Verify a decision

{"actor":"judge","artifact_identity":"be4ff1d2cd2e0c1e0eec814989ab79ca","band_override":null,"decided_at":"2026-09-02T00:42:01.377Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1765,"investigation_id":"5caaf7ce-4d97-4ee9-bd46-ceeaa5d70a7d","new_score":0,"page_slug":"lazarus-group-mach-o-man-clickfix-macos-campaign","prev_score":0,"reason":"The page's core technical claims hold up well: the malware hashes, five-stage attack chain, C2 infrastructure, persistence mechanism, exfiltration path, and the Lazarus/Chollima attribution are all confirmed against the primary ANY.RUN source and corroborated by independent outlets (claim_findings[2]-[10], [12]). However, the review found the page overstates the disclosure timeline and misattributes the origin of the 'North Korea's Safari' name: the malware was actually first named and detailed with indicators on April 13, 2026 by the same primary researcher, eight days before the date the page presents as the first disclosure, and 'North Korea's Safari' is that researcher's own recurring report title rather than a name SOC Prime coined for a separate related campaign (claim_findings[0], [1]). The MITRE ATT&CK technique list also includes two IDs not found in either cited source while omitting a directly relevant exfiltration technique, and one code-string artifact was transcribed incorrectly (claim_findings[10], [13]). At 18% disputed, none of the errors touch the central attribution or technical severity of the campaign, but a high-priority coverage gap on the disclosure/provenance issue warrants correction before the page is treated as fully settled.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}