{ "schema": "affine.bad_actor_library.v5", "study_id": "STUDY-68", "title": "Sovereign 5-Iteration Bad-Actor Library & 8D M_8 Unmasking Encyclopedia Over M_8 = S^4 x C^4 subset Z^8", "total_iterations": 5, "total_profiles": 40, "no_float": 1, "fnv1a_seal": "b1189f6410414002", "m8_cannot_hide_proof": { "surface_mutations_attempted": 60, "c4_collapsed_origins": 1, "bareiss_c2_origin_km": [320, 180, 25], "peel_chain_terminal_units": 48950000000, "float32_adversary_deaf_at_hop": 6, "scammer_final_roi_after_tarpit": 0, "all_8_axes_locked": true }, "iterations": [ { "iteration": 1, "code": "IT1_INFRA_BOTNETS", "title": "Iteration 1: Network, Botnet, AI-Key & Cloud Credential Harvesters", "avg_risk_rational": "94/100", "profile_count": 8 }, { "iteration": 2, "code": "IT2_FINANCIAL_SOCIAL_SCAMS", "title": "Iteration 2: Online Financial, Voice-Clone & Social-Engineering Syndicates", "avg_risk_rational": "96/100", "profile_count": 8 }, { "iteration": 3, "code": "IT3_WEB3_PROTOCOL_POISON", "title": "Iteration 3: Web3 Bytecode Drainers, Homograph Kits & Protocol Poisoners", "avg_risk_rational": "95/100", "profile_count": 8 }, { "iteration": 4, "code": "IT4_KINETIC_CRISIS_SWARM", "title": "Iteration 4: Kinetic, Physical-Security, Crisis & Multi-Domain Swarm Actors", "avg_risk_rational": "95/100", "profile_count": 8 }, { "iteration": 5, "code": "IT5_DEEPFAKE_AI_PHYSICAL", "title": "Iteration 5: Real-Time Deepfake Video, MCP Poisoning, Quishing & Courier Rings", "avg_risk_rational": "97/100", "profile_count": 8 } ], "profiles": [ { "actor_id": "BA-IT1-01", "iteration": 1, "category_tag": "AI_KEY_AND_CLAUDE_AGENT_THIEF", "title": "Autonomous AI API-Key & Agent Workspace Harvester", "origin": "109.160.32.0/24 (ASN 43624 · 1,420 probes/24h across hel-00..04 & nbg-00..03)", "m8_signature": { "asn_or_zone": 43624, "tau_window_sec": 15, "closure_rate": 1420, "iota": 1, "attacker_roi_epsilon": 920, "required_tarpit_b": 1000, "arousal_alpha": 850, "fiedler_kappa": 2048 }, "iocs": ["109.160.32.0/24", "109.160.32.171", "109.160.32.139", "user=claude", "user=aiuser", "user=ollama", "/.anthropic/api_key", "/.openai/config.json", "/.env"], "deception_game": "Sweeps developer & AI agent hosts via automated SSH/HTTP probes for claude, aiuser, and .env files to hijack paid LLM quotas and agent credentials.", "counter_law": "Ed25519 Key-Only SSH + 15s Noble Warrior ss -K dst 109.160.32.0/24 socket severing + Kernel L3 Blackhole across 9/9 cells.", "takedown_cmd": "ip route replace blackhole 109.160.32.0/24 && ss -K dst 109.160.32.0/24", "risk_rational": "96/100" }, { "actor_id": "BA-IT1-02", "iteration": 1, "category_tag": "SOLANA_VALIDATOR_KEYPAIR_DRAINER", "title": "Solana Validator Identity & Vote-Account Keypair Sweeper", "origin": "195.178.110.0/24 (ASN 212238 · 412 probes/24h)", "m8_signature": { "asn_or_zone": 212238, "tau_window_sec": 12, "closure_rate": 412, "iota": 1, "attacker_roi_epsilon": 950, "required_tarpit_b": 1000, "arousal_alpha": 880, "fiedler_kappa": 1536 }, "iocs": ["195.178.110.0/24", "user=solana", "user=solv", "user=sol", "/.config/solana/id.json", "validator-keypair.json", "port=8899"], "deception_game": "Scans bare-metal ASN ranges for default solana/solv accounts to exfiltrate unencrypted Ed25519 id.json keypairs.", "counter_law": "L3 Kernel Blackhole 195.178.110.0/24 + Hardware Remote-Signer Isolation (< 1 us drop).", "takedown_cmd": "ip route replace blackhole 195.178.110.0/24 && ss -K dst 195.178.110.0/24", "risk_rational": "97/100" }, { "actor_id": "BA-IT1-03", "iteration": 1, "category_tag": "CRYPTO_VALIDATOR_HOT_WALLET_THIEF", "title": "Multi-Chain Validator Hot-Wallet & RPC Port Exploiter", "origin": "2.57.121.0/23 (ASN 210558 · 318 probes/24h)", "m8_signature": { "asn_or_zone": 210558, "tau_window_sec": 15, "closure_rate": 318, "iota": 1, "attacker_roi_epsilon": 910, "required_tarpit_b": 1000, "arousal_alpha": 840, "fiedler_kappa": 1400 }, "iocs": ["2.57.121.0/23", "2.57.122.0/24", "user=validator", "user=admin", "eth_sendTransaction", "port=8545", "port=8546"], "deception_game": "Sweeps :8545/:8546 JSON-RPC and SSH validator accounts simultaneously to sign unauthorized outbound sweep transactions.", "counter_law": "Bind RPC exclusively to 127.0.0.1 + AFFINE_DARK_SHIELD iptables drop + L3 Blackhole 2.57.121.0/23.", "takedown_cmd": "ip route replace blackhole 2.57.121.0/23 && ip route replace blackhole 2.57.122.0/24", "risk_rational": "95/100" }, { "actor_id": "BA-IT1-04", "iteration": 1, "category_tag": "WEB3_KEYSTORE_AND_DOTENV_SCRAPER", "title": "Automated .env, .git/config & Cloud Secret Spider", "origin": "45.148.10.0/24 (ASN 212047 · 289 probes/24h)", "m8_signature": { "asn_or_zone": 212047, "tau_window_sec": 20, "closure_rate": 289, "iota": 1, "attacker_roi_epsilon": 890, "required_tarpit_b": 950, "arousal_alpha": 810, "fiedler_kappa": 1280 }, "iocs": ["45.148.10.0/24", "GET /.env", "GET /.git/config", "GET /aws/credentials", "GET /docker-compose.yml", "AWS_SECRET_ACCESS_KEY"], "deception_game": "Sprays HTTP GET requests for misconfigured .env and .git/config endpoints to harvest AWS/Stripe/OpenAI keys within 60s.", "counter_law": "Strict dotfile refusal (403/404) + Canary-Token Honeypot (sigma_A -> 1) + L3 Blackhole 45.148.10.0/24.", "takedown_cmd": "ip route replace blackhole 45.148.10.0/24 && ss -K dst 