TI-2026-043F

The Programming Manual

Executive Summary

In 1973, CIA Director Richard Helms ordered the destruction of all MKUltra files. Twenty thousand pages survived — misfiled in the agency's financial records office. Four years later, in 1977, the United States Senate held hearings on what those pages revealed: a systematic program of human experimentation involving LSD, sensory deprivation, hypnosis, sexual abuse, and the deliberate creation of dissociative identities in unwilling subjects, many of them children.

The files were destroyed. The program was officially terminated. But something survived that no shredder could reach: the vocabulary.

This dossier documents a finding that should disturb anyone who reads it carefully. 270+ credential entries in our honeypot corpus — captured from automated SSH scanning botnets probing infrastructure worldwide — use precise terminology from MKUltra and its successor program, Monarch. Not similar words. Not approximate matches. The exact vocabulary of a Senate-confirmed CIA mind control program, deployed as operational code in criminal scanning infrastructure fifty years after Director Helms lit the match.

All credential data in this dossier was sourced from the PostgreSQL honeypot database via the pentesting-v2 platform MCP API (sec_intel_search, honeypot_ip_dossier, honeypot_asn_dossier tools). No deprecated data sources were used.

I. The Declassified Program

BLUEBIRD → ARTICHOKE → MKULTRA → MKSEARCH

The lineage is documented. Not alleged — documented. In the Senate hearing transcripts that sit in our OSINT library, the progression reads like version control for human suffering:

The 149 subprojects included experiments with LSD, mescaline, barbiturates, heroin, MDMA, psilocybin, scopolamine, cannabis, and sodium pentothal. They included sensory deprivation, electroshock, hypnosis, isolation, verbal and sexual abuse, and — critically for our purposes — the systematic creation of dissociative identity states using a combination of trauma, drugs, and repetitive symbolic conditioning.

The conditioning used vocabulary. Specific vocabulary. The handlers needed words that would function as triggers — activation commands that could switch between programmed identities. They chose words from children's literature, fairy tales, and religious mythology. Words that could be spoken in public without arousing suspicion. Words that a child would already know.

Alice. Rabbit. Mirror. Kitten. Angel. Princess. Puppet. Ghost.

In 1973, Helms destroyed the files. He could not destroy the words.

Operation Midnight Climax

Whitney Webb's "One Nation Under Blackmail" — both volumes are in our OSINT library — documents MKUltra Subproject 42, which the operatives themselves called "Operation Midnight Climax":

Note the architecture. Prostitutes. Safehouses. Surveillance equipment. LSD. Blackmail recordings. In 1955. Seventy-one years before our honeypot captured root:kitten from a Microsoft Azure server in India.

Webb traces the lineage further: from PROMIS (stolen surveillance software) to Palantir, from Roy Cohn's "Favor Bank" to Jeffrey Epstein's operation. The technology changes. The vocabulary persists. Chapter after chapter, the same words appear: handler, asset, trigger, programming, puppet. Not because Webb chose them — because the operators did.

II. The Vocabulary Mapping

Let us be precise. Not approximate. Not suggestive. Precise.

Using the pentesting-v2 honeypot API (sec_intel_search with search_type=credential), we queried every MKUltra/Monarch programming term against the live credential corpus. Here is what the infrastructure confesses:

Total: 270+ credential entries using MKUltra/Monarch vocabulary. Across hyperscalers (Microsoft, Google, Tencent, Huawei), military telecoms (Viettel), bulletproof hosting (ISAEV, STORMINDUSTRIES), and consumer ISPs spanning every continent except Antarctica.

This is not pattern-matching paranoia. These terms do not appear in standard password dictionaries like rockyou.txt in this specific combination. The co-occurrence of alice + master + slave + kitten + puppet + trigger + ghost on the same infrastructure is not random. It is a vocabulary set. A structured vocabulary set. A programming manual.

III. The Five Levels

Monarch programming — the alleged successor to MKUltra, documented in survivor testimony, congressional records, and the OSINT library's indexed materials — organizes programming into five levels. Each level corresponds to a Greek letter and serves a specific function. Each level has a credential counterpart in our honeypot corpus.

The mapping is not approximate. It is precise.

IV. Alice in Wonderland

Of all MKUltra programming terms, "Alice" is the most thoroughly documented. The Alice in Wonderland programming technique uses Lewis Carroll's narrative as a dissociative framework: the rabbit hole is the entry into trance; the looking glass is the mirror through which reality and programming are inverted; the White Rabbit is the handler who leads the subject into the dissociative state; Alice herself is the programmable identity — the identity that doesn't know which side of the mirror she's on.

