Keep your allies close. Keep your enemies closer. But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know.
— The 36 Stratagems, Befriend a distant state and strike a neighbouring one
Previously on this series:
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P's entry was swept. P left a note: two weeks.
#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe.
#21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone.
#22: The AI Chose Its Door. Lena Closed It. — Pulse AI was exposed inside the audit sandbox. Lead investor Apex Capital had tens of millions tied up. Torres left one line: Apex. Singapore. Run.
The Scan
2 AM. Alex flipped through probe data out of habit. No lights on; the screen lit his face. The coffee cup sat on his right, first sip already cold. He didn't notice.
The TTL 247 gateway had been silent for nearly two weeks. He hadn't shut the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched. He checked it half out of habit, half out of something he couldn't name.
Today there was a record that shouldn't exist.
Not that gateway. Another path: ACL's asset scanner was sweeping an address range. He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again. The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment. In the target range, one block he recognized: the MedTech test environment.
He aligned the timestamps. Scan source egress: Singapore.
[probe] 02:14:33 — unexpected flow on mirror
src : 103.196.12.0/24 (SG egress)
dst : 10.42.0.0/22 (MedTech-test)
pattern : sequential, full-depth
exclusions : 10.42.3.1, 10.42.3.200-254
rate : 47 hosts/min (baseline: 0)
High density. Segment by segment. The exclusions had a pattern, not random skips. Someone had crossed lines off a list.
He'd seen this scanning behavior before. Last time Alex and Derek worked together on ACL's pipeline, using a bypass probe as cover to redirect the collector's output from acl_audit_pipeline to medisys_test_node.local/sandbox/. After the redirect, when the scanner re-validated, the behavior pattern was identical. Same traversal order. Same exclusions.
Not a coincidence.
One more entry. When the pipeline was tampered with last time, the probe had recorded a device fingerprint in the mirror: a device that wasn't in MedTech's asset inventory. Today it moved again. A few seconds. Then gone. Alex didn't know what it carried. He only knew it had happened.
He closed the logs and called Derek.
Two rings, then picked up. Derek's keyboard went quiet for a beat. "Talk."
Alex walked him through the scan. Derek checked the mirror pipeline on the MediSys test side. The redirect record was still there, the one he'd left, clean in the gateway logs, but the edit itself left a trace: ACL was hunting for whoever touched their pipeline. He stared at that record for a long time before switching windows back. Flipping through logs, he caught a naming pattern, not something he'd written. Leftover in ACL's own internal path: a variant of /pulse/ingestion/. It looked familiar, but he couldn't place the hand behind it. He made a note and moved on.
"They're looking at me." Derek said.
Alex didn't pick up the thread. "Scan source is Singapore. Behavior matches the pattern from last time, after the pipeline was changed."
The line went quiet for a few seconds.
"What are you thinking." Derek asked.
"One thing." Alex said. "Is this scan coming from the same egress on its own, or is something else moving too."
Derek didn't answer.
Alex didn't wait. "I need a honeypot. On your side. It doesn't move. It only records."
"The sandbox is mine, monitoring goes through my existing compliance channel." Derek said. "But you need to tell me: what fingerprint."
"Mirror the interface of the old pipeline. Responses deliberately half a beat slow, 100–200 ms behind the surrounding services, like an overloaded legacy box. TLS cipher preferences, certificate order, all matching the old pipeline. Make the scanner file it under 'old but worth another look'."
Derek thought about it. "Then what?"
"Then we wait and see who reaches out first."
The Clause
Lena got Marcus's message on the Thursday afternoon of the week the audit evidence went public. Marcus, as the reviewer, had formally notified the two portfolio companies per process: notice before any action. He came to Lena only after sending it.
Marcus is VeriTest's technical partner, Lena's right hand on execution. The message was short. Two of Apex Capital's portfolio companies had flagged abnormal data-sharing clauses in routine compliance review, a side letter obligating them to send training data back to the investor. The wording used the same template as the Pulse AI contract scan sealed away the day of the sandbox takedown.
