Field Manual

Revised dictionary-hybrid credential engine. Locks characters at roughly twice the rate of the v1 issue.

Credential pre-image library. Feeds ICEPICK a running head-start — roughly the first two-fifths of any gate is already solved when you sit down. On short traces, that head-start is the whole game.

Handshake replay sheath. Wraps the ICEPICK attack in captured session traffic so every failed attempt reads upstream as routine housekeeping. The trace does not begin until you are inside and making noise. Watchkeepers still notice a session loitering at the gate, so keep the crack short.

Dormant remote-access implant. Enter a target once and it plants itself; sever the link and you re-enter later without touching the credential gate. It sleeps in their kernel until you call it, and dies when the operation closes.

Extended relay authority. Raises your route ceiling from three relays to six. Every hop is seconds on the trace clock — buy the seconds.

Access to three non-attributable relay points held off the books, including one where official relays cannot reach. Each hop slows a trace considerably.

Signing authority over two reserve points of presence — one on the American west coast, one on the Gulf littoral — kept dark until drawn. When a target insists your final hop be local, these are the local.

Single-shot reflection buffer. Freezes an active trace for ten seconds. One use per operation. Use it late.

Injects synthetic latency into the inbound chain: halves the speed of an active trace for twenty seconds. One use per operation. Where MIRROR stops the clock, QUICKSAND makes it wade.

Decoy intrusion seeder. Your relay chain stages loud synthetic break-ins against unrelated hosts and the trace team drops your scent. Their second run comes back faster and less patient, so treat the reset as a loan. One use per operation.

Sacrificial line charge, fitted at the first relay. If a trace resolves your chain, the cutout fires and burns the junction before the final hop surrenders your origin: the session dies and you walk. Spent the moment it works, and it does nothing about what you left in their logs.

Forged stand-down authority. Inserts a signed all-clear into a target group's security traffic so the incident that put them on alert is closed and their next trace arms at the ordinary pace. Used from the operations board between phases; only works on organisations that trust their own paperwork.

Journal-aware log sanitiser. Purges an entire session trail in one pass instead of entry by entry. On a live box this is the difference between a debrief and a decommissioning.

Attributed-entry sweeper. Reads a live journal, matches each line against your session signature and lifts your entries one at a time, leaving the housekeeping where it lay. Built for watched systems, where the wrong deletion is worse than none.

Network sounder. Run from inside a breached host, it sweeps the segment behind it and maps every adjacent machine — service, port and version — so your session can be relayed deeper.

Durable relay implant. Seat it on a host you have breached to the inside and the machine stays yours after the link drops, enrolled on the map as a relay for every operation that follows. Seating it writes a journal entry, so put it down before the scrub, not after.

Channel-bonded exfiltration harness. Runs up to three file operations at once. The standard-issue harness works one file at a time, and feels like it.

Satellite-pass watch. Some targets ride a roaming Starlink uplink and fall off the grid as the dish loses its cell. Arm OVERPASS on one and Comms raises you the instant it surfaces.

Generative re-synthesis suite. Rebuilds a face or voice model inside a target system so it no longer matches the sample that flagged one of ours. Slow and unmistakable in the logs, but nothing else pulls an officer back out of a recognition database.