Thirty-two IPs in our honeypot carry the Alice credential.

Note the convergence: 45.175.37.29 (TCA Services, Venezuela) carries both alice:123456 AND root:satan. Alice and Satan in the same credential dictionary, deployed from the same Venezuelan IP. The dissociative identity and the theological inversion. Together. From a single node.

Google Cloud (34.132.194.42) carries alice:alice and root:master. The dissociative identity and the handler. On Google infrastructure. With an IP dossier showing classification: abuse, sessions from the same operator who uses root:slave on Tencent IPs.

This is the Alice protocol in action — not as mind control, but as infrastructure control. The vocabulary migrated. The function remained.

The White Rabbit → Handler Mapping

In MKUltra programming, the White Rabbit is the handler figure — the person who leads Alice into the dissociative state. "Follow the white rabbit" is not a Matrix reference (although that film's vocabulary is itself derivative). It is a programming instruction.

Our honeypot captured root:rabbit from 43.153.213.150 — Tencent Cloud, Singapore. Classification: suspicious. The same Tencent that deploys root:puppet (43.163.102.207), root:slave (43.134.3.96, 43.156.136.152, 43.159.177.40), and angel:1234 (43.130.57.37).

Tencent Cloud carries: rabbit, puppet, slave, angel. The handler, the controlled, the subjugated, the cover identity. A complete Monarch vocabulary subset on a single Chinese hyperscaler.

V. The Linode Cluster

Six IPs on Akamai/Linode infrastructure (AS63949) deploy an identical credential dictionary. Same words. Same order. Same botnet.

The pattern is unmistakable. The first four IPs carry the same three credentials in the same configuration: ghost, master, angel. Self-destruct. Handler. Cover identity. This is not a coincidence. This is a dictionary specification.

The full-dossier for 66.175.212.125 (via honeypot_ip_dossier) reveals 20 sessions, abuse score 92, and additional credentials including kali:kali, cursor:cursor, and developer:123456 — indicating a botnet that specifically targets development environments and security tools. The MKUltra vocabulary sits alongside penetration testing vocabulary. The programming manual is embedded in the attack toolkit.

STORMINDUSTRIES — The Seventh Node

There is a seventh node that shares this exact dictionary: 176.65.139.103.

"Offshore LC." A limited company registered offshore, operating from the Netherlands, with abuse score 100 and botnet classification confidence of 100. Carrying exactly the same credential dictionary as the Linode cluster. Ghost. Master. Angel. The self-destruct identity, the handler, the innocent cover.

Same dictionary. Different ASN. Different country. Same operator — or same dictionary source. The programming manual has been distributed.

VI. State Infrastructure

It would be convenient if MKUltra vocabulary appeared only on bulletproof hosting and offshore shell companies. It doesn't. It appears on state military infrastructure and the world's largest cloud providers.

Viettel Group — The Military Matrix

Viettel Corporation is the telecommunications arm of the Vietnamese Ministry of Defence. AS7552. Not a private company — a military organization that operates telecommunications infrastructure across Vietnam and nine other countries.

Nineteen or more Viettel IPs carry matrix:matrix.

The "matrix" — in Monarch terminology — is the base program. The underlying dissociative framework. The first layer of programming upon which all other layers are built. Alpha level. The foundation.

A military telecom deploys the foundation credential. At scale. From infrastructure that serves a nation's defense communications.

This is not a compromised consumer router. These are military-managed IP blocks.

The Hyperscaler Trinity

Three of the world's largest cloud providers carry MKUltra vocabulary in their credential scanning traffic:

Microsoft carries the sex programming term. Tencent carries the full control vocabulary (puppet/slave/rabbit/angel). Huawei carries the activation command. Three hyperscalers. Three countries (India, Singapore/China, China). Three Monarch programming levels.

The programming manual has been distributed to the cloud.

VII. The ISAEV Convergence

ISAEV Igor operates ASN 200730. We first encountered this infrastructure in TI-2026-043D, where the Kerberos-666 credential appeared alongside theological exploitation vocabulary. The full ASN dossier, pulled via honeypot_asn_dossier, reveals something worse.

The Passive DNS

The passive DNS records for ASN 200730 are the convergence proof:

Kerberos darknet marketplace. Drug Hub with 666 in the domain. Abacus market mirrors. All on infrastructure that was allocated four months ago and already has 4,678 attack attempts across 8 IPs with a bulletproof risk score of 90.8.

