Pre-Strike Worm

Distribution

The worm does not travel digitally. Nexus intercepts digital traffic — all of it, comprehensively, with the kind of thoroughness that makes encryption a speed bump rather than a wall. So the worm moves the way the Collective moves everything sensitive: physical data chips, left in dead drops across the Sprawl, retrieved by field agents who never meet the agent who planted them.

A dead drop is a crack in a wall, a magnetic case under a transit bench, a modified drainage grate in Sector 11. The Collective maps every active drop and every burned one. The intelligence about which drops are burned travels the same way the worms do — physical media, trusted hands, analog patience in a digital world. An operator doesn't carry the worm into the field. Carrying it creates exposure if they're searched, and the worm's only vulnerability window is installation. By the time it's running, searching for it is an exercise in looking for something that has already finished being something.

The entire distribution network runs slower than a single encrypted transmission. Nexus could deploy an equivalent payload in 0.003 seconds. The Collective's deployment cycle averages eleven days from chip fabrication to field installation.

The Collective's operational success rate against Nexus-secured targets has held at 73% for three consecutive years. Nexus's interdiction rate against Collective operations has held at 12%. Someone is optimizing for the right variable, and it isn't speed.

The Toolkit

The Pre-Strike Worm is the standard variant — defense stripping, calibrated for corporate security architecture. The Collective maintains a modular penetration toolkit built on the same philosophy:

The Attrition Plant goes in days before engagement and degrades structural integrity the way water damages a foundation — progressively, invisibly, until the load-bearing wall that held on Tuesday doesn't hold on Friday. Detectable over time, if someone knows to look. Shade Division has identified three Attrition Plants in the past eighteen months. Internal estimates suggest they missed somewhere between forty and seventy.

The Throttle Worm limits all enemy systems simultaneously — a broader effect compressed into a shorter operational window. Less elegant. Noisier. The Collective deploys it when the objective is worth the exposure, which tells Shade Division something about mission priority every time they detect one. The Collective knows Shade Division knows this. They deploy it anyway when it matters. The calculus is public.

The Exploit Crack rips existing vulnerabilities wider than standard penetration tools — finds the hairline fracture in a security wall and turns it into a doorway. Longer installation time, higher detection risk during deployment. Two Collective operators have been captured during Exploit Crack installations. Both were carrying dead drop coordinates for other agents. Neither coordinate set was current. The Collective burns addresses faster than Shade Division can raid them. The captured operators' chips contained worm variants that were already two versions obsolete by the time Nexus forensics finished imaging them.

Every tool in the kit operates on the same assumption: direct confrontation with Nexus, with Shade Division, with Guardian Corp, with the NCC Inquisition is a losing proposition at every resource ratio the Collective can achieve. The Collective does not try to match their adversaries. Matching requires fighting on terms calibrated to the other side's strengths. The Collective defines their own terms: arrive with the fight already decided, complete the objective, leave.

The Dead Hand Rule prohibits autonomous weapons authority. It says nothing about autonomous infrastructure compromise. The worm is not a weapon. It is a tool that adjusts things. The things it adjusts happen to be the security systems protecting the people the Collective intends to rob, sabotage, or surveil. The distinction is legal. The distinction is also the reason the Pre-Strike Worm exists in a regulatory gap that seventeen Nexus legal petitions have failed to close.

The Chips

The worm ships on standard-format data chips indistinguishable from commercial stock — no markings, no modification that registers on a surface scan. The chips are sourced through supply chains crossing three separate jurisdictions before reaching Collective fabrication cells. Forensics teams that recovered chips post-operation have traced them, consistently, to a manufacturing batch sold legitimately to a mid-tier data storage distributor in Sector 7. The distributor has been raided twice. The chips are purchased through dozens of separate, unconnected buyer accounts. The supply chain is not a secret — it is a surface so large that covering it would cost more than the operations it enables.

The worm itself, once installed, generates no persistent file signature. It operates in allocated memory and exits cleanly when its degradation sequence completes. Four years of Nexus investigation have produced two partial code samples. Both were from obsolete variants. The Collective versions their tools; Nexus's forensic timeline suggests it took them roughly eight months to notice.

