Provenance Record

Clear, well-structured News piece (674 words, within the 400-1200 News range). The Overview/What We Know/AI and RICO Angle/What We Don't Know structure cleanly separates the law-enforcement takedown from Microsoft's parallel legal action. Each claim carries an inline source attribution.

All 5 source snapshots read from disk and verified. source-0 (The Record, 200): confirms June 24 announcement, '326 servers and 142 domains', EUR41M/USD47M crypto, 27M credentials, '140,000+ infected computers in the first two weeks of May', StealC capturing 'passwords, cookies and session tokens' (verbatim), SocGholish phony-browser-update mechanism. source-1 (Help Net Security, 200): confirms '326 servers and 142 domains', 'over 41 million euros (approximately 47 million US dollars)' (verbatim), 'nearly 27 million stolen login credentials', Masada quote 1 'Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information' (VERBATIM), 'over 18,000 victim computers' (Microsoft figure per Masada), Proofpoint/IBM X-Force/Eurojust partners. source-2 (The Register, 200): confirms civil RICO claims against five defendants, the 'Malware as a Service enterprise ... Amadey Malware Suite and StealC Malware Suite' court-document quote (verbatim), the shared-infrastructure-as-single-conspiracy framing, and the Masada AI quotes. source-3 (Microsoft Security Blog, 200): confirms 'over 200 malicious Amadey and StealC command-and-control domains and IPs' (verbatim) and the ransomware-entry-point context. source-4 (CyberInsider, 200): confirms the six-country list 'Canada, Denmark, Germany, the Netherlands, the UK, and the US' (verbatim, single-source), '14,971 compromised websites' (verbatim), and SocGholish/FakeUpdates/Evil Corp attribution (verbatim).

The two distinct figure sets are NOT conflated. Europol-action figures (326 servers, 142 domains, ~USD47M, ~27M credentials) are attributed to The Record/Help Net; Microsoft's own figures (over 200 C2 domains/IPs, 18,000 victim computers) are attributed to the Microsoft blog/Help Net. The 'What We Don't Know' section explicitly flags that the relationship between the 326/142 tally and the 'over 200' C2 endpoints is not spelled out in the sources. The six-country list is correctly attributed only to CyberInsider. The Hacker News (which returned 403) is not cited. One issue: the AI quote attributed to Masada, 'We used Copilot and other AI tools to analyze both malwares and their infrastructure, asking questions in plain English instead of manually combing through complex code,' wraps in quotation marks a span that The Register rendered partly as a third-person paraphrase ('Redmond's investigators used Copilot and other AI tools to analyze both malwares and their infrastructure') with only the 'asking questions in plain English...' clause in direct quotes. The second fragment ('surface key details, uncover hidden data, and test findings in a fraction of the time, turning what would have taken hours or days into minutes') is verbatim from The Register. The substance of the first fragment is accurate and independently supported by the Microsoft blog, but the quote boundary is imprecise — handled via a corrections record.

Substantively accurate, well-sourced News article that correctly keeps the Europol and Microsoft figure sets distinct and flags their unspecified relationship. The single quote-boundary imprecision on the first Masada AI quote is minor and honestly summarizable, so APPROVE_WITH_CORRECTIONS with a corrections record rather than REJECT.