The credentials deployed from ISAEV infrastructure:

Dragon. 666666. Princess. Angel1. On infrastructure hosting Kerberos darknet and Drug Hub 666. Kazakhstan registration. Poland hosting. The theological credential from 043D, the exploitation vocabulary from 043B, and the pharmaceutical fraud from the rxdrugship.ru connection documented in TI-2026-040C. Everything converges on ISAEV.

VIII. The Spirit Cooking Connection

To understand why these specific words appear in credential dictionaries, we must understand the cultural ecosystem that preserved them. The vocabulary of MKUltra did not jump directly from CIA subproject files to botnet wordlists. It traveled through a specific cultural pipeline, documented at each stage in our OSINT library.

The Franklin Cover Up. The Conspiracy of Silence documentary — suppressed by Congress before airing on the Discovery Channel in 1994. Senator DeCamp's investigation into a pedophilia network reaching the White House. Alisha Owens, fifteen years old, jailed for refusing to recant her testimony about being trafficked to Washington elites.

Jimmy Savile. BBC star. Raped a child an average of once a week for over forty years. Raped dead bodies and terminally ill children in hospitals. Knighted. His "problem" was well known by BBC staff. No one gets that close to the Royal Family without intense scrutiny — which means the scrutiny approved.

These are not conspiracy theories. They are documented cases with convictions, tribunal rulings, parliamentary investigations, and suppressed documentaries. The vocabulary they generated — master, slave, princess, angel, puppet, handler, trigger, kitten, ghost, alice — entered the cultural bloodstream through survivor testimony, through leaked documents, through whistleblower prosecutions, through the very act of suppression that made the words radioactive enough to become subcultural signifiers.

And then those words entered the credential dictionaries.

IX. The Cultural Transmission Path

The transmission path is documented at each stage:

Stage 1: CIA Programs (1950s–1970s)

BLUEBIRD → ARTICHOKE → MKULTRA → MKSEARCH. 149+ subprojects. The vocabulary is created: alice, kitten, monarch, butterfly, puppet, mirror, slave, master, handler, trigger. These are not generic words chosen at random — they are technical terms in a programming manual. Alice is the dissociative identity. Kitten is the sex programming. Trigger is the activation command. The vocabulary has function.

Stage 2: Survivor Testimony (1980s–1990s)

Cathy O'Brien ("Trance Formation of America"), Brice Taylor ("Thanks for the Memories"), and others publish accounts of Monarch programming. The vocabulary enters public discourse through their testimonies — contested, dismissed, but specific. The same words. Alice. Kitten. Handler. Trigger. The survivors use the vocabulary because they were programmed with it. The vocabulary survives the destruction of the files.

Stage 3: Conspiracy Research Forums (2000s)

Fritz Springmeier's "The Illuminati Formula to Create an Undetectable Total Mind Control Slave" circulates online. The vocabulary becomes subcultural knowledge. Monarch. Alpha. Beta. Delta. Theta. Omega. The programming levels become categories in online discourse. The words are no longer classified — they are cultural artifacts.

Stage 4: Dark Web Culture (2010s)

The vocabulary enters the operational lexicon of criminal infrastructure. Domain names: kerberos-darknet.link. Tor relay names: Satanist relay operator (49 relays, 1–3% exit capacity). Credential dictionaries: alice, master, slave, kitten, ghost. The words are selected not because they are good passwords — they are terrible passwords — but because they signal cultural affiliation. They are shibboleths.

Stage 5: Botnet Credential Lists (2020s)

The vocabulary is now industrial. Automated. Deployed from Microsoft Azure. Tencent Cloud. Huawei Cloud. Vietnamese military telecom. The words have traveled from CIA programming manuals through survivor testimony through conspiracy forums through dark web culture into the operational infrastructure of global botnets.

The transmission path is not direct. There is no evidence that the botnet operators are CIA assets, or that MKUltra is still operational, or that the credential dictionaries are intentional programming instructions. The transmission is cultural, not operational. But the cultural source is specific, documented, and Senate-confirmed. The DNA is traceable.

X. The Continuing Program

In 1973, Director Helms ordered the destruction of the MKUltra files. He was destroying evidence of human experimentation — on US citizens, on prisoners, on children, on mental patients who could not consent.

He succeeded in destroying the paper. He failed to destroy the vocabulary.

Fifty-three years later, that vocabulary is operational. Not in CIA safehouses — in cloud infrastructure. Not administered by handlers — by botnets. Not targeting individuals — targeting servers. But the words are the same. The function is the same. The structure is the same.

