Follow the Payload · 12 — The Decoy Payload: A Payload Planted to Be Misread

Follow the Payload — Case 12. This register takes what an intruder leaves behind and reads it for the one thing it cannot hide: its purpose. Closing each case on the objective the payload serves: STEAL COMPUTE · STEAL BANDWIDTH · RECRUIT · STEAL DATA · EXTORT · PERSIST.

The register has read payloads that hid their intent and one payload that lied about it. This case reads a payload that tells the truth about itself and is used to lie. A decoy is a payload planted deliberately to be found and misread: the operator drops something conspicuous — a loud miner, an obvious webshell — precisely so the defender finds it, reads it as the intrusion's objective, feels the clean satisfaction of a solved case, and stops looking. And while the defender is satisfied, a quieter payload — a stealthy harvester, a hidden backdoor — does the real work, protected by the very closure the decoy produced. The decoy is a genuine payload doing a genuine thing; the miner really mines. Its deception is not about what it is but about what role it plays in the operation: it is the intrusion's false objective, planted to end the search at the wrong place.

This makes the decoy the register's adversarial case, the payload-layer counterpart to the false flag the attribution register studied. There, an operator planted a misleading identity signal to make the analyst attribute the wrong hand; here, an operator plants a misleading objective signal to make the analyst read the wrong purpose. Both are deceptions aimed squarely at the analyst's reading, and both work the same way — by offering a plausible, satisfying signal that the analyst will latch onto and stop at. Reading the decoy therefore demands a discipline the register planted in its very first case, at the miner: never let a single conspicuous payload close the investigation. The decoy is beaten not by the unreliable skill of spotting every plant, but by an investigative posture that makes spotting them unnecessary — one that treats the loudest payload as the beginning of the search and never its end. This case is about that posture, and about the honest MEDIUM confidence with which a decoy can ever be named.

1. A Truthful Payload in a False Role

Begin with what the decoy is and is not, because the distinction is the case. A decoy is not a payload that lies about its function. The decoy miner really is a miner; it really mines; if you analyze it, its function is exactly what it appears to be. The deception is not in the payload's self-representation — the payload is honest about itself. The deception is in the payload's role: this genuine miner is presented as the intrusion's objective when it is in fact the intrusion's distraction, and the real objective is a separate, quieter payload elsewhere on the host. The decoy is a true thing put to a false use.

This is what separates the decoy from the wiper-in-ransom-clothing of Case 8, and the separation matters because they are opposite kinds of deception. The wiper lied about itself — one payload, declaring extortion while committing destruction, its self-representation false. Catching the wiper meant catching a payload in a lie about its own function. The decoy tells no such lie; the decoy miner's function is truthful. What is false is the analyst's inference that the decoy is the objective — an inference the operator engineered by making the decoy loud and the real payload quiet, so the analyst would find the loud one, conclude, and miss the quiet one. The wiper deceives by misrepresenting a function; the decoy deceives by arranging the evidence so that a truthful function is mistaken for the whole story.

So reading a decoy is a different act than reading a self-lying payload. It is not analyzing the payload harder to catch its misrepresentation — there is no misrepresentation in the payload to catch. It is stepping back from the payload to the operation, and asking whether this genuine payload is playing the role it appears to play. The question is not "is this miner really a miner" (it is) but "is this miner the objective, or the cover" — and that question cannot be answered by studying the miner, because the miner is the same miner either way. It can only be answered by studying the intrusion around it: whether the loud payload fits, or whether it is incongruous with everything else the operation shows.

2. The Payload-Layer False Flag

The decoy is the payload-layer false flag, and placing it against the attribution register's identity false flag illuminates both. That register documented operators who planted misleading identity signals — a rival's handle in a tool, a foreign language in the code — to make the analyst attribute the attack to the wrong hand. The mechanism was to supply a plausible, satisfying WHO that the analyst would accept and stop at, so the real author escaped attribution behind the planted one. The decoy does the identical thing one axis over: it supplies a plausible, satisfying WHAT — an obvious objective — that the analyst accepts and stops at, so the real objective escapes notice behind the planted one. One deception corrupts the reading of identity; the other corrupts the reading of intent; and structurally they are the same move.

