Pre-Strike Worm
Pre-Strike Worm
Overview
The Pre-Strike Worm is the Collective's answer to a math problem they lost before they were born.
Nexus Dynamics controls 40% of the Sprawl's computational infrastructure. Shade Division staffs more security analysts per shift than the Collective fields in a quarter. Guardian Corp's automated response time averages 1.3 seconds from breach detection to countermeasure deployment. The Collective's total operational headcount, by the most generous internal estimate, would not fill a Nexus cafeteria.
The worm deploys hours before the operator arrives. Sometimes days. It seeds through a target system's authentication architecture, identifies defensive protocols, and begins degrading them from the inside. It doesn't trip attack-detection systems because — technically, definitionally, in every way Shade Division's classification algorithms understand — it never attacks anything. It queues silent failures into redundancy schedules. It finds the monitoring system's blind spots and moves in. It adjusts thermal signatures to match expected baselines. When the operator finally walks through the door and the target system boots up for what appears to be a routine startup, most of what would have stopped them has already been removed by something that was never there.
The Collective's field operations manual includes a line that ships as the worm's documentation header: "We don't fight fair. Fair is a luxury for people who aren't outnumbered."
Shade Division's internal classification for the Pre-Strike Worm is "Passive Infrastructure Compromise, Class IV." They have developed fourteen detection protocols for it. The protocols work during installation. After installation, there is nothing to detect. This is like developing a security system that catches burglars while they're parking — effective in theory, provided the burglar parks where you expect, when you expect, and doesn't notice the camera you mounted at windshield height.
The Collective parks somewhere else.
Distribution
The worm does not travel digitally. Nexus intercepts digital traffic — all of it, comprehensively, with the kind of thoroughness that makes encryption a speed bump rather than a wall. So the worm moves the way the Collective moves everything sensitive: physical data chips, left in dead drops across the Sprawl, retrieved by field agents who never meet the agent who planted them.
A dead drop is a crack in a wall, a magnetic case under a transit bench, a modified drainage grate in Sector 11. The Collective maps every active drop and every burned one. The intelligence about which drops are burned travels the same way the worms do — physical media, trusted hands, analog patience in a digital world. An operator doesn't carry the worm into the field. Carrying it creates exposure if they're searched, and the worm's only vulnerability window is installation. By the time it's running, searching for it is an exercise in looking for something that has already finished being something.
The entire distribution network runs slower than a single encrypted transmission. Nexus could deploy an equivalent payload in 0.003 seconds. The Collective's deployment cycle averages eleven days from chip fabrication to field installation.
The Collective's operational success rate against Nexus-secured targets has held at 73% for three consecutive years. Nexus's interdiction rate against Collective operations has held at 12%. Someone is optimizing for the right variable, and it isn't speed.
The Toolkit
The Pre-Strike Worm is the standard variant — defense stripping, calibrated for corporate security architecture. The Collective maintains a modular penetration toolkit built on the same philosophy:
The Attrition Plant goes in days before engagement and degrades structural integrity the way water damages a foundation — progressively, invisibly, until the load-bearing wall that held on Tuesday doesn't hold on Friday. Detectable over time, if someone knows to look. Shade Division has identified three Attrition Plants in the past eighteen months. Internal estimates suggest they missed somewhere between forty and seventy.
The Throttle Worm limits all enemy systems simultaneously — a broader effect compressed into a shorter operational window. Less elegant. Noisier. The Collective deploys it when the objective is worth the exposure, which tells Shade Division something about mission priority every time they detect one. The Collective knows Shade Division knows this. They deploy it anyway when it matters. The calculus is public.
The Exploit Crack rips existing vulnerabilities wider than standard penetration tools — finds the hairline fracture in a security wall and turns it into a doorway. Longer installation time, higher detection risk during deployment. Two Collective operators have been captured during Exploit Crack installations. Both were carrying dead drop coordinates for other agents. Neither coordinate set was current. The Collective burns addresses faster than Shade Division can raid them. The captured operators' chips contained worm variants that were already two versions obsolete by the time Nexus forensics finished imaging them.
Every tool in the kit operates on the same assumption: direct confrontation with Nexus, with Shade Division, with Guardian Corp, with the NCC Inquisition is a losing proposition at every resource ratio the Collective can achieve. The Collective does not try to match their adversaries. Matching requires fighting on terms calibrated to the other side's strengths. The Collective defines their own terms: arrive with the fight already decided, complete the objective, leave.