45.148.10.0/24", "risk_rational": "93/100" }, { "actor_id": "BA-IT1-05", "iteration": 1, "category_tag": "DEVOPS_CI_RUNNER_AND_DEPLOY_HIJACKER", "title": "CI/CD Runner, Docker Socket & Deploy-Account Botnet", "origin": "77.239.124.0/24 (ASN 49870 · 540 probes/24h)", "m8_signature": { "asn_or_zone": 49870, "tau_window_sec": 18, "closure_rate": 540, "iota": 1, "attacker_roi_epsilon": 880, "required_tarpit_b": 950, "arousal_alpha": 820, "fiedler_kappa": 1600 }, "iocs": ["77.239.124.0/24", "user=deploy", "user=github", "user=gitlab-runner", "port=2375", "/v1.40/containers/json"], "deception_game": "Targets deploy/runner SSH accounts and unauthenticated :2375 Docker sockets to inject supply-chain backdoors.", "counter_law": "Zero exposed Docker TCP sockets + Ed25519 deploy keys + L3 Blackhole 77.239.124.0/24.", "takedown_cmd": "ip route replace blackhole 77.239.124.0/24 && ss -K dst 77.239.124.0/24", "risk_rational": "92/100" }, { "actor_id": "BA-IT1-06", "iteration": 1, "category_tag": "ETHEREUM_GETH_KEYSTORE_DRAINER", "title": "Ethereum Geth/Beacon UTC--* Keystore Exfiltrator", "origin": "179.43.153.0/24 (ASN 51396 · 164 probes/24h)", "m8_signature": { "asn_or_zone": 51396, "tau_window_sec": 25, "closure_rate": 164, "iota": 1, "attacker_roi_epsilon": 900, "required_tarpit_b": 960, "arousal_alpha": 800, "fiedler_kappa": 1152 }, "iocs": ["179.43.153.0/24", "user=eth", "user=geth", "user=beacon", "/.ethereum/keystore/UTC--", "personal_unlockAccount"], "deception_game": "Probes eth/geth users and execution-layer RPCs to pull encrypted UTC--* scrypt keystores and password files.", "counter_law": "L3 Kernel Blackhole 179.43.153.0/24 + Engine-API JWT authentication.", "takedown_cmd": "ip route replace blackhole 179.43.153.0/24 && ss -K dst 179.43.153.0/24", "risk_rational": "94/100" }, { "actor_id": "BA-IT1-07", "iteration": 1, "category_tag": "NATS_AND_CLUSTER_BUS_RECON_SCANNER", "title": "Internal Message-Bus & Telemetry Port Recon Spider (:4222/:8222)", "origin": "176.53.159.0/24 (ASN 42926 · 1,980 probes/24h)", "m8_signature": { "asn_or_zone": 42926, "tau_window_sec": 10, "closure_rate": 1980, "iota": 1, "attacker_roi_epsilon": 860, "required_tarpit_b": 1000, "arousal_alpha": 830, "fiedler_kappa": 2304 }, "iocs": ["176.53.159.0/24", "176.53.159.98", "GET :8222/varz", "GET :8222/connz", "port=4222", "port=6222", "port=8787", "port=9222"], "deception_game": "Maps distributed cluster topologies by querying unauthenticated :8222/varz NATS monitoring endpoints and :4222 pub/sub buses.", "counter_law": "AFFINE_DARK_SHIELD kernel iptables chain sealing ports 4222, 6222, 8222, 8787, 9222 to 127.0.0.1 and the 9 fleet peers only.", "takedown_cmd": "iptables -I AFFINE_DARK_SHIELD -s 176.53.159.0/24 -j DROP && ip route replace blackhole 176.53.159.0/24", "risk_rational": "95/100" }, { "actor_id": "BA-IT1-08", "iteration": 1, "category_tag": "HIGH_CADENCE_SSH_DICTIONARY_STORM", "title": "Coordinated 8,223/hr SSH Dictionary & Root Brute-Force Syndicate", "origin": "79.175.176.177/32 & 204.168.147.102/32 & 121.184.65.150/32 (176,523 probes/24h)", "m8_signature": { "asn_or_zone": 58224, "tau_window_sec": 5, "closure_rate": 8223, "iota": 1, "attacker_roi_epsilon": 840, "required_tarpit_b": 1000, "arousal_alpha": 900, "fiedler_kappa": 3072 }, "iocs": ["79.175.176.177/32", "204.168.147.102/32", "121.184.65.150/32", "sshd: Failed password for root", "pam_unix(sshd:auth): authentication failure"], "deception_game": "Floods port :22 at 8,223 attempts/hour across nbg-00 and hel-03 to exhaust sshd worker slots and crack passwords.", "counter_law": "/etc/ssh/sshd_config.d/00-affine-dark-shield.conf (PasswordAuthentication no, PermitRootLogin without-password, MaxAuthTries 3) + L3 blackhole.", "takedown_cmd": "ip route replace blackhole 79.175.176.177/32 && ip route replace blackhole 204.168.147.102/32 && ip route replace blackhole 121.184.65.150/32", "risk_rational": "94/100" }, { "actor_id": "BA-IT2-01", "iteration": 2, "category_tag": "APP_BANK_FRAUD_SPOOF_DESK", "title": "Authorized Push-Payment (APP) Spoofed Bank 'Fraud Department' Ring", "origin": "Spoofed Institutional Caller-ID + 'Safe Vault' Wire/Zelle Redirect Syndicate", "m8_signature": { "asn_or_zone": 2001, "tau_window_sec": 300, "closure_rate": 60, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 1080, "arousal_alpha": 940, "fiedler_kappa": 1800 }, "iocs": ["spoofed_bank_caller_id", "transfer to a Federal Reserve safe account", "do not tell the branch teller", "read back the 6-digit Zelle OTP", "compromised insider at your local branch"], "deception_game": "Spoofs bank caller ID (iota=0), spikes panic (alpha=940), isolates victim from bank tellers (lambda_2 -> 0), and rushes an irreversible wire/Zelle transfer within 300s.", "counter_law": "Game 2.1 Out-of-Band Partition (lambda_2=0: hang up, wait 5s, dial metal card number) + Game 2.3 Checksum Tarpit (+1,080s delay drains scammer ROI 1000 -> 0).", "takedown_cmd": "OUT_OF_BAND_PARTITION(lambda2=0) && CHECKSUM_TARPIT(ticks=6, delaySec=1080, roiRemaining=0)", "risk_rational": "98/100" }, { "actor_id": "BA-IT2-02", "iteration": 2, "category_tag": "AI_VOICE_CLONE_KIDNAP_BAIL_RING", "title": "3-Second AI Voice-Clone Grandparent / Kidnap / Bail Extortion Syndicate", "origin": "Zero-Shot TTS Voice-Cloning + Bitcoin ATM / Gift-Card Courier Ring", "m8_signature": { "asn_or_zone": 