This parallel is not decorative — it tells the register how to read the decoy, by importing the reflexive suspicion the attribution register learned. There, the lesson was that a too-clean identity link is itself suspicious: when an attribution falls into place too neatly, too conveniently, that very neatness is a reason to distrust it, because a planted signal is designed to fall into place neatly. The decoy imports the same lesson to intent: a too-clean objective may be a plant. When the intrusion's purpose is obvious, satisfying, and arrives without effort — a nice loud miner right where you would look — that convenience is precisely what a decoy is engineered to provide, and the analyst should be more suspicious of an easy objective, not less. The false flag taught the attribution register to distrust the gift-wrapped answer; the decoy teaches the payload register the same.

And the parallel carries a warning the attribution register also learned: the reflexive suspicion must be calibrated, not paranoid. Not every clean identity link was a false flag — most were just clean links — and the register there had to avoid crying "false flag!" at every neat attribution, which would have paralyzed it. The same holds here: not every loud objective is a decoy, and section 5 returns to the danger of over-diagnosis. The lesson from the false flag is to hold the possibility of a plant as a live hypothesis at appropriate confidence, and to let it drive further search — not to assume every satisfying answer is a trap, which would be its own kind of failure. The decoy demands suspicion, but suspicion held at the right strength.

3. Incongruity Is the Seam

If the decoy is recognized at all, it is recognized by incongruity — a mismatch between the conspicuous payload and the intrusion that surrounds it — and the incongruity takes a few characteristic forms. The first is a sophistication mismatch: the intrusion shows care and quietness everywhere — a subtle entry, minimal footprint, clean tradecraft — and then, incongruously, drops a blaring miner. A careful operator who then acts carelessly, in one loud stroke, is a contradiction, and the contradiction is a seam: the loud payload does not match the hand that got in. The second is an economics mismatch: the effort of the compromise is out of all proportion to the value of the found objective. An operator who burned a valuable exploit, or invested serious effort in access, to drop a commodity miner worth pennies has done something that does not add up — nobody spends a fortune to steal a nickel, so either the miner is not the real objective, or the reading is missing something.

The third form is the most direct: coexistence. The loud payload sits alongside faint traces of a quieter operation — an unexplained outbound connection, a subtle persistence mechanism, an access to credential stores — that have nothing to do with the loud payload and that the loud payload's noise would conveniently mask. When a conspicuous miner coexists with a whisper of a backdoor, the miner's whole function may be to be the thing you notice so you do not notice the whisper. The coexistence is the seam because it directly shows the two-payload structure a decoy operation requires: a loud one to find, a quiet one to miss.

Incongruity is the tell because it is forced by the decoy's own requirements. A decoy must be loud enough to be found — a decoy no one notices fails as a decoy — and satisfying enough to end the search — a decoy that does not produce closure fails too. But those requirements put the decoy at odds with a sophisticated intrusion's usual caution: the loudness that makes it a good decoy is the same loudness that makes it incongruous with a careful operation. The decoy cannot be both perfectly stealthy and effective as a decoy; its effectiveness depends on being conspicuous, and its conspicuousness is what betrays it against a quiet background. So the register looks for the loudness-that-does-not-fit, because that mismatch is the price the decoy pays for doing its job.

4. Why the Reading Is Only MEDIUM

The register is honest that recognizing a decoy is a MEDIUM judgment, not a HIGH one, and the honesty matters because the temptation is to over-claim a clever insight. It is genuinely hard to prove that a genuine payload was planted to mislead. The incongruity that suggests a decoy is suggestive, not conclusive, because the same incongruity is consistent with innocent explanations the register cannot rule out. A loud miner on a sophisticated intrusion might be a decoy — or it might be a sophisticated operator who, having gained access, also wanted some easy coin on the side (operators are not single-minded). It might be a second, unrelated intruder who found the same open host and dropped a commodity miner independently of the careful operator. It might simply be sloppiness — even good operators have lapses. Each of these produces the same incongruity as a decoy, and the register cannot see into the operator's mind to know which it is.