The Dead Hand Rule prohibits autonomous weapons authority. It says nothing about autonomous infrastructure compromise. The worm is not a weapon. It is a tool that adjusts things. The things it adjusts happen to be the security systems protecting the people the Collective intends to rob, sabotage, or surveil. The distinction is legal. The distinction is also the reason the Pre-Strike Worm exists in a regulatory gap that seventeen Nexus legal petitions have failed to close.
The Chips
The worm ships on standard-format data chips indistinguishable from commercial stock — no markings, no modification that registers on a surface scan. The chips are sourced through supply chains crossing three separate jurisdictions before reaching Collective fabrication cells. Forensics teams that recovered chips post-operation have traced them, consistently, to a manufacturing batch sold legitimately to a mid-tier data storage distributor in Sector 7. The distributor has been raided twice. The chips are purchased through dozens of separate, unconnected buyer accounts. The supply chain is not a secret — it is a surface so large that covering it would cost more than the operations it enables.
The worm itself, once installed, generates no persistent file signature. It operates in allocated memory and exits cleanly when its degradation sequence completes. Four years of Nexus investigation have produced two partial code samples. Both were from obsolete variants. The Collective versions their tools; Nexus's forensic timeline suggests it took them roughly eight months to notice.
No individual Collective operators have been publicly identified as Pre-Strike Worm specialists. Two captured during Exploit Crack installations were processed without yielding usable network intelligence; their identities are sealed in NCC Inquisition custody, and the Collective has not acknowledged them. Distribution nodes — the people who plant and maintain dead drops — are believed to number in the dozens. Some are likely civilian contractors handed physical packages and coordinates with no context about what the chips contain. The worm moves the way any contraband moves: through layers of deniable intermediaries who each know less than the layer above them.
Connections
- The Collective: Designed the worm as asymmetric tactical infrastructure. The worm embodies their operational philosophy with uncomfortable precision — strike first, strike quietly, never fight fair when you can fight ahead of time. The 73% success rate is the philosophy's report card.
- Nexus Dynamics: Primary target. The worm was built to operate inside Nexus security architecture specifically, calibrated against their detection thresholds, their response timing, their classification taxonomies. Building a tool this precisely targeted requires understanding the target better than the target understands itself. The Collective's intelligence on Nexus internal security protocols is, by several metrics, more current than Nexus's own documentation.
- Shade Division: Built fourteen detection protocols. The protocols catch installation attempts 31% of the time. The other 69% of the time, the worm is already running before Shade Division knows it was planted. The division's annual budget for Pre-Strike Worm countermeasures exceeds the Collective's entire annual operating budget by a factor of six. Shade Division considers this an acceptable allocation. The Collective considers it a compliment.
▲ Unverified Intelligence
The Collective's dead drop network has expanded 340% in the past three years — far exceeding the pace required by their current operational tempo. Most new drops are in sectors where the Collective has no known active operations. Shade Division analysts have flagged the expansion as potential pre-positioning for a large-scale coordinated action, but cannot determine the target without burning surveillance assets they've spent years placing.
One theory circulating in Shade Division's analytical division: the excess drops are empty. Decoys. The expansion itself is the operation — forcing Nexus to allocate surveillance resources across a network ten times larger than necessary, diluting their coverage of the drops that actually carry payloads. If true, the Collective is running a Pre-Strike Worm against Shade Division's attention — degrading their analytical capacity the same way the worm degrades security protocols. Quietly. In advance. Before the real operation begins.
Shade Division has requested budget to monitor all new drops simultaneously. The request was denied. The budget required would exceed the Collective's entire annual operating budget by a factor of eleven.
An unverified Collective internal document, circulated through a source Shade Division rates as "partially reliable," describes a variant designated the Sleeper — a worm that installs, goes fully dormant for six to eighteen months, and only begins degradation when triggered by an external signal. If the Sleeper exists, it is already somewhere inside Nexus infrastructure, and its dormancy period means it predates any detection protocol Shade Division currently runs. Shade Division's official position is that the report is disinformation. Their unofficial budget line for Sleeper investigation has existed for fourteen months.