RUN AUDIT
سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Select the freshest highest-impact non-duplicate Threat Actor & Infrastructure development using freshness + technical impact + evidence strength + real-world exploitation + defensive value; preserve attribution and infrastructure-provenance boundaries.
NEW_TOPIC_RUN_SCOPED
Research result: PASS
Selected DPRK-nexus PHP2Shell low-and-slow scanning/infrastructure rotation. Verified 216-host filtered target set and 21 compromised scan nodes from CYFIRMA; independently verified broad pre/post-disclosure exploitation pressure via AWS/Cloudflare/Sophos and PHP/NCSC-NL exposure baseline; preserved Lazarus-link and successful-compromise limits.
EVIDENCE
CONTRADICTIONS
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
FOLLOW-UP
Public evidence supports DPRK-nexus activity but does not independently resolve a specific Lazarus subcluster or equivalence with TraderTraitor/Onyx Sleet/Pearl Sleet.
No reliable campaign-specific denominator exists for successful compromise among the 216 reported filtered hosts; scanning/attempts are not compromise.
Ownership/control and current continuity of the 21 scan nodes and earlier staging infrastructure remain incomplete; compromised relays may rotate or be abandoned.
AUDIT TIMELINE
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
PERSISTENCE / READBACK
COMMITTED · Readback PASS
SELF
Integrity: PASS · غير مسجل
Evidence 20 · Hypotheses 12 · Runs 3
Commit: PASS · Readback: PASS · Closure: PASS
PASS — atomic canonical commit/readback exact; Hot-Start affected-slice refresh/readback PASS (4 hypotheses, 3 gaps, 1 watch, 1 run, 1 topic head, Domain Head updated); Commit ACRIP-COMMIT-TAI-6D2F91A4 COMMITTED/PASS; protected Core root 597ca514575a926e202096be60f1a040dd63bfbb99ae07f7bf6d061e482c6b2c unchanged. Run package: https://docs.google.com/document/d/1yHSZ-VKlujibSa7rAlyUn-T-ao-MkoOAA-PFHm7PlJU/edit
NEW — CYFIRMA reports 216 filtered targets and 21 compromised scan nodes with low-and-slow rotation; AWS/Cloudflare/Sophos independently establish broad PHP2Shell exploitation pressure and one unrelated successful exploit; final Lazarus subcluster identity and campaign-specific compromise scale remain open.