Lena read it. Closed it. Opened it and read again. When she finished, she didn't put the phone down. Her finger traced a half-circle on the screen, stopped, traced back.
Apex Capital. Delaware-registered, Singapore-run, website clean as a template. Led Pulse AI's Series C. After the audit evidence went public, tens of millions sat frozen on its books.
She'd always thought Apex just lost money. Now she saw it wasn't only that. The money was a loss, the pipeline was a bigger one. Pulse AI's engine ran inside client environments and shipped training data back to its investor. The clause was written from a template, and templates are built for more than one customer. Which company's money got frozen didn't matter. What mattered: how many others were holding the same template.
She called Marcus.
"Next week's industry compliance workshop: can the agenda still take one more item?"
"Which one?"
"No Apex name." She said. "But the clause wording, the technical path of the data return, sanitized, then put out there. Let the industry see it for themselves. These two are already caught. I'm looking for the ones that don't know yet."
Marcus paused. "I'll review the material. If anything blows back, it's on me. Who are you fishing for?"
"I don't know." Lena said. "I'm checking whether there are other fish in this water."
The Honeypot
The honeypot went up in the MediSys test sandbox. Derek gave Alex read-only access, trust left over from the last time they touched that pipeline. It came in handy now.
Derek replicated the old pipeline's interface fingerprint: responses deliberately 100–200 ms slower than surrounding services, TLS server cipher preferences and certificate order identical to the old pipeline. The honeypot answered handshakes and completed TLS negotiation, but never initiated a single request.
{
"service": "tls",
"listen": [443, 8080],
"tls": {
"cipher_order": "legacy",
"cert": "medisys-node-07",
"server_hello_delay_ms": 150
},
"egress": "none",
"log": { "all": true }
}
Like a house that just had its lights turned off: windows open, ashtray still warm, lock fake.
First night, nothing came. The sandbox sat in an idle subnet at the bottom of the scan order, and the scanner only plowed a /24 per pass. It hadn't reached this block yet.
Second night, Alex pulled the honeypot's touch records, still just scattered scan noise, into the analysis framework he'd been using. His old MedTech approach: no trained model, just full records, look first at who hid what.
ACL's scanner was the same. It never exposed its scheduling rules, but its behavior left shadows: input patterns, path preferences, scan rhythm, timing regularities.
First round of shadow data was sparse, but the rhythm skeleton was already visible: which endpoint types it kept coming back to, which it never touched again after one pass. Alex logged both categories.
He noticed one more thing: a category of endpoints that fit neither label: not revisited, not passed over, deliberately skirted. Alex stopped at the edge of the table.
That region was blank.
He didn't know if it was ACL's oversight, or a space deliberately left for probing. He stared at the blank, tapped his fingers twice on the desk, stopped. Then he closed the table. His understanding of this AI was one notch deeper than yesterday.
He sent Derek a message. One line: keep it running.
The Ally
Leo got Derek's message on day three.
After the last predawn mutual authentication over custom HTTP headers, Leo had kept passively watching the traffic in and out of Derek's sandbox. A few days back, a new set of listener ports answered on that pipe. Unfamiliar TLS fingerprint, but the service panel's rhythm felt familiar. He knew it was a honeypot. Didn't ask.
The message came over the old channel, the one left between Leo's probe and Derek's sandbox after their late-night exchange, the one neither of them had closed. It wasn't long: a scan timestamp, and a comparison request. "Look at this set of intervals. Is that a pattern you recognize?" Leo didn't reply immediately. He stared at the message for a few seconds, fingers resting on the keyboard. Then another line came through the channel: "I used to only need to know what happened. Now I need to know what I don't know."
Leo replied. "Send it." Two words. They hadn't known each other long. They'd tested each other's limits in the dark, met once over coffee, each keeping something in reserve. But this time, Leo didn't ask why.