So the register cannot read "intent to deceive" directly; it can only note the mismatch and weigh it. And weighing it honestly yields MEDIUM: "this conspicuous payload may be a decoy, on the strength of this incongruity" — a real, calibrated possibility, offered as a possibility, never asserted as a certainty. The register will not upgrade a suspicion of deception into a confident diagnosis, because the evidence that raises the suspicion (the incongruity) is precisely the evidence that is also consistent with not-deception. To claim HIGH would be to assert access to the operator's deceptive intent that the register does not have — the same over-reach the register refuses everywhere.

This honest MEDIUM has an important consequence: it means the register's defense against decoys cannot rest on diagnosing them, because a MEDIUM diagnosis is too weak to be the whole defense. If the only protection against decoys were "correctly identify each decoy as a decoy," that protection would fail often, because identification is only MEDIUM-reliable. So the register needs a defense that works even when it cannot tell whether a given payload is a decoy — a defense that does not depend on winning the diagnosis. That defense is the operative rule, and it is the case's real answer to the decoy: a procedure that defeats decoys without needing to identify them.

5. The Rule That Defeats Decoys Without Diagnosing Them

The register's actual defense against decoys is not a diagnosis but a rule, and it is the rule the register planted in its very first case: never let a single conspicuous payload close the investigation. Whether or not any given loud payload is a decoy — a question the register can answer only at MEDIUM — the discipline that defeats decoys is to treat the loudest payload as the beginning of the search, not its end. Find the miner, and keep looking. Read the whole payload stack. Hunt for quieter companions after the obvious one is found. Ask, always, "what else came through this door" — because the door that admitted the loud payload admitted whatever else the operator brought.

The elegance of this rule is that it makes the decoy's mechanism fail, without requiring the register to spot the decoy at all. A decoy works by producing closure — by giving the analyst a satisfying objective that makes him stop. Its entire power is the analyst's willingness to stop at the first good answer. A defender who never stops at the first find cannot be misdirected by a payload planted to make him stop, because the misdirection depends on a stop that never comes. So the rule defeats every decoy, diagnosed or not, by denying the decoy the one thing it needs: an early close. The analyst does not have to correctly label the loud miner "decoy"; he only has to keep searching past it, and the search will find the quiet payload if there is one, and confirm there is none if there is not. The rule converts a hard diagnostic problem (is this a decoy?) into an easy procedural one (keep looking), and the procedural answer is far more reliable.

This is why the register prefers exhaustive over satisfying as a standing posture. The decoy exploits a psychological fact — that a clean, obvious objective feels like a complete answer, and the feeling of completeness is what ends searches. That feeling is the decoy's weapon, and the countermeasure is to distrust it: to treat easy closure as a reason for more suspicion, not less, and to complete the search regardless of how satisfying the first find is. The defender who insists on exhaustiveness over the comfort of a clean answer cannot be played by a decoy, because the decoy's leverage is exactly the comfort he refuses.

But the discipline cuts both ways, and the register is careful about the second edge. The danger is not only being misdirected by a decoy but over-diagnosing decoys — crying "decoy!" at every loud payload and inventing a hidden real objective that is not there. Most loud payloads are not decoys; they are just loud payloads from unsophisticated operators who wanted the easy thing, and a register that assumed a secret objective behind every obvious one would manufacture phantom intrusions, the mirror-image over-reading. The operative rule resolves both edges at once, which is its final virtue: it protects against misdirection without requiring an allegation of deception, because it does not diagnose — it simply searches further and reports what it actually finds. If a quiet payload is there, the search finds it and the register reports a real second objective. If none is there, the search comes up empty and the register reports the loud payload as the objective, decoy hypothesis unconfirmed. Either way the register reports only what it found, never a decoy it merely suspected nor a hidden objective it merely imagined. The vectors do not lie: a conspicuous payload is present and its function is genuine. Whether it is the objective or the cover is a MEDIUM question the register holds open — and answers not by guessing the operator's intent to deceive, but by looking harder, and saying what is there.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the operative rule — "never close on one payload, keep searching" — is unfalsifiable and unbounded. You can always claim that a quieter real payload might exist that you simply have not found yet, so under this rule the register can never declare an intrusion fully understood: every closed case is vulnerable to "but what if there's a decoy and a hidden payload you missed?" This, the objection says, is an infinite-search mandate that paralyzes response — a defender who can never conclude, never sign off, never say "we have found everything," because the rule always licenses one more search for a payload that, by hypothesis, is hidden. A discipline that cannot ever be satisfied is not a discipline; it is a recipe for a search that never ends and a decision that never comes.