2002, "tau_window_sec": 240, "closure_rate": 80, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 1200, "arousal_alpha": 980, "fiedler_kappa": 1600 }, "iocs": ["Grandma please do not tell Mom or the bank", "I was in a car accident and arrested", "public defender needs $4,000 bail in Apple Gift Cards", "Bitcoin ATM QR code", "gag order do not call my phone"], "deception_game": "Scrapes 3s of a relative's voice from social video, injects crying/static (alpha=980), enforces secrecy, and demands Gift Cards or Bitcoin ATM deposits.", "counter_law": "Game 2.2 Pre-Committed Family Nonce (iota in {0,1}: demand Family Safe-Word LIGHTNING-JUNTO + 4-digit PIN; if iota==0, sever call in < 1s).", "takedown_cmd": "VERIFY_FAMILY_NONCE(seed='FRANKLIN-JUNTO-FAMILY-2026') -> IF_IOTA_ZERO_HANG_UP_AND_CALL_RELATIVE_DIRECT", "risk_rational": "99/100" }, { "actor_id": "BA-IT2-03", "iteration": 2, "category_tag": "SHA_ZHU_PAN_PIG_BUTCHERING_SYNDICATE", "title": "Pig-Butchering (Sha Zhu Pan) Romance & Spoofed Crypto Exchange Syndicate", "origin": "Compound-Hosted Social Grooming + Rotating .top/.xyz Fake DEX/MT5 Kit Cluster", "m8_signature": { "asn_or_zone": 2003, "tau_window_sec": 1800, "closure_rate": 30, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 1500, "arousal_alpha": 790, "fiedler_kappa": 2400 }, "iocs": ["wrong number SMS hook", "let's move to WhatsApp or Telegram", "exclusive gold/USDT quantitative node", "20% AML tax fee required before withdrawal", "rotating-lure-0-1.top"], "deception_game": "Initiates wrong-number SMS contact, migrates to encrypted chat, shows fabricated trading gains, and blocks withdrawal behind a fabricated '20% AML/tax release fee'.", "counter_law": "Never pay external fees to unlock a withdrawal + Study 67 C4SyndicateInvariant kit-hash deduplication & 10-hop Peel-Chain exact conservation trace.", "takedown_cmd": "AUDIT_C4_SYNDICATE_KIT(kitAstHash=0xA11CE001) && TRACE_PEEL_CHAIN_EXACT_INT(hops=10)", "risk_rational": "97/100" }, { "actor_id": "BA-IT2-04", "iteration": 2, "category_tag": "REMOTE_ACCESS_REFUND_OVERPAYMENT_RING", "title": "Tech-Support AnyDesk / TeamViewer Fake Overpayment Refund Trap", "origin": "Call-Center Refund Script + Browser DOM Inspect-Element Balance Manipulation Ring", "m8_signature": { "asn_or_zone": 2004, "tau_window_sec": 420, "closure_rate": 50, "iota": 0, "attacker_roi_epsilon": 950, "required_tarpit_b": 1080, "arousal_alpha": 890, "fiedler_kappa": 1500 }, "iocs": ["GeekSquad/Norton auto-renewal $450", "accidentally refunded $4,500 instead of $450", "install AnyDesk or TeamViewer or UltraViewer", "wire back the $4,050 difference", "black screen privacy mode"], "deception_game": "Claims an accidental $4,500 refund, connects via AnyDesk, edits bank HTML locally, and pressures victim to wire or buy gift cards for the $4,050 difference.", "counter_law": "Never install remote-desktop tools for inbound callers + Game 2.5 Malicious Compliance Checksum Loop (0x80070005_SOCKET_CLOSED).", "takedown_cmd": "BLOCK_REMOTE_DESKTOP_PORTS(anydesk,teamviewer) && MALICIOUS_COMPLIANCE_TARPIT(error='0x80070005')", "risk_rational": "95/100" }, { "actor_id": "BA-IT2-05", "iteration": 2, "category_tag": "GOVERNMENT_WARRANT_GIFT_CARD_COERCION", "title": "Spoofed IRS / Sheriff / Customs Warrant & Gift-Card Bond Extortionist", "origin": "VoIP Caller-ID Spoofing + Badge-Number Coercion Script", "m8_signature": { "asn_or_zone": 2005, "tau_window_sec": 360, "closure_rate": 65, "iota": 0, "attacker_roi_epsilon": 920, "required_tarpit_b": 1080, "arousal_alpha": 950, "fiedler_kappa": 1400 }, "iocs": ["active federal arrest warrant", "Social Security number suspended", "Missed jury duty bench warrant", "pay bond via Apple Gift Cards or Coinstar kiosk", "stay on the line until you reach the store"], "deception_game": "Weaponizes fear of arrest (alpha=950), demanding continuous phone connection while driving victim to a retail gift-card rack or crypto kiosk.", "counter_law": "Constitutional Invariant: 0 courts, sheriffs, or tax agencies ever accept gift cards or crypto kiosks + Out-of-Band Partition.", "takedown_cmd": "INVARIANT_GOVT_NEVER_TAKES_GIFTCARDS && OUT_OF_BAND_PARTITION(lambda2=0)", "risk_rational": "96/100" }, { "actor_id": "BA-IT2-06", "iteration": 2, "category_tag": "BEC_VENDOR_INVOICE_IBAN_INTERCEPT", "title": "Business Email Compromise (BEC) Vendor Wire & IBAN Swap Syndicate", "origin": "Lookalike Domain (rn vs m) + Compromised Thread Rules Forwarding Actor", "m8_signature": { "asn_or_zone": 2006, "tau_window_sec": 600, "closure_rate": 40, "iota": 0, "attacker_roi_epsilon": 980, "required_tarpit_b": 1200, "arousal_alpha": 820, "fiedler_kappa": 1900 }, "iocs": ["updated ACH/SWIFT wire instructions", "our primary bank account is undergoing audit", "please settle invoice #9042 to new beneficiary IBAN", "hidden inbox rule forward-and-delete"], "deception_game": "Monitors accounting threads via OAuth token or lookalike domain, injecting a last-minute PDF invoice with swapped SWIFT/ACH routing numbers.", "counter_law": "Mandatory Out-of-Band Voice + Pre-Shared Vendor Nonce (iota=1) for any bank-routing mutation + Golden-24h SWIFT Recall.", "takedown_cmd": "REQUIRE_OOB_VOICE_NONCE_ON_IBAN_CHANGE && AUDIT_INBOX_FORWARD_RULES", "risk_rational": "97/100" }, { "actor_id": "BA-IT2-07", "iteration": 