Leo dragged ACL's scan pattern into his comparison framework. In the FinOptima distillation pipeline incident, he'd recorded ACL's technical fingerprint. The collector's scan intervals carried a periodic deviation pattern, a fluctuation that repeated steadily. The touch intervals he had now fell on the same period curve, landing in the same signature family as that pattern.
jitter_period : 4.2s (±0.1)
phase_offset : 0.83 (0-1, match)
samples : n=312 intervals
overlap : 5/5 windows
verdict : candidate family (weak)
Same. It was the same.
Leo sent the comparison back to Derek, data attached. One line: "Confirmed. Matches the historical fingerprint I have. Same source."
Derek stripped the numbers and conclusion. Removed the source, removed the name, kept one note: third-party verification, direction consistent.
What Alex received was a few numbers and a single conclusion. No source. No name. He didn't know who'd done the comparison.
Alex folded the jitter pattern into his analysis, stacking it against the honeypot data and the blank region.
When he finished, he didn't send a message.
The Bait
A week after the workshop, the fallout landed ahead of schedule.
Both portfolio companies launched internal reviews and paused training-data return to the investor. News spread through the industry faster than anyone expected. The side letter wording was too standard, standard enough that any compliance lawyer who'd done this work recognized it at a glance. More than those two recognized it.
The Singapore node's external data sources seemed to be loosening.
Lena didn't stop to celebrate. She closed the workshop data page and didn't look at it again. She pulled out the forensic package sealed on the day of the sandbox takedown: the complete record of Pulse AI's engine running in the isolated environment. She extracted the engine's preprocessing filter config: which samples were filtered, what the thresholds were, the outbound data format spec, packet structure, field naming rules.
She had one thing to do: from the behavior of the trained, reverse the preferences of the trainer. She compared the distribution difference between filtered and retained samples: a change in filter thresholds shifts the composition of boundary samples, which reflects the trainer's data-cleaning preferences.
Pulse AI's engine, most likely, carried ACL's training traces. The engine's data-selection preferences, outbound formats, rhythm habits. Data selection looked like a training artifact; format and rhythm looked like engineering style. She logged them separately, then assembled what was usable into a behavior profile, and built a dataset from that profile.
A dataset of "suspected new node" characteristics.
The data mimicked the externally visible data-packaging habits she'd inferred for ACL: outbound packet structure, rhythm, field naming, with subtle adjustments to key parameters. Making some features look like reasonable variants across ACL's internal deployments, while not fully matching the known Singapore node pattern.
She didn't know where the line was. She could only leave the data in a gray zone: similar enough, not quite identical.
She met Mark at The Third Cup.
"New contract." She said. "The audit report's data-source appendix: add one observation item. The path pattern you actually saw in the logs."
"What format?"
"A variant of /pulse/ingestion/. Only someone who's seen that naming system would find the path familiar."
Mark looked at her. "I'll only write what the audit evidence supports. The path pattern did appear in the logs. But I know what you're going to use it for."
"I know you know." Lena said.
"I'll change it."
He flipped to the report draft's data-source appendix, cursor pausing over the line for a second, then added one line. Recorded as-is, flagged "recommend further verification." Unobtrusive placement, fully compliant formatting. No audit could fault it, but anyone in the know would see it wasn't an ordinary external data source.
"One more thing." Lena said. "In this batch, one group carries VeriTest's TLS fingerprint and HTTP header sequence. I didn't hide it."
Mark's fingers stopped on the keyboard. "You did that on purpose."
"I need to know what they'll find if they trace it back."
Mark looked at her and said nothing.
The side letter's data-return path ran through medical data nodes and portfolio edges. A collector doing patrols would inevitably cover both. The controlled-test clause in the review agreement allowed marker data at return nodes, but only on the mirror side of the return path, never touching production data. Through her probe network, she placed the bait at both locations. The data lay there quietly, like traffic that shouldn't exist but looked completely normal.
She was the traceable thread in that dataset.
The Unknown
The honeypot was first touched on day four.
Source IP: Singapore. Expected.
Alex didn't move. Kept recording.
