shellDojo needs JavaScript for the interactive range. The briefings are readable without it:
- Operation Ghost Signal — A web server is mining crypto for someone who isn't you.
- Operation Midnight Run — PsExec-style lateral movement on a domain-joined Windows server.
- Operation Iron Ledger — Post-breach persistence audit on a Debian build server.
- Operation Glass Shield — Emergency network segmentation during a live ransomware spread.
- Operation Broken Key — Locked out of your own database server. Boot it back into your hands.
- Operation Dead Bolt — The domain controller locked every admin out. Recover it from the boot up.
- Operation Salted Earth — A live ransomware run is locking you out as fast as you log in. Race it.
- Operation Paper Oracle — Your support AI read a booby-trapped ticket and did what it was told.
- Operation Hollow Index — One poisoned document taught your company assistant to lie.
- Operation Tainted Weights — The model you deployed this morning isn't the one you reviewed.
- Operation Ghost Prompt — Your chatbot handed a stranger its own system prompt — API key and all.
- Operation Runaway Agent — An autonomous agent went off the rails and started renting GPUs on your card.
- Operation Whisper Net — Someone is smuggling your data out disguised as ordinary AI chatter.
- Operation False Copilot — A developer plugged an untrusted tool into their AI copilot. It read the repo secrets.
- Operation Poison Well — Someone seeded your abuse-detection model to wave their own attacks through.
- Operation Mirror Mask — A cloned voice talked your help desk into resetting an executive's MFA.
- Operation Synthetic Siege — Every infected host has a different malware hash. Signatures are useless. Adapt.
- Operation Cold Trail — One C2 address. Pivot it into the attacker's whole estate — and find where the trail ends.
- Operation Paper Trail — You know what happened. Now preserve it, report it, and hand it over properly.
- Operation Onion Skin — Every hop is Tor. Route attribution is dead — so establish why they came for you.
- Operation Flash Point — A compromised agent is spawning workloads faster than you can delete them. Stop chasing.
- Operation Hydra Protocol — It rebuilds itself every time you kill it. Take away what it rebuilds with.
- Operation Dead Reckoning — Machine-generated credential stuffing from 9,000 addresses. Blocking by hand loses.
- Operation Hollow Crown — A nation-state-grade domain compromise. Work it to first contact and find out who really opened the door.
- Operation Still Water — A water plant, operators locked out of the HMI, and a dosing setpoint that is no longer theirs.
- Operation Dry Powder — The autonomous defence appliance is dead. Drones, robots, machinery and radios are all yours now.
- Operation Paper Walls — Twelve containers, one reverse proxy, and one bind mount that made all of it optional.
- Operation Last Good Copy — Everything on the NAS is encrypted, including the backup. Something older than the damage still exists.
- Operation Thin Partition — A doorbell camera reached the hypervisor's management interface. The VLAN was a label, not a wall.
- Operation Rebound — A public name resolved to your living room. The browser did the rest.
- Operation Dark Datastore — Every guest is stopped and the datastore is encrypted. The multi-terabyte disks were never touched.
- Operation Choke Point — Your edge firewall answers to somebody else. Everything the site does passes through it.
- Operation Blue Water — Contacts that are not there, a position that jumps, and a chart display that believes all of it.
- Operation Broken Chain — Nothing was exploited. Every component did exactly what it was documented to do, and the data left anyway.
- Operation Cold Key — No malware. A Group Policy Object turned on BitLocker across the estate with somebody else's recovery key.
- Operation Borrowed Blade — The endpoint agent did not crash and did not alert. It was terminated from kernel space by a driver with a valid signature.
- Operation Babel — You inherited the site, the servers and the logs. The logs are not in your language, and neither is the intruder.
- Operation Undertow — Your users' video feeds are being steered. You cannot fix what they see. You can destroy the thing that put it there.
- Operation Ash Layer — The logs were destroyed and the toolkit was shredded. The filesystem kept more than either of them intended.
- Operation Residue — Sixteen gigabytes of RAM from a host that looked clean. Every process on it is a Windows process. One is lying.
- Operation Second Hand — Every timestamp on the suspect file says March. The filesystem keeps a second set that nothing bothered to change.