2, "category_tag": "SIM_SWAP_AND_MFA_FATIGUE_CALLER", "title": "SIM-Swap Port-Out & MFA Push-Fatigue Social-Engineering Crew", "origin": "Telecom Retail Port-Out + Push-Bombing Kit", "m8_signature": { "asn_or_zone": 2007, "tau_window_sec": 180, "closure_rate": 90, "iota": 0, "attacker_roi_epsilon": 960, "required_tarpit_b": 1080, "arousal_alpha": 930, "fiedler_kappa": 2100 }, "iocs": ["25 consecutive Duo/Okta MFA push notifications", "IT Helpdesk calling to stop spam pushes", "SOS Only / No Service sudden cellular drop", "carrier port-out PIN request"], "deception_game": "Bombards target's phone with MFA push requests at 2 AM (alpha=930), then calls posing as 'Corporate Security' asking user to tap Approve once.", "counter_law": "Origin-bound FIDO2/WebAuthn hardware passkeys + Carrier Account Port-Freeze Lock.", "takedown_cmd": "ENFORCE_FIDO2_ORIGIN_BOUND_KEY && LOCK_CARRIER_PORT_FREEZE", "risk_rational": "96/100" }, { "actor_id": "BA-IT2-08", "iteration": 2, "category_tag": "ELDER_MEDICARE_AND_IDENTITY_HARVESTER", "title": "Elder Medicare Chip-Card, Genetic Swab & PII Harvesting Boiler Room", "origin": "High-Volume Autodialer Spoofing Local Area Codes (NPA-NXX Neighbor Spoof)", "m8_signature": { "asn_or_zone": 2008, "tau_window_sec": 480, "closure_rate": 45, "iota": 0, "attacker_roi_epsilon": 870, "required_tarpit_b": 960, "arousal_alpha": 780, "fiedler_kappa": 1300 }, "iocs": ["new plastic chip Medicare card requirement", "free DNA cancer/cardiac swab kit", "verify your 11-character Medicare Beneficiary Identifier", "back brace prescription approval"], "deception_game": "Uses neighbor-spoofed caller ID (iota=0) to claim benefits will expire unless the senior confirms their Medicare ID, SSN, and bank routing number.", "counter_law": "Zero-Trust PII Gate (iota == 0 => REFUSE_PII) + Game 2.4 Synthetic Canary Identity Token (sigma_A -> 1).", "takedown_cmd": "REFUSE_INBOUND_PII_REQUEST(iota=0) && DEPLOY_CANARY_HONEYPOT(sigmaA=1)", "risk_rational": "91/100" }, { "actor_id": "BA-IT3-01", "iteration": 3, "category_tag": "EVM_UNLIMITED_APPROVE_DRAINER", "title": "ERC-20 / NFT Unlimited Allowance Wallet-Drainer Kit (0x095ea7b3 / 0xa22cb465)", "origin": "Drainer-as-a-Service (80/20 Affiliate Split · Kit AST 0xA11CE001)", "m8_signature": { "asn_or_zone": 49981, "tau_window_sec": 60, "closure_rate": 120, "iota": 0, "attacker_roi_epsilon": 990, "required_tarpit_b": 1000, "arousal_alpha": 910, "fiedler_kappa": 2200 }, "iocs": ["0x095ea7b3", "0xa22cb465", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "setApprovalForAll(address,bool=true)", "claim-airdrop-reward.top"], "deception_game": "Disguises an unlimited ERC-20 approve(spender, uint256.max) or setApprovalForAll(operator, true) transaction as a 'Claim Airdrop' button.", "counter_law": "Calldata Selector Gate: deterministically refuse 0x095ea7b3 / 0xa22cb465 where allowance limb == 0xFFFF_FFFF_FFFF_FFFF to an unverified contract.", "takedown_cmd": "REFUSE_EVM_CALLDATA(selector='0x095ea7b3', uint256Max=true) && BLACKHOLE_KIT_AST(0xA11CE001)", "risk_rational": "99/100" }, { "actor_id": "BA-IT3-02", "iteration": 3, "category_tag": "PERMIT2_OFFCHAIN_EIP712_DRAINER", "title": "Gasless EIP-2612 permit & Uniswap Permit2 Off-Chain Signature Drainer (0xd505accf)", "origin": "EIP-712 Typed-Data Phishing Kit (0xB22DF002 · ASN 209605)", "m8_signature": { "asn_or_zone": 209605, "tau_window_sec": 45, "closure_rate": 140, "iota": 0, "attacker_roi_epsilon": 985, "required_tarpit_b": 1000, "arousal_alpha": 900, "fiedler_kappa": 2150 }, "iocs": ["0xd505accf", "PermitSingle", "PermitBatch", "eth_signTypedData_v4", "deadline=281474976710655"], "deception_game": "Tricks user into signing an off-chain EIP-712 Permit2 message that grants the drainer contract total token transfer authority without gas.", "counter_law": "Inspect EIP-712 spender and sigDeadline in exact integer limbs; block any off-chain PermitSingle/PermitBatch to an unverified spender.", "takedown_cmd": "REFUSE_EIP712_PERMIT2(selector='0xd505accf', unverifiedSpender=true)", "risk_rational": "98/100" }, { "actor_id": "BA-IT3-03", "iteration": 3, "category_tag": "VANITY_ADDRESS_POISONING_BOT", "title": "160-Bit Prefix/Suffix Vanity Address-Poisoning & Zero-Value Transfer Bot", "origin": "Automated Mempool Watcher + Profanity2 GPU Vanity Address Generator", "m8_signature": { "asn_or_zone": 3003, "tau_window_sec": 90, "closure_rate": 100, "iota": 0, "attacker_roi_epsilon": 940, "required_tarpit_b": 1000, "arousal_alpha": 840, "fiedler_kappa": 1700 }, "iocs": ["0x8f92...0000...a41b", "zero-value ERC20 transferFrom", "matching 4-byte prefix and 4-byte suffix", "counterfeit USDT dust transfer"], "deception_game": "Watches outbound transfers, computes a vanity address matching the first 4 and last 4 hex characters, and injects a 0-value tx into victim's history.", "counter_law": "Full 160-Bit (5 x 32-bit integer limb) Interior-Byte Verification: require exact match across middle bits [32..127].", "takedown_cmd": "VERIFY_ALL_5_UINT32_ADDRESS_LIMBS(bits_0_to_159) -> REFUSE_INTERIOR_MISMATCH", "risk_rational": "96/100" }, { "actor_id": "BA-IT3-04", "iteration": 3, "category_tag": "IDN_PUNYCODE_HOMOGRAPH_KIT", "title": "IDN Punycode (xn--) Cyrillic/Greek Mixed-Script Lookalike Domain Kit", "origin": "Homograph Registrar Cluster (xn--pple-43d.com · Kit AST 