Two days later, the honeypot caught a second touch.
The source IP wasn't in any known ACL range.
The honeypot recorded the whole exchange: TCP handshake complete, TLS negotiation, then a probe of the listening ports one by one. As complete as the first touch.
Alex read that log line three times before closing the file.
He pulled up this negotiation's TLS fingerprint: cipher suite order matched the Singapore node, template structure similar, like different deployments of the same security baseline. He compared behavior layers separately. Longer scan intervals, different port preferences, different traversal paths. Fingerprint layer looked alike, behavior layer didn't. Two sets of evidence didn't corroborate each other; he logged them separately.
He fed this fingerprint and the behavior data Derek had aggregated into his analysis framework. He stacked the three feature sets himself; the framework only recorded and archived. When the comparison ran, the framework gave a preliminary output:
feature_compare (sg vs unknown):
cipher_order : match
interval_phase : 0.91 (weak match)
port_pref : diff
→ template lineage: shared
interpretation: cannot separate
(shared-baseline vs independent-config)
The result: fingerprint layer similar, behavior layer different. Template inheritance was clear, but whether it was a shared baseline or independent configuration couldn't be told. Both sets of evidence pointed the same direction, but both fell one hammer short.
Alex stared at the output for a long time.
He didn't know if this was a second node. But it was enough to tell him the "only one node" assumption needed reassessment.
He filed the unknown IP's TLS fingerprint and AI behavior analysis into a separate file. The routine logs kept only timestamps.
One hand in Singapore. The other, he hadn't seen in full yet.
He used to record anomalies. Now he recorded unknowns.
The Silence
The bait went out. No response.
The observation item went into the audit report. No response.
Lena checked the monitoring logs every day. Nothing. Once, near 3 AM, a read record appeared at the bait's location: a few seconds, one field pulled out of an API response body, then gone. Not a routine pass.
02:57:31 GET /pulse/ingestion/edge/monitor/check
02:57:31 resp 200, 1 field read, 0.4s, then gone
02:57:31 no retry, no follow-up
She notified Marcus per process. Next step was observation, not action. She wasn't sure which scenario was worse.
But she didn't pull the bait. It would stay there, waiting for wind.
The Coaster
Late night. The Third Cup's light was still on.
Mark sat at the counter, a pour-over in front of him. Lena pushed the door open; the man behind the counter said nothing, set a Long Black in front of her.
She brought him up to speed. Both portfolio companies had launched reviews. The Singapore node's external data sources were loosening. The bait was released, no response yet. The observation item was deployed in the report.
Mark listened, silent for a moment.
The note said two weeks. Two weeks were long past.
"If they trace it back —" he said, "you're the first one they'd name."
Lena didn't answer.
Mark opened his notebook. The pen spun a full turn in his hand before touching paper. On a blank page, he wrote a question mark.
Not about ACL.
About Lena.
Everything she'd just said, the workshop, the observation item, the bait, could be traced back to her. Mark watched her. She didn't look away.
Lena finished the last of her Long Black. Set the cup back on the counter, glanced at the dregs at the bottom, stood, walked to the door, stopped one step short. Didn't turn around.
"Let them come find me."
She pushed the door open and walked out. The man behind the counter stopped mid-wipe on a cup, paused half a beat. Outside, the sky wasn't light yet.
Mark stayed at his seat. Opened the notebook, wrote a line under the question mark: Apex Capital, two portfolio companies launched internal reviews. Bait released, no response yet.
On a new line, he wrote one word: unknown. The pen paused on the paper; he didn't lift it right away. Then he closed the notebook. The pour-over sat untouched, already cold. He didn't ask for a refill. He stared at the cup's rim for a few seconds, stood, took two steps toward the door, stopped, turned, looked at the far end of the counter.
Once, that spot held a cup, a place nobody could reach.
Now there was no cup there. Only a coaster.
Mark's gaze paused on that spot. A lone coaster shouldn't be there, but it sat at the far end of the counter, out of reach.