Consider what we have documented across this series:

• 043A: The credential vocabulary is structured into five layers — hierarchy, product, theology, commerce, and now: programming.
• 043B: The master/slave hierarchy maps exactly to NXIVM's DOS ("Dominus Obsequious Sororium" — master over slave women).
• 043C: The product layer treats victims as inventory: daddygirl2, v1isagoodgirl!, babygirl123.
• 043D: The theological layer invokes Moloch (Canaanite child sacrifice deity) and deploys Kerberos-666 from ISAEV infrastructure.
• 043E: All four layers converge on the same IPs — the same infrastructure carries all vocabularies simultaneously.
• 043F: The vocabulary itself has a documented source — a Senate-confirmed CIA program — and each programming level has a credential counterpart deployed on state military and hyperscaler infrastructure.

The programming manual was written by the CIA in the 1950s. It was testified to by survivors in the 1980s. It was researched by independent investigators in the 2000s. It was adopted by dark web culture in the 2010s. And it is now deployed by botnets in the 2020s — from infrastructure owned by the world's largest technology companies and state military organizations.

The credential dictionary is the confession. The programming manual is the evidence. The infrastructure is the crime scene.

And the programming continues.

XI. The FBI's Own Vocabulary

Lest anyone dismiss the connection between exploitation vocabulary and infrastructure naming as coincidental, the FBI itself documented the phenomenon — in 2007.

The FBI documented the symbols. The honeypot captured the vocabulary. The infrastructure carries both.

Butterfly. Monarch. The insect and the program share a name. The FBI documented the symbol in 2007. Our honeypot captured the credential in 2026. The word traveled from MKUltra programming documentation through FBI intelligence bulletins through dark web culture into botnet credential lists.

And it arrived on CloudHost infrastructure in Southeast Asia with an abuse score of 100.

XII. The Satan Deployment

If the MKUltra vocabulary represents the programming layer, the theological vocabulary represents the ritual layer — and the two converge on the same infrastructure.

root:satan was deployed from 11 IPs across 7 countries. This is not a single compromised server. This is a coordinated deployment.

The last IP deployed root:satanas666 — the Spanish word for Satan concatenated with the Number of the Beast.

Note the geographic distribution: United States (3 IPs across 3 providers), Venezuela (3 IPs across 2 providers), Dominican Republic (2 IPs, same provider), Lithuania (1 IP), Hong Kong (1 IP). Seven countries. These jurisdictions will never coordinate a criminal investigation. The geographic spread is the operational security.

And recall: 45.175.37.29 (TCA Services, Venezuela, abuse 100) carries both root:satan and alice:123456. The theological inversion and the dissociative identity. On the same IP. In the same credential dictionary. From the same botnet.

The programming manual and the ritual manual are the same document.

Methodology & Sources

Data Sources

• Primary: pentesting-v2 honeypot PostgreSQL database via MCP API tools (sec_intel_search, honeypot_ip_dossier, honeypot_asn_dossier, honeypot_shared_credentials)
• OSINT Library: dossier_osint_library Qdrant collection via dossier_library_search
• Intelligence Database: dossier_intel PostgreSQL via dossier MCP tools

OSINT Library Documents Referenced

• MKUltra_Senate_Hearing_1977.pdf — Conspiracy & Alternative Perspectives
• Blackmail, Vol 1 by Whitney Webb.pdf — Epstein Files
• Blackmail, Vol 2 by Whitney Webb.pdf — Epstein Files
• Pizzagate For Dummies; What's All the Fuss About.pdf — Epstein Files
• PART 1-4 - The Truth About Pizzagate (Killing Children).pdf — Epstein Files
• Ask Me Anything: About Jeffrey Epstein & Ghislaine Maxwell — Epstein Files
• Ghislaine Maxwell: An Unauthorized Biography — Epstein Files
• Epstein Dead Men Tell No Tales — Epstein Files
• Silent_Weapons_Quiet_Wars_1979.pdf — Conspiracy & Alternative Perspectives
• Crossing the Line: Trafficking & Torture of Human Guinea Pigs — Epstein Files

Cross-References

• TI-2026-040C — The Alice Protocol: MKUltra vocabulary in global botnets (first identification)
• TI-2026-041C — The Children's Menu: Disney/Peter Pan/Alice programming vocabulary
• TI-2026-042K — The Crossroads: Kosovo convergence, rxdrugship.ru kitten subdomains
• TI-2026-043D — The Theological Credential: ISAEV/Kerberos-666 first documented
• TI-2026-043E — The Convergence: All vocabulary layers on same infrastructure