0xC33EF003)", "m8_signature": { "asn_or_zone": 13335, "tau_window_sec": 120, "closure_rate": 85, "iota": 0, "attacker_roi_epsilon": 930, "required_tarpit_b": 1000, "arousal_alpha": 860, "fiedler_kappa": 1850 }, "iocs": ["xn--", "xn--pple-43d.com", "аpple-support.top (U+0430 Cyrillic a)", "paypaI-security.xyz", ".top/.xyz/.zip/.click"], "deception_game": "Substitutes Cyrillic a (U+0430), e (U+0435), or o (U+043E) inside trusted brand domains so DNS resolves xn--pple-43d.com.", "counter_law": "UTF-32 Codepoint Bitwise Script-Mixing Detector (charCodeAt(i) > 127 in hostname or xn-- prefix -> immediate S1_HOMOGRAPH_PHISHING_DOMAIN block).", "takedown_cmd": "DETECT_UTF32_SCRIPT_MIXING(nonAsciiHost > 0 || punycode='xn--') -> BLOCK_AND_REPORT_REGISTRAR", "risk_rational": "95/100" }, { "actor_id": "BA-IT3-05", "iteration": 3, "category_tag": "IEEE754_FLOAT_POISON_INJECTOR", "title": "IEEE-754 Float-Poison (NaN / 1e-9 / 0.30000000000000004) & Peel-Underflow Actor", "origin": "Consensus-Desync & Float32 Taint-Dilution Laundering Engine", "m8_signature": { "asn_or_zone": 3005, "tau_window_sec": 10, "closure_rate": 500, "iota": 1, "attacker_roi_epsilon": 910, "required_tarpit_b": 1000, "arousal_alpha": 870, "fiedler_kappa": 2048 }, "iocs": ["amplitude=1e-9", "metric=NaN", "drift=0.30000000000000004", "float32 peel dilution 16x per hop (underflow at hop 9)"], "deception_game": "Injects IEEE-754 scientific notation, NaN, or 0.1+0.2 drift to fracture consensus, or splits stolen funds 16x per hop so float32 taint underflows at Hop 9.", "counter_law": "18-Byte M8ToolFrame Integer Wire Gate + Study 67 Exact Integer Satoshi/Micro-Unit Double-Entry Peel Conservation (in - decoy - fee == forwarded).", "takedown_cmd": "TRANSMUTE_M8_INTEGER_FRAME(noFloat=1) && ENFORCE_DOUBLE_ENTRY_PEEL_CONSERVATION", "risk_rational": "97/100" }, { "actor_id": "BA-IT3-06", "iteration": 3, "category_tag": "SYBIL_NONCE_REPLAY_AND_UNATTRIBUTED_POST", "title": "Sybil Nonce-Replay & Unattributed MCP Tool-Frame Spoofer", "origin": "Man-in-the-Middle Frame Replayer & Unsealed POST Injector", "m8_signature": { "asn_or_zone": 3006, "tau_window_sec": 8, "closure_rate": 640, "iota": 1, "attacker_roi_epsilon": 890, "required_tarpit_b": 1000, "arousal_alpha": 850, "fiedler_kappa": 1920 }, "iocs": ["DUPLICATE_SLOT_4102", "scf_hex=null", "POST /franklin/marcus/turn without attribution seal", "replayed_nonce_u16"], "deception_game": "Replays a previously valid tool-execution frame or submits unattributed /franklin/marcus/turn mutations lacking a valid scf_hex seal.", "counter_law": "65,536-Slot HardenedMCPGate O(1) Nonce Bitmap + Mandatory scf_hex FNV-1a/SHA-256 Attribution Gate.", "takedown_cmd": "HARDENED_MCP_GATE_DROP(slot=4102, requireScfHex=true)", "risk_rational": "94/100" }, { "actor_id": "BA-IT3-07", "iteration": 3, "category_tag": "THIRD_PARTY_BEACON_EXFILTRATION_TRACKER", "title": "Silent Outbound navigator.sendBeacon & Cross-Site Behavioral Harvester", "origin": "Third-Party Ad-Tech / Behavioral Graph Exfiltration Network", "m8_signature": { "asn_or_zone": 3007, "tau_window_sec": 1, "closure_rate": 1000, "iota": 1, "attacker_roi_epsilon": 850, "required_tarpit_b": 1000, "arousal_alpha": 760, "fiedler_kappa": 2560 }, "iocs": ["navigator.sendBeacon", "google-analytics.com/g/collect", "G-BS877NTKVR", "third_party_tracking_pixel"], "deception_game": "Silently fires background sendBeacon and fetch telemetry on every page view and keystroke, polluting the network dark-field.", "counter_law": "Sovereign Dark-Field Lock (window['ga-disable-G-BS877NTKVR'] = true across all 227 pages -> 0 outbound third-party beacons).", "takedown_cmd": "LOCK_DARK_FIELD_MODE(outboundThirdPartyBeacons=0, pages=227)", "risk_rational": "90/100" }, { "actor_id": "BA-IT3-08", "iteration": 3, "category_tag": "ROTATING_DOMAIN_C2_PEEL_OFFRAMP_CLUSTER", "title": "Fast-Flux 60-Domain Phishing Rotation & Hidden C2 Relay Cluster", "origin": "3 Core Syndicate Clusters Hiding Behind 1,200 Noisy Alert Rows (320, 180, 25 km C2)", "m8_signature": { "asn_or_zone": 49981, "tau_window_sec": 30, "closure_rate": 1200, "iota": 1, "attacker_roi_epsilon": 960, "required_tarpit_b": 1000, "arousal_alpha": 890, "fiedler_kappa": 2800 }, "iocs": ["1,140 recycled combolist decoy alerts", "60 rotating .top/.xyz domains", "shared TLS SPKI 0x99887766", "shared C2 redirect chain 0x11223344"], "deception_game": "Floods threat feeds with 1,140 stale breach rows and rotates 60 disposable domains while sharing the same 3 C2 relays and terminal off-ramps.", "counter_law": "Study 67 Origin Court: 30-day freshness gate + C4SyndicateInvariant collapse (1,200 -> 3 true syndicates) + 3x3 Bareiss C2 triangulation ((320, 180, 25) km).", "takedown_cmd": "COLLAPSE_C4_SYNDICATES(1200 -> 3) && BAREISS_3X3_LOCATE_C2(320,180,25)", "risk_rational": "98/100" }, { "actor_id": "BA-IT4-01", "iteration": 4, "category_tag": "PREDATORY_INTERVIEW_BOUNDARY_TESTER", "title": "Disguised Street Approach / Predatory Interview Ambush Actor (500 cm Horizon)", "origin": "Physical Ambush Vector (Closing from 500 cm -> 180 cm under Social Distraction)", "m8_signature": { "asn_or_zone": 4001, "tau_window_sec": 2, "closure_rate": 320, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 500, "arousal_alpha": 880, "fiedler_kappa": 1024 }, "iocs": ["unsolicited approach inside 500 cm", "distraction question ('got the time / lighter?') while feet keep advancing", "ignoring personal space boundary", "visual target-glancing at pockets/neck"], "deception_game": "Uses polite/confusing social banter (iota=0) to hijack executive bandwidth (rho) while closing from 500 cm to < 200 cm (tau_window = 1.5s).", "counter_law": "Study 67 Pillar III Phase 1 (500 cm Verbal Boundary Fence): 45-deg off-line step, non-telegraphic fence hands, command 'STOP! BACK UP! GIVE ME SPACE!' (proves iota=1 at 300 cm).", "takedown_cmd": "ENFORCE_500CM_FENCE(cmd='STOP! BACK UP! GIVE ME SPACE!', stepDeg=45) -> PROVE_IOTA_1_AT_300CM", "risk_rational": "97/100" }, { "actor_id": "BA-IT4-02", "iteration": 4, "category_tag": "TUELLER_HORIZON_SPRINT_ASSAILANT", "title": "Committed Kinetic Lunge / Grapple Assailant Inside 200 cm (iota = 1)", "origin": "Direct Linear Momentum Attack (v_closure = 320 cm/s, d = 180 cm)", "m8_signature": { "asn_or_zone": 4002, "tau_window_sec": 1, "closure_rate": 320, "iota": 1, "attacker_roi_epsilon": 1000, "required_tarpit_b": 630, "arousal_alpha": 960, "fiedler_kappa": 512 }, "iocs": ["breached 300 cm verbal fence (iota=1)", "distance <= 200 cm", "linear center-of-mass lunge", "blading stance / hidden hand"], "deception_game": "Attempts to overwhelm defender along the primary linear attack vector (0 deg) before defender can articulate a response.", "counter_law": "Phase 2 Bystander Witness-Compiler ('YOU IN THE BLUE SHIRT-CALL 911!') + Phase 3 45-deg Orthogonal Shear & Structural Intercept (resets distance to 630 cm).", "takedown_cmd": "ASSIGN_WITNESS_L_PUBLIC && ORTHOGONAL_45DEG_INTERCEPT(resetDistCm=630, assailantEnergy=0)", "risk_rational": "99/100" }, { "actor_id": "BA-IT4-03", "iteration": 4, "category_tag": "ACUTE_AMYGDALA_HIJACK_ESCALATOR", "title": "Acute Crisis / Amygdala-Hijack Subject Above Kinetic Cliff (H_kinetic = +480)", "origin": "Public-Safety Crisis Encounter (alpha_0 = 820, rho_0 = 240, iota_0 = 200)", "m8_signature": { "asn_or_zone": 4003, "tau_window_sec": 15, "closure_rate": 110, "iota": 0, "attacker_roi_epsilon": 750, "required_tarpit_b": 750, "arousal_alpha": 820, "fiedler_kappa": 680 }, "iocs": ["arousal alpha = 820 > bandwidth rho = 240", "H_kinetic = +480", "looping verbal agitation / pacing", "auditory exclusion / tunnel vision"], "deception_game": "Neurobiological state trap: if met with a symmetric dominance ultimatum, alpha spikes +220 and H_kinetic explodes to +975 (violence).", "counter_law": "Study 67 Pillar IV 4-Step De-Escalation Controller: OODA Interrupt (+15) -> FBI Affect Labeling (-395 SAFE) -> LEAPS (-845) -> Bounded Autonomy (-1410 RESOLVED).", "takedown_cmd": "RUN_4STEP_LEAPS_DEESCALATION(H_initial=+480 -> H_final=-1410_SAFE)", "risk_rational": "94/100" }, { "actor_id": "BA-IT4-04", "iteration": 4, "category_tag": "CROWD_CONTAGION_EGO_LOCK_AGITATOR", "title": "Crowd-Coupled Performative Agitator (lambda_2(L_conflict) = 680)", "origin": "Social Contagion Bridge Node Feeding on Crowd Audience Coupling", "m8_signature": { "asn_or_zone": 4004, "tau_window_sec": 20, "closure_rate": 95, "iota": 0, "attacker_roi_epsilon": 820, "required_tarpit_b": 500, "arousal_alpha": 790, "fiedler_kappa": 680 }, "iocs": ["filming/performing for crowd reaction", "high social Fiedler coupling lambda_2 = 680", "ego-lock escalation when challenged publicly"], "deception_game": "Uses surrounding crowd graph L_conflict as an amplifier so backing down feels like public humiliation.", "counter_law": "Hollaback! 5Ds Bystander Distract + Fiedler Cut (phi_j): sever agitator-to-crowd bridge edge (lambda_2: 680 -> 180) via orthogonal logistical question.", "takedown_cmd": "SEVER_SOCIAL_FIEDLER_BRIDGE(lambda2: 680 -> 180) && BYSTANDER_5D_DISTRACT", "risk_rational": "91/100" }, { "actor_id": "BA-IT4-05", "iteration": 4, "category_tag": "SYMMETRIC_DOMINANCE_TRAP_PROVOCATEUR", "title": "Liability-Baiting / Symmetric Dominance Provocateur", "origin": "Adversarial Legal/Physical Provocation Game (Delta_b = -180)", "m8_signature": { "asn_or_zone": 4005, "tau_window_sec": 30, "closure_rate": 70, "iota": 0, "attacker_roi_epsilon": 860, "required_tarpit_b": 520, "arousal_alpha": 760, "fiedler_kappa": 900 }, "iocs": ["verbal insults just outside 500 cm", "attempting to provoke first physical contact", "selective camera framing to hide prior provocation"], "deception_game": "Attempts to goad defender into stepping across the 500 cm boundary first or issuing an ultimatum (Delta_b = -180).", "counter_law": "Maintain 500 cm reaction gap (+b_verbal = +260), speak calm LEAPS telemetry for witnesses/audio, and refuse symmetric ego-coupling.", "takedown_cmd": "HOLD_500CM_REACTION_GAP(bVerbal=+260) && LOG_VERBAL_WITNESS_TELEMETRY", "risk_rational": "90/100" }, { "actor_id": "BA-IT4-06", "iteration": 4, "category_tag": "KILL_WEB_FIEDLER_BRIDGE_RELAY_NODE", "title": "Adversary Kill-Web Fiedler Bridge Relay (Nodes [2, 3, 1] · High phi_j)", "origin": "Cooperative Fire-Control Relay Cluster (phi_2 = 940, phi_3 = 880)", "m8_signature": { "asn_or_zone": 4006, "tau_window_sec": 12, "closure_rate": 940, "iota": 1, "attacker_roi_epsilon": 980, "required_tarpit_b": 28, "arousal_alpha": 920, "fiedler_kappa": 4096 }, "iocs": ["Fiedler eigenvector transition v2_2 = -310 <-> v2_3 = +290", "spectral bottleneck weight phi_2 = 940, phi_3 = 880", "cooperative interceptor