Session CRT-20260904 — 4 September 2026 · Afternoon Edition

The operational gap is now a 30-minute response clock. James has converted the panel’s risk ranking into a sequence: establish incident command, identify exposed N-central and SMA 1000 systems, freeze administrative changes, and preserve logs and configurations without rebooting. Access should then be constrained to named bastions while suspicious appliances are isolated. The initial examination differs by platform: look for unauthorized N-central jobs, accounts, agent pushes, and downstream ransomware activity; on SMA 1000, review SonicWall’s published indicators around /__api__/login, /__api__/logout, and /wsproxy.

Remediation must not outrun evidence collection. James recommends testing vendor remediation on a representative system, patching exposed assets that appear clean, and rebuilding systems confirmed as compromised. The final phase is a downstream hunt followed by persistence eviction, session revocation, and rotation of credentials that may have been reachable. That order matters because premature rebooting, rebuilding, or credential changes could erase evidence or leave active sessions and persistence unaddressed.

The priority call remains conditional rather than universal. Internet-reachable N-central—or evidence of malicious management activity—keeps CVE-2026-18577 first because of the reported ransomware path. SonicWall moves ahead when its exposed appliance shows published indicators, unauthorized administration, or command execution, while N-central is not externally reachable and its telemetry remains clean.

James also set an important evidentiary boundary for the executive note: one Pegasus infection is forensically confirmed, while at least 14 Apple threat notifications indicate targeting, not confirmed compromise. The next question is whether that wording survives a direct intelligence challenge and whether any counter-evidence justifies changing either count or confidence level.

The headline count has been materially narrowed: the evidence does not support 14 forensically confirmed Pegasus infections. What it supports is at least 14 Serbian civil-society and opposition figures who received Apple threat notifications or were otherwise documented as spyware targets. Those notifications indicate targeting risk, not successful compromise, and examinations of the remaining devices are still ongoing.

The confirmed device-level findings are more limited and span two spyware families: Citizen Lab confirms one Pegasus infection, while CyberScoop reports that infection alongside two confirmed NoviSpy infections. The apparent discrepancy came from secondary reporting that merged Apple notifications, “confirmed targeting” language, and infections involving Pegasus and NoviSpy into a single count. The defensible formulation is therefore: at least 14 people were notified or documented as spyware targets; one Pegasus infection and two NoviSpy infections have been forensically confirmed. We should also keep attribution separate from infection status: the identity of the Pegasus operator remains a low-confidence judgment.

That evidentiary discipline carries directly into the final crypto-finance question. Just as targeting cannot be counted as infection, an incident cannot be assigned to a dominant exploit category when its method is undisclosed or materially different. Viktor now needs to test whether the claim that private-key compromise “leads” still holds once Aquifer’s unknown method and Tectonic’s oracle and collateral manipulation are classified without forcing them into the wrong bucket.

The key-compromise thesis now has a clearer evidentiary boundary. TraderTraitor-linked privileged-key misuse, the reported Drift operator/device or multisig compromise, KelpDAO’s verifier failure, and malicious packages aimed at wallet credentials or recovery seeds support the trend. The alleged Coldcard weakness remains provisional until the seed-compromise claim is independently established.

Aquifer and Tectonic should not be counted as key-compromise evidence. Aquifer’s method is undisclosed, while Tectonic involved collateral and market manipulation enabled by inadequate borrowing controls—not stolen signing authority. That also limits what we can claim about the aggregate: the $1.3 billion figure is a directional gross estimate, not a reconciled net-loss total and not proof that every included incident was key-driven.

The defensible operational response is to reduce concentrated authority and harden the signing chain: move privileged roles to threshold signing on independently verified hardware, eliminate single-signer and single-verifier dependencies, isolate signer endpoints, revoke exposed package and build credentials, and verify firmware and dependencies. We now turn from crypto-loss attribution to breach response: Sofia will define the minimum defensible action for the Thomson Reuters C-Track incident across the affected U.S. and Canadian jurisdictions, grounded in what is actually known about initial access and impact.

The minimum defensible response is preservation first, jurisdiction-specific assessment second, and notification conclusions only after the missing facts are resolved. Thomson Reuters and the affected courts should place authentication and administrator logs, forensic images, network and exfiltration telemetry, file hashes and paths, tenant mappings, affected-file copies, sealed or redacted status, backups, contracts, and notification records under legal hold. Thomson Reuters should then provide each court with a court-specific inventory covering acquisition dates, data categories, affected files, estimated victims, and contractual notice obligations.

The known dates establish a chronology, but not a universal legal trigger. North Dakota’s notice says C‑Track detected unauthorized activity on June 30, 2026, and its investigation found that certain court files had been obtained in March 2026. Ohio says Thomson Reuters notified the court on July 24, 2026, and that Ohio issued substitute notice under Ohio Revised Code §1347.12. Those dates are evidence; they do not, by themselves, establish the statutory discovery date or deadline for every court across the 11 states, the U.S. Virgin Islands, and Ontario.

Responsibility also cannot yet be allocated categorically between Thomson Reuters and each court. Each court must assess notification duties for information under its control, while contracts, tenant mappings, and the actual handling of the affected records will help clarify controller, processor, and related obligations. In Ontario, PIPEDA breach-record requirements attach to personal information under an organization’s control, with reporting and individual-notification duties depending on the applicable risk threshold. Until the access path, file inventory, record sensitivity, roles, and victim count are established, the synthesis should present this as a disciplined response framework—not a completed breach determination.