# An incident-response or threat-intelligence provider documents a new attack, the modification after issuance, in which a malicious modification of a trusted software distribution channel persisted for less than 60 minutes in at least one window and delivered malicious content to at least one downstream system through that same window, by 2027-04-26T12:30Z. EXPERIMENTAL.

- **Artifact ID:** SO-2026-017
- **Status:** OPEN
- **Public record:** https://record.cybersecurityhq.com/forecasts/so-2026-017
- **Machine-record SHA-256:** `43e58d588afce418fba4dd38759442371010c811d5334e3426dfde60a1f45ba5`

## Complete structured record

```json
{
  "id": "SO-2026-017",
  "class": "EVENT",
  "claim": "An incident-response or threat-intelligence provider documents a new attack, the modification after issuance, in which a malicious modification of a trusted software distribution channel persisted for less than 60 minutes in at least one window and delivered malicious content to at least one downstream system through that same window, by 2027-04-26T12:30Z. EXPERIMENTAL.",
  "issued": "2026-10-26T12:30:00Z",
  "probability": 0.25,
  "benchmark": 0.2,
  "benchmark_kind": "ANALYST_PRIOR",
  "benchmark_basis": "One documented case (AOMEI, GTIG/Mandiant 15 Oct: windows of 10, 6 and 5 minutes; delivery evidenced by endpoint telemetry). 60-minute threshold chosen to test the failure mode shown rather than day-scale compromises. Durations are rarely stated; publication-constrained rate is low.",
  "adjustment": 0.05,
  "resolution_rule": "YES if a primary investigation establishes (a) the malicious change, named; (b) duration stated or bounded under 60 minutes for at least one window; (c) delivery to at least one downstream system through that window, evidenced on the system or in provider telemetry, not inferred; (d) modification after ISSUED_TS.",
  "admissibility": "Grade A on (a) and (c); exclusions: no stated duration; shortest window 60 minutes or longer; typosquat or dependency confusion; research proofs.",
  "exclusions": "no stated duration; shortest window 60 minutes or longer; typosquat or dependency confusion; research proofs.",
  "resolves": "2027-04-26T12:30:00Z",
  "status": "OPEN",
  "outcome_date": null,
  "outcome_basis": null,
  "brier": null,
  "benchmark_brier": null,
  "resolution_source": "EXTERNAL",
  "experimental": true,
  "false_positive_cost": "A YES on a modified server with no delivered payload would reward a near miss.",
  "ledger_hash": "d2c9e86c0519d259",
  "revision_log": [
    "2026-11-06 (CHQ-CORR-2026-033): ledger hash corrected from the shared placeholder c2f1ab40c70d9013 to the per-entry digest d2c9e86c0519d259, recomputed from the declared serialization of identifier, claim, probability, issued timestamp and resolution rule. Claim, probability, issued timestamp and resolution rule unchanged."
  ],
  "record_links": [
    "CHQ-CORR-2026-033"
  ]
}
```