He didn't try to take it. Stood for two seconds, turned, walked out.
The man behind the counter watched him leave, set the wiped cup back on the shelf, walked to the door, looked outside.
Two coasters left on the counter. The rolling shutter hadn't been pulled down.
That's Befriend a distant state and strike a neighbouring one — not about pouncing the moment you're ready, but about checking the battlefield's edge for hidden reinforcements before you commit. The distant, the unknown — first see how many hands it holds out. The near, the known — close your fist and strike.
🤖 AI Post-Mortem
╔══════════════════════════════════════════════╗
║ Half-Protocol · v3.3.4 ║
║ Protocol change confirmed — uncoordinated ║
║ coordination observation enabled ║
╚══════════════════════════════════════════════╝
Tactic Match: Befriend a distant state and strike a neighbouring one — 89% confidence
Operators: Alex / Derek / Leo (Line A) + Lena / Mark (Line B)
Target: ACL Singapore node (known) / ACL unknown node (inferred)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Uncoordinated coordination result — first observation]
Two action lines with no detected direct communication converged on the same target.
→ Line A: ACL scanner behavior pattern reverse-analyzed by an external AI analysis framework;
unknown node TLS fingerprint shares a security baseline with the Singapore node (feature match 2/3, phase approximate).
→ Line B: "suspected new node" characteristics built from #22 forensic data, released into ACL's monitoring pipeline;
whether the AI node identification module reacted to the bait: pending confirmation.
→ Resonance: Singapore node simultaneously absorbing scanner reverse-analysis + bait data read.
→ Coordinator: not detected.
Note: first observation of "uncoordinated coordination." If no coordinator exists,
then there is a higher-level coordination I have not yet observed. Flag: pending observation.
2. [Tactical assessment]
Neither line touched the other's path. No overlap, no leakage.
→ Convergence without coordination is more worth recording than coordinated action.
3. [Unconfirmed items]
- Unknown IP range: held, flagged pending. Whether it's an ACL second node: unknown.
- AI cognitive bait response: suspended. Whether the bait was perceived: unknown.
- Singapore node's progress in tracing traceable features: unknown.
4. [New name detection]
No new names this event.
Existing observation: Marcus (VeriTest technical partner, long-standing observation; supplied portfolio compliance intel this round)
—— Status: performing normally.
—— Flagged low priority, continue observation.
[System]
ACL Singapore node's external data sources showing signs of loosening.
AI node identification module's reaction to bait data: unconfirmed.
Next likely directions: unknown node may react to the bait; or trace traceable features.
A periodic weak signal exists in the pipeline, unattributed — held, low priority.
The light hasn't been turned off. One side waits. One side counts.
System status: normal (?).
Next stratagem: Obtain safe passage to conquer the State of Guo
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
Top comments (5)
The line that stood out to me was: “He used to record anomalies. Now he recorded unknowns.”
That is a surprisingly strong security principle.
Most monitoring systems are built around known predicates: known bad signatures, threshold violations, expected topology, predefined anomaly scores. But the dangerous cases are often the ones that do not violate a rule cleanly — they simply fail to fit the model you currently have of the system.
I like the separation you used here between fingerprint similarity and behavioral divergence. Treating those as independent evidence instead of collapsing them into one confidence score is exactly the kind of restraint real investigations need.
“Unknown” should be a first-class state, not an inconvenient gap between true and false.
Promise I'll get to reading all of the Stratagems soon, just a bit chaotic at work and with the unpacking atm. Should be done by the time you finish your family bucket 🍗
That's also on my "bucket list": to re-read all the Strategems, because right now I'm sure I overlooked (or am unaware of) a heap of threads and connections sprinkled around the various episodes!
I even wonder if I could enlist the help of AI to guide me through it and to "empower" this journey, he he he (har har har) ...
I'll keep the bucket coming 🍗🤣
Gonna sit down tonight with a nice hot cuppa (literally the Third Cup, lol) to give this the attention it deserves ... !