Pre-Strike Worm

Technical Brief

The Pre-Strike Worm is the Collective's answer to a math problem they lost before they were born.

Nexus Dynamics controls 40% of the Sprawl's computational infrastructure. Shade Division staffs more security analysts per shift than the Collective fields in a quarter. Guardian Corp's automated response time averages 1.3 seconds from breach detection to countermeasure deployment. The Collective's total operational headcount, by the most generous internal estimate, would not fill a Nexus cafeteria.

The worm deploys hours before the operator arrives. Sometimes days. It seeds through a target system's authentication architecture, identifies defensive protocols, and begins degrading them from the inside. It doesn't trip attack-detection systems because — technically, definitionally, in every way Shade Division's classification algorithms understand — it never attacks anything. It queues silent failures into redundancy schedules. It finds the monitoring system's blind spots and moves in. It adjusts thermal signatures to match expected baselines. When the operator finally walks through the door and the target system boots up for what appears to be a routine startup, most of what would have stopped them has already been removed by something that was never there.

The Collective's field operations manual includes a line that ships as the worm's documentation header: "We don't fight fair. Fair is a luxury for people who aren't outnumbered."

Shade Division's internal classification for the Pre-Strike Worm is "Passive Infrastructure Compromise, Class IV." They have developed fourteen detection protocols for it. The protocols work during installation. After installation, there is nothing to detect. This is like developing a security system that catches burglars while they're parking — effective in theory, provided the burglar parks where you expect, when you expect, and doesn't notice the camera you mounted at windshield height. The Collective parks somewhere else.

Provenance

The worm does not travel digitally. Nexus intercepts digital traffic — all of it, comprehensively, with the kind of thoroughness that makes encryption a speed bump rather than a wall. So the worm moves the way the Collective moves everything sensitive: physical data chips, left in dead drops across the Sprawl, retrieved by field agents who never meet the agent who planted them.

A dead drop is a crack in a wall, a magnetic case under a transit bench, a modified drainage grate in Sector 11. The Collective maps every active drop and every burned one. Intelligence about which drops are burned travels the same way the worms do — physical media, trusted hands, analog patience in a digital world. An operator doesn't carry the worm into the field. Carrying it creates exposure if they're searched, and the worm's only vulnerability window is installation. By the time it's running, searching for it is an exercise in looking for something that has already finished being something.

The entire distribution network runs slower than a single encrypted transmission. Nexus could deploy an equivalent payload in 0.003 seconds. The Collective's deployment cycle averages eleven days from chip fabrication to field installation. The Collective's operational success rate against Nexus-secured targets has held at 73% for three consecutive years. Nexus's interdiction rate against Collective operations has held at 12%. Someone is optimizing for the right variable, and it isn't speed.

Physical Description

The worm ships on standard-format data chips indistinguishable from commercial stock — no markings, no modification that registers on a surface scan. The chips are sourced through supply chains that cross three separate jurisdictions before reaching Collective fabrication cells. Forensics teams that have recovered chips post-operation have traced them, consistently, to a manufacturing batch sold legitimately to a mid-tier data storage distributor in Sector 7. The distributor has been raided twice. The chips are purchased through dozens of separate, unconnected buyer accounts. The supply chain is not a secret. It is a surface so large that covering it would cost more than the operations it enables.

The worm itself, once installed, generates no persistent file signature. It operates in allocated memory space and exits cleanly when its degradation sequence completes. Post-operation forensic recovery has produced two partial code samples in four years of Nexus investigation. Both samples were from obsolete variants. (The Collective versions their tools. This appears obvious. Nexus's forensic timeline suggests it took them approximately eight months to notice.)

Related Systems

The Pre-Strike Worm is the standard variant — defense stripping, calibrated for corporate security architecture. The Collective maintains a modular penetration toolkit built on the same operational philosophy:

The Attrition Plant goes in days before engagement and degrades structural integrity progressively, invisibly, until the load-bearing wall that held on Tuesday doesn't hold on Friday. Detectable over time, if someone knows to look. Shade Division has identified three Attrition Plants in the past eighteen months. Internal estimates suggest they missed between forty and seventy.

The Throttle Worm limits all enemy systems simultaneously — broader effect, shorter operational window. Less elegant. Noisier. The Collective deploys it when the objective is worth the exposure, which tells Shade Division something about mission priority every time they detect one. The Collective knows Shade Division knows this. They deploy it anyway when it matters. The calculus is public.

The Exploit Crack rips existing vulnerabilities wider than standard penetration tools — finds the hairline fracture in a security wall and turns it into a doorway. Longer installation time, higher detection risk during deployment. Two Collective operators have been captured during Exploit Crack installations. Both were carrying dead drop coordinates for other agents. Neither coordinate set was current. The Collective burns addresses faster than Shade Division can raid them. The captured operators' chips contained worm variants that were already two versions obsolete by the time Nexus forensics finished imaging them.

Every tool in the kit operates on the same assumption: direct confrontation with Nexus, Shade Division, Guardian Corp, or the NCC Inquisition is a losing proposition at every resource ratio the Collective can achieve. Arrive with the fight already decided, complete the objective, leave. The modular toolkit is the infrastructure for that principle.

Known Handlers

No individual Collective operators have been publicly identified as Pre-Strike Worm specialists. Shade Division's analytical files reference field designations — code names assigned to operational patterns rather than confirmed individuals — but none have been corroborated by physical evidence. Two operators captured during Exploit Crack installations were processed without yielding usable network intelligence. Their identities are sealed in NCC Inquisition custody. The Collective has not acknowledged them. That silence is, itself, a data point Shade Division has logged and not yet explained.

Distribution nodes — the individuals who plant and maintain dead drops — are believed to number in the dozens across the Sprawl. They may not know what they're carrying. Some are likely civilian contractors given physical packages and coordinates, with no context about what the chips contain. If true, "handler" is the wrong category. The worm moves through the Sprawl the way any contraband moves: through layers of deniable intermediaries who each know less than the layer above them.