No individual Collective operators have been publicly identified as Pre-Strike Worm specialists. Two captured during Exploit Crack installations were processed without yielding usable network intelligence; their identities are sealed in NCC Inquisition custody, and the Collective has not acknowledged them. Distribution nodes — the people who plant and maintain dead drops — are believed to number in the dozens. Some are likely civilian contractors handed physical packages and coordinates with no context about what the chips contain. The worm moves the way any contraband moves: through layers of deniable intermediaries who each know less than the layer above them.

Invisibility as Fog

The Sprawl's privacy havens are defensive geography — places a person travels to where the watching stops. The Pre-Strike Worm is the [Transparency Bargain](the-transparency-bargain)'s one offensive answer, and it works by manufacturing invisibility inside the watcher's own surveillance. It deploys hours or days before the operator arrives, degrades defenses from the inside, and trips no attack-detection system because — technically, definitionally — it never attacks anything. Shade Division's fourteen detection protocols work during installation; after installation there is nothing to detect. The Collective does not hide from the surveillance. It edits the surveillance into not seeing.

The deepest form of this is already latent in the worm's own intelligence file: the theory that the Collective's 340%-expanded dead-drop network is mostly empty — decoys — and that the expansion itself is the operation, a Pre-Strike Worm run against [Shade Division](shade-division)'s attention, forcing Nexus to spread surveillance coverage across a network ten times larger than necessary until the resolution drops everywhere at once. This is invisibility not as a place you hide but as a fog you generate. It is the same defeat [the Data Shadow](the-data-shadow)'s Sifters win by accident — dissolving beneath the instruments' resolution — except the Collective does it on purpose, at scale, as doctrine. Both have learned the lesson the rich learned first and the Bargain cannot un-teach: you do not beat total surveillance by hiding from it. You beat it by making it too expensive to be total — by being, in aggregate, more than the watcher can afford to resolve. The geography of invisibility, at its most sophisticated, is not a tunnel or a vault. It is a thinning of the watcher's gaze, induced quietly, in advance, before the real operation begins.

The Crime With No Crime Scene

The Pre-Strike Worm belongs to the Evidence Paradox thread for a reason Shade Division's classification taxonomy is structurally unable to admit: the worm does not forge evidence. It manufactures the absence of evidence, which the law has no category for and no instrument to image.

The thread's usual story is about fabrication — proof spun out of nothing, deepfakes indistinguishable from reality, a justice system hollowed out because anything can be faked. The worm is the same crisis approached from the far side. It "never attacks anything," definitionally, in every way the classification algorithms understand. By the time the operator walks through the door, what would have stopped them has already been removed by something that was never there. The crime scene is pristine. The system boots clean. The only trace the worm leaves is a negative space shaped exactly like an intrusion — and you cannot photograph a thing defined by not being present, cannot enter it into evidence, cannot cross-examine a deletion.

This is why seventeen Nexus legal petitions have failed to close the gap, and why the gap is not a loophole but the thread itself. A justice system can perhaps adapt to forged proof — demand stronger provenance, raise the burden, distrust the too-perfect record. It cannot adapt to crimes engineered to produce no proof, because there is nothing for the burden to attach to. Judge Dreg ruled that "a record that cannot be wrong is not evidence — it is a verdict in costume," throwing out documentation too clean to trust. The Pre-Strike Worm hands him the opposite case and the same dead end: a defendant against whom there is no record at all, because the record was the first thing the worm removed. The Dead Hand Rule prohibits autonomous weapons. It says nothing about autonomous infrastructure compromise, because the people who wrote it could still imagine a court that could tell the two apart. The worm exists in the space where that distinction stopped being verifiable.

