Correction: the first-seen date of attacker infrastructure was recorded as an exploitation date
Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.
- id
- CHQ-CORR-2026-035
- class
- CORRECTION
- subtype
- counting
- status
- IN FORCE
- authority
- DM ratified 2026-11-12
- effective
- 2026-11-12
- published
- 2026-11-12
- title
- Correction: the first-seen date of attacker infrastructure was recorded as an exploitation date
- what was wrong
- On SN-2026-11-09-01, a candidate on Autonomous AI Attack Operations, the exploitation date was recorded as 19 October 2026. In the source that is the date an attacker server was first seen. The source dates the campaign only to October 2026 and gives no exploitation date.
- what is true
- No exploitation date is established for the operation. The 19 October observation concerns infrastructure.
- what changed
- The exploitation date is cleared and the observation is kept, labelled as infrastructure first seen. Corrected the day the row was written.
- what did not change
- No count, rating, Outlook or Watch. The row is a held candidate and no interval was published from it.
- control analysis
- Treating an infrastructure observation as exploitation manufactures a pre-disclosure interval. No mechanical control distinguishes the two; the distinction is recorded as a rule for the analyst.
- found by
- An external review on the day of entry, verified against the source.