The objection is serious because the risk is real: taken literally, "always keep searching" is unbounded, and an investigation that cannot terminate is useless — response requires closure at some point, and a rule that forbids closure forbids response. And the objection correctly identifies that the hidden-payload hypothesis is unfalsifiable in the strict sense: you can never prove the absence of a well-hidden payload, so "keep searching for the one you might have missed" can always be invoked, forever. If the register meant the rule as an absolute, the objection would be devastating — it would make every case eternally open.

The register answers that the rule is about proportionality, not infinity — search depth scales to the intrusion's sophistication and to observed incongruity — so it terminates, and terminates honestly, without ever claiming an impossible certainty of completeness. The rule is not "search forever"; it is "do not let a single conspicuous payload close the investigation prematurely," and "premature" is defined by proportion. A low-sophistication intrusion with a congruent loud payload — a sloppy compromise that dropped a matching commodity miner, no sophistication mismatch, no economics mismatch, no trace of a quieter operation — is reasonably closed at the found payload, because there is no incongruity to warrant deeper search and the intrusion's low caliber makes a hidden second operation unlikely. The rule does not demand further search there, because the found payload fits and the search that has occurred is proportionate to what the intrusion shows. Conversely, a high-sophistication intrusion, or a visible incongruity, warrants deeper search precisely because those are the conditions under which a decoy is plausible. So the depth of the search is calibrated to the evidence: shallow where the payload is congruent and the operator unsophisticated, deep where mismatch or sophistication raises the decoy's prior. This is bounded, and it terminates, because the calibration gives a stopping point — you have searched to the depth the intrusion's sophistication and incongruity warranted, and that is enough. And crucially, when the register closes, it closes honestly: it reports "search complete to the depth the evidence warranted," not the impossible "nothing else exists." The register never claims to have proven the absence of a hidden payload — it claims to have searched proportionately and found what it found, which is exactly the calibrated-not-absolute honesty it applies to every confidence everywhere. The objection is right that "nothing is hidden" is unprovable and that infinite search is paralytic; the register agrees, and therefore never asserts the first nor mandates the second. It asserts only "we searched as deeply as the evidence warranted and here is what we found," which is a terminating, falsifiable, proportionate claim — and the residual possibility of a payload hidden below the warranted search depth is acknowledged as exactly that: a residual, honestly stated, not a paralysis. Proportionate search that closes with an honest "to this depth" is not the unbounded mandate the objection fears; it is the same bounded, calibrated discipline the register uses for confidence itself.

7. Objective Signal — MISDIRECT (A Planted False Objective)

Case 12 read the register's adversarial payload. A decoy is a payload planted deliberately to be FOUND and MISREAD: the operator drops a conspicuous payload (a loud miner, an obvious webshell) so the defender finds it, reads it as the objective, feels a solved case, and STOPS — while a quieter payload does the real work unseen, protected by the closure the decoy produced. The decoy's function is GENUINE (a real miner really mines); its PURPOSE in the operation is MISDIRECTION — it is the intrusion's false objective. This is the payload-layer FALSE FLAG, the mirror of the attribution register's identity false flag: that corrupts WHO, this corrupts WHAT, both by supplying a plausible, satisfying signal the analyst latches onto and stops at — so a too-clean objective, like a too-clean identity link, may be a plant.