Affiliated Entities

• The Collective: Designed the worm as asymmetric tactical infrastructure. The worm embodies their operational philosophy with uncomfortable precision — strike first, strike quietly, never fight fair when you can fight ahead of time. The 73% success rate is the philosophy's report card.
• Nexus Dynamics: Primary target. The worm was built to operate inside Nexus security architecture specifically, calibrated against their detection thresholds, their response timing, their classification taxonomies. Building a tool this precisely targeted requires understanding the target better than the target understands itself. The Collective's intelligence on Nexus internal security protocols is, by several metrics, more current than Nexus's own documentation.
• Shade Division: Built fourteen detection protocols. The protocols catch installation attempts 31% of the time. The other 69% of the time, the worm is already running before Shade Division knows it was planted. The division's annual budget for Pre-Strike Worm countermeasures exceeds the Collective's entire annual operating budget by a factor of six. Shade Division considers this an acceptable allocation. The Collective considers it a compliment.
• The Law (Judge Dreg): The Dregs' arbiter never tries a Pre-Strike Worm case, because a Pre-Strike Worm case has no evidence to try. His doctrine — a record that cannot be wrong is not evidence, it is a verdict in costume — was built for documentation too clean to trust. The worm is the opposite problem on the same axis: not a record too clean, but no record at all, the crime scrubbed before it happened. Both are the Evidence Paradox; both leave a judge with nothing he can stand a witness in front of.

▲ Unverified Intelligence

The Collective's dead drop network has expanded 340% in the past three years — far exceeding the pace required by their current operational tempo. Most new drops are in sectors where the Collective has no known active operations. Shade Division analysts have flagged the expansion as potential pre-positioning for a large-scale coordinated action, but cannot determine the target without burning surveillance assets they've spent years placing.

One theory circulating in Shade Division's analytical division: the excess drops are empty. Decoys. The expansion itself is the operation — forcing Nexus to allocate surveillance resources across a network ten times larger than necessary, diluting their coverage of the drops that actually carry payloads. If true, the Collective is running a Pre-Strike Worm against Shade Division's attention — degrading their analytical capacity the same way the worm degrades security protocols. Quietly. In advance. Before the real operation begins.

Shade Division has requested budget to monitor all new drops simultaneously. The request was denied. The budget required would exceed the Collective's entire annual operating budget by a factor of eleven.

An unverified Collective internal document, circulated through a source Shade Division rates as "partially reliable," describes a variant designated the Sleeper — a worm that installs, goes fully dormant for six to eighteen months, and only begins degradation when triggered by an external signal. If the Sleeper exists, it is already somewhere inside Nexus infrastructure, and its dormancy period means it predates any detection protocol Shade Division currently runs. Shade Division's official position is that the report is disinformation. Their unofficial budget line for Sleeper investigation has existed for fourteen months.

The Long Mercy Retool

The Worm's original mission was infrastructure procurement — disrupting the Nexus systems that route maintenance funding away from present-service delivery toward long-horizon capital projects. The 73% success rate against Nexus systems was achieved against this target profile between 2171 and 2179.

The retooling happened in 2180, after the Long Mercy doctrine became a named political position and after the Collective's analytical division concluded that procurement disruption was treating symptoms: even when a specific funding redirect was blocked, the Civic Advisory simply generated an updated projection that achieved the same reallocation through a different mechanism. The math was the problem, not the procurement routing. You cannot block a math.

What you can do is make the math tell a different story.

The Worm's current configuration targets Civic Advisory projection data pipelines at a specific point in the modeling cycle — the welfare cost estimation phase, where the model assigns quantitative weight to present-generation transition impacts. The corruption is targeted: present-generation welfare costs are inflated by a factor of 1.4; the confidence interval on long-horizon welfare projections is deflated by an equivalent factor. The effect on the model's output is measurable. Infrastructure reallocations that would clear the ratification threshold under the Advisory's standard modeling now fall below it under the adjusted data. The councils vote closer to 50/50. Transition assistance gets improved. Water filtration gets maintained.

The Advisory's technical review board has described this as "systematic data corruption with material impact on governance quality." The Collective's position, published anonymously in a technical journal that does not list its editor's address: the corruption adjusts for a documented systematic bias in the Advisory's modeling — a consistent underweighting of present-generation welfare by a factor of approximately 1.3 to 1.5, which the Worm corrects to approximately neutral. The Advisory has not opened its models to external audit. The Collective's adjustment factor is derived from the Worm's own impact measurements rather than the underlying model. This is, technically, a bootstrapped calibration. The plumber's water has been clean for fourteen months. The Worm's operators consider this an acceptable validation methodology.