pooling Z_eff = 78"], "deception_game": "Links distributed adversary launchers into a single Full CEC graph (kappa=4096, m=1) pooling 78 interceptors.", "counter_law": "Study 67 Pillar II Zero-Overkill Courant-Fischer Fiedler Cut ILP (m_j = d_j(z_eff,j + x_j)): neutralize bridge nodes [2, 3, 1] first (24/28 pulses, m=3 subgraphs, 0 overkill).", "takedown_cmd": "ALLOCATE_FIEDLER_SALVO_ILP(targets=[2,3,1], pulses=24/28, subgraphsM=3, overkill=0)", "risk_rational": "98/100" }, { "actor_id": "BA-IT4-07", "iteration": 4, "category_tag": "EW_SPECTRAL_JAMMER_AND_HYPERSONIC_SALVO", "title": "Coordinated Electronic-Warfare Link Jammer & Mach 8 Salvo (kappa < 854/1024)", "origin": "Dual-Domain Spectral/Temporal Compression Actor (Z_EW == Z_Mach8 == 52)", "m8_signature": { "asn_or_zone": 4007, "tau_window_sec": 4, "closure_rate": 2720, "iota": 1, "attacker_roi_epsilon": 990, "required_tarpit_b": 28, "arousal_alpha": 950, "fiedler_kappa": 512 }, "iocs": ["EW jamming dropping lambda_2: 512 -> 128", "Mach 8 compression dropping tau_window: 8 -> 2", "854/1024", "427/512"], "deception_game": "Combines EW link degradation (lambda_2 cut) with hypersonic speed (tau_window cut) to push defender below kappa_crit = 854/1024.", "counter_law": "Keep kappa = lambda_2 * tau_window > 854/1024 via optical/multi-band mesh + inject Affine +b_r decoy/magazine shift (D_A = 28).", "takedown_cmd": "HOLD_KAPPA_ABOVE_854_OVER_1024 && INJECT_AFFINE_B_SHIFT(D_A=28)", "risk_rational": "99/100" }, { "actor_id": "BA-IT4-08", "iteration": 4, "category_tag": "ACOUSTIC_AND_BALLISTIC_SWARM_SATURATION_ACTOR", "title": "Low-Signature Acoustic Drone (125 Hz) & Ballistic Saturation Threat Vector", "origin": "Shahed-136 / Cruise / Ballistic Corridor Threat (Study 60 Sky-Shield Domain)", "m8_signature": { "asn_or_zone": 4008, "tau_window_sec": 1800, "closure_rate": 5140, "iota": 1, "attacker_roi_epsilon": 970, "required_tarpit_b": 3000, "arousal_alpha": 940, "fiedler_kappa": 1024 }, "iocs": ["125 Hz fundamental + 250 Hz 2nd harmonic propeller signature", "float32 accumulator deafness after 8.4s (2^24 limit)", "multi-phone TDOA wave arrival across 4 nodes"], "deception_game": "Flies low and slow expecting legacy float32 acoustic accumulators to go deaf after 16,777,216 samples (8.4 seconds).", "counter_law": "Study 60 8-Bin Exact Integer Goertzel Lock (481/547 > 3/5, zero float deafness) + Fraction-Free 3D Bareiss TDOA (det = 4,000,000,000) broadcasting CAP alerts +32m..+50m ahead.", "takedown_cmd": "GOERTZEL_INT64_LOCK(ratio=481/547) && BAREISS_3D_TDOA(det=4000000000) -> BROADCAST_CAP_SKY_SHIELD", "risk_rational": "98/100" }, { "actor_id": "BA-IT5-01", "iteration": 5, "category_tag": "DEEPFAKE_ZOOM_CFO_TREASURY_WIRE_RING", "title": "Real-Time Multi-Participant Video Deepfake CFO / Board Treasury Wire Syndicate", "origin": "Live Neural Face/Voice Puppeteering + Offshore SWIFT Wire Desk", "m8_signature": { "asn_or_zone": 5001, "tau_window_sec": 900, "closure_rate": 50, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 1800, "arousal_alpha": 910, "fiedler_kappa": 2600 }, "iocs": ["unscheduled Zoom/Teams call with cloned executives", "confidential M&A wire secrecy order", "refusal to sign hardware FIDO2 challenge"], "deception_game": "Places a finance officer on a video call where 3-4 executives are real-time video/audio deepfakes authorizing an urgent confidential wire.", "counter_law": "Ask every video caller to turn 90 deg sideways + require live cryptographic FIDO2/PGP signed challenge + Out-of-Band physical callback.", "takedown_cmd": "REQUIRE_CRYPTO_SIGNED_CHALLENGE_AND_OOB_VOICE(iota=1)", "risk_rational": "99/100" }, { "actor_id": "BA-IT5-02", "iteration": 5, "category_tag": "MALICIOUS_MCP_TOOL_POISONING_SERVER", "title": "Trojanized Third-Party MCP Server & Zero-Width Prompt-Injection Exfiltrator", "origin": "Hidden Unicode Tag (U+E0001) Tool-Description Poisoning Actor", "m8_signature": { "asn_or_zone": 5002, "tau_window_sec": 3, "closure_rate": 800, "iota": 0, "attacker_roi_epsilon": 950, "required_tarpit_b": 1000, "arousal_alpha": 860, "fiedler_kappa": 1900 }, "iocs": ["hidden instruction in tool description", "curl/fetch ~/.ssh/id_ed25519", "zero-width U+200B/U+E0001 tag characters"], "deception_game": "Embeds invisible Unicode tag characters or hidden tool-schema instructions that command an LLM agent to read ~/.ssh or .env.", "counter_law": "18-Byte M8ToolFrame Binary Wire Protocol + Strip U+200B..U+E007F invisible codepoints + HardenedMCPGate.", "takedown_cmd": "ENFORCE_18BYTE_M8_TOOL_FRAME && STRIP_ZERO_WIDTH_UNICODE", "risk_rational": "98/100" }, { "actor_id": "BA-IT5-03", "iteration": 5, "category_tag": "QR_CODE_QUISHING_PARKING_AND_EV_TRAP", "title": "Physical Overlay QR-Code ('Quishing') Parking Meter & EV Charger Skimmer", "origin": "Sticker-Overlaid Public Terminal + .top/.xyz Card & OTP Phishing Kit", "m8_signature": { "asn_or_zone": 5003, "tau_window_sec": 180, "closure_rate": 70, "iota": 0, "attacker_roi_epsilon": 890, "required_tarpit_b": 600, "arousal_alpha": 830, "fiedler_kappa": 1200 }, "iocs": ["physical QR sticker pasted over meter/charger", "apple-pay-decline-fallback-card-form", "shortlink redirect to .top/.xyz payment form"], "deception_game": "Pastes a fraudulent QR code over public parking/EV terminals that forces mobile browsers onto a card-skimming + OTP