CP-001Network Infrastructure
Salt Typhoon
The authority graph is nonlinear: device execution becomes identity, privileged management, network control and cross-domain reach.
Explore case →Read the Prologue
Attack Stories
The doctrine explains the model. The cases show the model under pressure. Canonical CP identifiers remain stable as the collection grows. R2.6 expands the collection to eleven cases.
Method-version note. This collection spans three schema generations. Earlier cases retain their original case semantics; native 0.6 cases use estate-scoped privilege debt and role-stratified recurrence. Debt and recurrence values must not be summed or directly compared across schema generations without recalibration.
Current collection UPDATED
Explore the Cases
Case IDs identify canonical research artifacts; they are not display sequence numbers. Unpublished IDs are not represented by placeholders.
CP-002Agentic Operations
Taiwan Agentic
AI changed speed, parallelism and search while the target environment supplied the authority that could be consumed.
Explore case →CP-003AI / Cloud / Kubernetes
Hugging Face
Individually survivable conditions composed into cross-cluster control and renewable authority.
Explore case →CP-004OT / Water Control
Risevatnet
A weak password stood directly in front of remote valve-control authority, making the authority path unusually shallow.
Explore case →CP-005Government / Water / Identity
CISA: A Tale of Two SOCs
Two separately bounded red-team assessments show how inherited authority, trust material and retained dependencies changed the defensive outcome.
Explore case →CP-006Campaign Infrastructure
QTFY Infrastructure Quartermaster
Separates campaign-scale infrastructure, concealed reach and victim-side authority without collapsing multiple estates into one kill chain.
Explore case →CP-007Cloud Identity / Government Email
Storm-0558
A supplier-side signing key and validation failure composed into accepted identity authority, then crossed into four government and diplomatic target estates.
Explore case →CP-008Structural Case / Communications
Stranger Pings
The first Structural Case shows how authority-bearing dependencies can remain after a regulatory remediation without manufacturing an attack ending.
Explore case →CP-009Critical Infrastructure / Pre-positioning
Volt Typhoon
Ten target estates show inherited authority accumulated and re-verified as a disruptive option held in reserve.
Explore case →CP-010Software Supply Chain / Build Infrastructure
Malicious Packages: In RubyGems We Trust
A package campaign converted registry publication into build-worker execution, public-data retrieval, and derived-package republication.
Explore case →CP-011AI Services / Developer Platforms
Hacktron Composes Vulnerabilities to Reach OpenAI Authority
Controlled research followed inherited authority from uploaded content through an employee agent to a harmless internal pull request.
Explore case →