Operation Whisper Net

AI · LINUX · difficulty 2 · ~18 min · 12 steps

Someone is smuggling your data out disguised as ordinary AI chatter.

Briefing

All company LLM traffic egresses through llm-proxy-01, an nginx gateway in front of an external model API. DLP flagged nothing, because to DLP it all looks like normal prompts. But one workstation is sending enormous 'prompts' at 3am, far beyond any human using a chat assistant. The approved AI channel is being used as an exfiltration tunnel. Find it in the proxy logs, understand why it slipped past DLP, and shut the tunnel.

Objectives

Return to the range lobby

THREAT FEED ▲ lateral movement via wmiexec up 18% ▲ new loader family 'GHOSTPULSE' staging via DLL search-order hijack ▲ prompt injection in support queues now routine ▲ cron persistence campaign targeting exposed SSH ▲ poisoned model weights on public hubs ▲ remember: trust nothing, hash everything ▲
operator@dojo:~$