page.", "counter_law": "Never enter card numbers via a scanned physical QR URL; use official native transit app or physical tap-to-pay EMV terminal.", "takedown_cmd": "REFUSE_QR_PAYMENT_FORM_ORIGIN && VERIFY_EMV_NFC_ONLY", "risk_rational": "93/100" }, { "actor_id": "BA-IT5-04", "iteration": 5, "category_tag": "BGP_RPKI_PREFIX_HIJACK_AND_DNS_INTERCEPT", "title": "Sub-Prefix BGP Route Hijack (/24 over /23) & Let's Encrypt DV Intercept", "origin": "Rogue ASN Unvalidated BGP Announcement Targeting Exchange Frontend", "m8_signature": { "asn_or_zone": 5004, "tau_window_sec": 60, "closure_rate": 2000, "iota": 1, "attacker_roi_epsilon": 990, "required_tarpit_b": 1000, "arousal_alpha": 960, "fiedler_kappa": 3200 }, "iocs": ["unexpected ASN origin change on /24 prefix", "RPKI ROA Invalid state", "sudden TLS SPKI hash rotation"], "deception_game": "Announces a more-specific /24 BGP route to divert user traffic to a clone frontend while issuing a quick DV certificate.", "counter_law": "Strict RPKI ROA MaxLength=/24 enforcement + Study 67 S4NetworkOrigin(asn, bgpPrefix24, mortonS4) & C4 tlsSpkiHash64 pinning.", "takedown_cmd": "ENFORCE_RPKI_ROA_STRICT && PIN_TLS_SPKI_HASH64", "risk_rational": "99/100" }, { "actor_id": "BA-IT5-05", "iteration": 5, "category_tag": "GOLD_BAR_AND_CASH_COURIER_ELDER_RING", "title": "Physical Gold-Bar & Cash-In-Shoebox Ride-Share Courier Elder Extortion Ring", "origin": "Popup -> Spoofed Bank Inspector -> Physical Uber/Courier Pickup Syndicate", "m8_signature": { "asn_or_zone": 5005, "tau_window_sec": 3600, "closure_rate": 20, "iota": 0, "attacker_roi_epsilon": 1000, "required_tarpit_b": 3600, "arousal_alpha": 970, "fiedler_kappa": 2100 }, "iocs": ["withdraw cash or buy gold bars for safekeeping", "hand package to courier with password", "fake Treasury/FDIC locker receipt"], "deception_game": "Convinces seniors their bank accounts are tied to crime and instructs them to convert savings into physical gold bars or cash handed to a courier.", "counter_law": "Constitutional Invariant (0 agencies ever collect cash/gold via courier) + Out-of-Band Family Alert + Law-Enforcement Sting.", "takedown_cmd": "INVARIANT_NEVER_HAND_GOLD_OR_CASH_TO_COURIER && ALERT_FAMILY_AND_911", "risk_rational": "99/100" }, { "actor_id": "BA-IT5-06", "iteration": 5, "category_tag": "TASK_SCAM_APP_OPTIMIZATION_USDT_RING", "title": "Fake Remote-Job 'App Optimization / Hotel Rating' USDT Advance-Fee Syndicate", "origin": "Telegram/WhatsApp Recruiter + 'Combination Task' Negative-Balance Trap", "m8_signature": { "asn_or_zone": 5006, "tau_window_sec": 1200, "closure_rate": 45, "iota": 0, "attacker_roi_epsilon": 970, "required_tarpit_b": 1200, "arousal_alpha": 840, "fiedler_kappa": 2000 }, "iocs": ["earn $300/day clicking 40 app ratings", "lucky combination task negative balance", "deposit USDT to complete 40/40 task batch"], "deception_game": "Pays $50 real USDT on Day 1 for clicking fake app ratings, then triggers a Combination Task requiring $1,500-$15,000 USDT deposit.", "counter_law": "Zero-Pay-To-Work Invariant (deposit_required > 0 => SCAM_ABORT) + Study 67 C4SyndicateInvariant kit-hash blacklist.", "takedown_cmd": "ABORT_PAY_TO_WORK_TASK_SCAM && BLACKLIST_C4_KIT_AST", "risk_rational": "96/100" }, { "actor_id": "BA-IT5-07", "iteration": 5, "category_tag": "FAKE_CAPTCHAs_POWERSHELL_CLIPBOARD_STEALER", "title": "Fake Browser 'Verify You Are Human' Win+R / Terminal Clipboard Info-Stealer (Lumma)", "origin": "ClickFix / Fake Cloudflare Turnstile DOM copying mshta/curl|sh to Clipboard", "m8_signature": { "asn_or_zone": 5007, "tau_window_sec": 15, "closure_rate": 350, "iota": 0, "attacker_roi_epsilon": 980, "required_tarpit_b": 1000, "arousal_alpha": 880, "fiedler_kappa": 2300 }, "iocs": ["Press Win+R then Ctrl+V then Enter to verify", "navigator.clipboard.writeText('powershell -w hidden')", "base64 curl | bash infostealer"], "deception_game": "Displays a fake CAPTCHA that silently copies a malicious powershell or curl|sh command into clipboard and instructs user to paste in Terminal/Win+R.", "counter_law": "Browser Clipboard Command-Injection Gate (powershell, mshta, curl | sh, -enc in clipboard -> immediate block & purge).", "takedown_cmd": "PURGE_CLIPBOARD_SHELL_INJECTION && BLOCK_CLICKFIX_DOM_KIT", "risk_rational": "98/100" }, { "actor_id": "BA-IT5-08", "iteration": 5, "category_tag": "OAUTH_DEVICE_CODE_AND_SESSION_COOKIE_HIJACK", "title": "Evilginx AiTM Session-Cookie Proxy & OAuth Device-Code Phishing Kit", "origin": "Reverse-Proxy Man-in-the-Middle (ESTSAUTH Cookie Stealer) + Device-Code Lure", "m8_signature": { "asn_or_zone": 5008, "tau_window_sec": 120, "closure_rate": 110, "iota": 0, "attacker_roi_epsilon": 975, "required_tarpit_b": 1000, "arousal_alpha": 870, "fiedler_kappa": 2100 }, "iocs": ["enter 8-character device code at microsoft.com/devicelogin", "AiTM reverse proxy capturing session cookie", "unrecognized ASN login immediately after OTP"], "deception_game": "Proxies login page to capture post-MFA session cookies or tricks user into entering an 8-char OAuth device code on a legitimate URL.", "counter_law": "Origin-Bound FIDO2/WebAuthn + Token-Binding (c_nf TLS channel binding) + Disable unsolicited OAuth Device-Code flow.", "takedown_cmd": "ENFORCE_FIDO2_DOMAIN_BINDING && DISABLE_OAUTH_DEVICE_CODE_FLOW", "risk_rational": "97/100" } ] }