The decoy is DISTINCT from the wiper-in-ransom-clothing (Case 8): the wiper lied about ITS OWN objective (one self-misrepresenting payload); the decoy does not lie about itself (the miner really mines) — the lie is at the level of the OPERATION, a truthful payload MISUSED in a false ROLE as cover for a separate quieter one. The tell is INCONGRUITY: the loud payload too conspicuous for the sophistication shown elsewhere, its objective too cheap for the compromise's effort (the economics do not add up), or its coexistence with faint traces of a quieter operation its noise would mask — the mismatch is the seam, because a decoy must be loud enough to be found and satisfying enough to end the search, and that loudness is out of proportion to a careful intrusion. But recognizing a decoy is a MEDIUM judgment, not HIGH: it is hard to PROVE a genuine payload was planted to mislead, and the same incongruity is consistent with innocent explanations (a sophisticated operator who also wanted easy coin, a second unrelated intruder, sloppiness), so the register offers the decoy reading at MEDIUM and never upgrades a suspicion of deception into a certainty.

The linkage signal is MISDIRECT (a planted false objective). Because the decoy reading is only MEDIUM, the register's real defense is not a diagnosis but the OPERATIVE RULE it planted at the miner: NEVER let a single conspicuous payload CLOSE the investigation — treat the loudest payload as the BEGINNING of the search, read the whole stack, hunt quieter companions, ask 'what else came through this door.' This defeats the decoy's mechanism (producing closure) regardless of whether any payload is provably one: a defender who never stops at the first find cannot be misdirected by a payload planted to make him stop. So prefer EXHAUSTIVE over SATISFYING (the decoy's weapon is the feeling of a complete answer). The discipline cuts BOTH ways — do not be misdirected, but do not OVER-DIAGNOSE decoys either (most loud payloads are just loud payloads) — and the operative rule resolves both by protecting against misdirection WITHOUT alleging deception: it searches further and reports only what it actually finds. The steelmanned objection — that the rule is unfalsifiable and unbounded, an infinite-search mandate — is answered by the rule being about PROPORTIONALITY not infinity: search depth scales to sophistication and incongruity (a low-sophistication congruent intrusion is reasonably closed at the found payload; a high-sophistication or incongruous one warrants deeper search), so it terminates, closing with an honest "search complete to the depth the evidence warranted," never the impossible "nothing else exists" — the same calibrated-not-absolute honesty the register applies everywhere. No individual named — the loud payload a fact, the decoy hypothesis MEDIUM, any real objective reported only when found. Classification: TLP:WHITE. We hold the decoy possibility open, keep searching, prefer exhaustive over satisfying, report only what we find, and let people judge.

Follow the Payload — Case 12. Objective signal: MISDIRECT (a planted false objective). Confidence: MEDIUM for the decoy reading (a genuine, conspicuous payload — a real miner that really mines — planted to be FOUND and MISREAD as the objective so the analyst stops, while a quieter payload does the real work; recognized by INCONGRUITY — the loud payload too conspicuous for the intrusion's sophistication, its objective too cheap for the compromise's effort, or coexisting with faint traces of a quieter operation — but only MEDIUM because it is hard to PROVE a genuine payload was planted to mislead, and the same incongruity fits innocent explanations: a sophisticated operator also wanting easy coin, a second intruder, sloppiness). The payload-layer FALSE FLAG (mirror of the identity false flag: corrupts WHAT not WHO; a too-clean objective may be a plant). DISTINCT from the wiper-in-disguise (Case 8): the wiper lied about ITS OWN objective (self-misrepresenting), the decoy is a TRUTHFUL payload in a false ROLE (the lie is the operation's, not the payload's). The real defense is the OPERATIVE RULE (planted at the miner): NEVER let a single conspicuous payload CLOSE the investigation — treat the loudest payload as the START of the search, read the whole stack, ask 'what else came through this door' — which defeats the decoy's closure mechanism regardless of diagnosis. Prefer EXHAUSTIVE over SATISFYING; the discipline cuts both ways (do not be misdirected, but do not OVER-DIAGNOSE decoys — most loud payloads are just loud payloads), resolved by searching further and reporting only what is found. Steelmanned objection (the rule is unfalsifiable/unbounded — infinite search) answered by PROPORTIONALITY: search depth scales to sophistication and incongruity, terminating with an honest 'search complete to the depth the evidence warranted' not 'nothing else exists.' No individual named. Classification: TLP:WHITE. Include everything — a conspicuous genuine payload is present; whether it is the objective or the cover is a MEDIUM question answered by searching harder, not by guessing intent to deceive.