Follow the Payload · 16 — The Self-Propagator: The Payload Whose Objective Is To Spread

Follow the Payload — Case 16. This register takes what an intruder leaves behind and reads it for the one thing it cannot hide: its purpose. Closing each case on the objective the payload serves: STEAL COMPUTE · STEAL BANDWIDTH · RECRUIT · STEAL DATA · EXTORT · PERSIST.

Most of the payloads in this register do their work on the host where they land and stop there — the miner mines the host it is on, the stealer robs the host it is on, the ransomware encrypts the host it is on. This case takes the payload whose defining behaviour is the opposite: it does not stay put. A self-propagating payload — a worm — is built to copy itself to new hosts, and it carries the machinery to do so in its own body: it harvests SSH keys and known-hosts files to reach the machine's peers, it fires exploit modules at neighbours, it loops through reused credentials, it writes itself to removable media. Its most conspicuous objective, the one written plainly in its code, is to reach more hosts. The verb that names it is PROPAGATE, and this case is about how to read a payload whose purpose, on its face, is simply to spread.

The reading has a trap in it, and the trap is the whole reason the case exists. Propagation is loud — it generates traffic, trips intrusion detection, fills logs with connection attempts — so it dominates the analyst's attention and tempts the easy close: "it's a worm, objective: spread." That close is wrong, not because the spread is not real, but because spreading is a means, not an end. A worm spreads in order to do something on the hosts it reaches; the spread is the announcement, the terminal payload it carries (or defers, or lacks) is the answer. PROPAGATE is a meta-objective — capability-expansion, the same class as RECRUIT and PERSIST and DELIVER — and reading it as the terminal purpose mistakes how the payload travels for what the payload is for. This case works out the propagation-verb-versus-terminal-objective split, why PROPAGATE compounds where RECRUIT adds, and how the shape of the spread carries intent about what the reach is for.

1. Propagation Is Written in the Code

Start with what makes the propagation reading firm. A self-propagating payload does not spread by accident or as a side effect — it carries its spread mechanism in its own body, as explicit, purpose-built machinery. Read the payload and you find the machinery plainly: routines that harvest SSH private keys and parse known-hosts files to enumerate the machine's trusted peers; exploit modules (EternalBlue-class SMB attacks and their descendants) that fire at neighbours to gain code execution; credential-reuse loops that take a password found here and try it everywhere; scanners that sweep address ranges for the next target; writers that copy the payload onto USB drives with autorun hooks. Every one of these has a single function: to place a copy of the payload on an additional host.

Because this machinery is visible and unambiguous, the propagation verb is a HIGH-confidence reading. There is no inference required, no behaviour that could plausibly be innocent — the code that copies the code is right there, and its only conceivable purpose is to spread. This is the strongest kind of objective-reading the register does: not a guess from context, not a probabilistic argument, but the direct observation of purpose-built spread machinery. Whatever else is uncertain about a worm, that it propagates is not. The register can state PROPAGATE with the same confidence it states EXECUTED for a payload it watched run, because it is reading the same kind of evidence — capability that is present and functional in the artifact itself.

So the propagation reading is the anchor of a worm case: firm, high-confidence, directly evidenced. And that firmness is exactly what makes the trap dangerous, because a firm, loud, obvious reading feels complete. It feels like the answer. The discipline of this case is to hold that PROPAGATE, however firmly read, is only the reach-layer objective — a true and important statement about how the payload behaves, and not a statement about what the payload is ultimately for. The anchor is real; it just is not the whole ship.

2. Propagation Is a Means, Not an End

Here is why the firm reading is not the terminal one: a worm spreads in order to do something. Propagation is capability-expansion — it enlarges the set of hosts the operator can act on — and capability-expansion is, by its nature, instrumental. Nobody spreads for the pure sake of spreading; the reach is acquired so that it can be used. The worm copies itself to a thousand hosts so that it can mine on a thousand hosts, or botnet a thousand hosts, or ransom a thousand hosts, or exfiltrate from a thousand hosts, or simply be present on a thousand hosts against a future need. The spread is the delivery of a capability; the terminal payload is the exercise of it.

This places PROPAGATE precisely in the register's taxonomy of meta-objectives — the objective classes that expand what the operator can do without, by themselves, being the ultimate purpose. RECRUIT enlists a host under command; PERSIST secures continued access; DELIVER drops a further payload; and PROPAGATE reaches more hosts. All four share a structure: they answer "what capability did this payload acquire?" and defer the question "what is that capability for?" to a later, separate reading. A payload can be read at the meta-layer with full confidence — yes, it recruits; yes, it persists; yes, it propagates — while the terminal objective it serves remains open. The meta-reading is complete and the terminal reading is pending, and the two are genuinely different questions.

Reading the meta-objective as the terminal objective is the specific error the case guards against. "Objective: spread" treats the reach as the purpose, and it is exactly as wrong as reading a delivery truck's objective as "driving around" — the driving is real, conspicuous, and continuous, and it is entirely in service of the deliveries that are the actual point. The worm's spread is its driving; the terminal payload is its cargo. A register that closes on "it spreads" has described the truck's motion and never opened the back. The propagation is true; it is just not the answer to "what is this for," and the case's first discipline is to keep asking that question after the firm PROPAGATE reading, not to let the firm reading stand in for it.

3. The Terminal Objective: Named, Deferred, or Absent

So the register reads a worm in two layers, and the second layer — the terminal objective — comes in three honest states, exactly paralleling the deferred/absent/never-run trichotomy the register worked out for carried payloads. First, the terminal objective may be named: the worm carries a rider payload that identifies the end. A worm bundling a coin-miner propagates in order to STEAL COMPUTE at scale; one bundling a botnet client propagates in order to RECRUIT (with its own deferred command-objective beyond); one bundling ransomware propagates in order to EXTORT across an estate. When the rider is present and readable, the terminal objective reads at the rider's own confidence — HIGH for a recognizable miner, and so on — and the full reading is "PROPAGATE (HIGH) in service of STEAL COMPUTE (HIGH)."

Second, the terminal objective may be deferred: the worm spreads and carries no terminal payload yet, only the spread machinery and perhaps a beacon awaiting a later drop. This is the pure-spread worm, and its reading is PROPAGATE (executed, HIGH) with a deferred terminal objective — the same honest unknown as the recruited bot idling for orders. The reach is real and complete; the purpose the reach serves has not yet arrived. The register does not guess it. It records that capability has been expanded and the terminal act withheld, and it says so plainly: this payload has spread, and what it spread for is not yet on the host to be read.

Third — rarely, and worth naming for completeness — the propagation machinery may be present but constrained to inertness: a spread module that is disabled, misconfigured, or gated behind a condition that never fires. Here PROPAGATE is a capability the payload holds but has not executed, and the register marks it staged-not-executed, exactly as it would a dormant miner. The distinction between a worm that is spreading, one that has spread and awaits a terminal drop, and one that could spread but has not is the difference between three quite different situations, and the register keeps them apart rather than flattening all three into "worm." The layered reading — firm PROPAGATE verb, terminal objective in one of three honest states — is the whole method, and it is what stops the loud, firm spread from closing a case whose actual purpose lives one layer deeper.

4. PROPAGATE Compounds Where RECRUIT Adds

PROPAGATE sits closest to RECRUIT in the taxonomy — both expand the operator's reach — and distinguishing them sharpens what each reading actually claims. The difference is mechanism, and it is consequential. RECRUIT enlists: it brings a host under the operator's command, making it a controlled node that obeys instructions from a C2. The reach RECRUIT builds is linear — each enlisted host adds one node to the operator's fleet, and the operator's reach grows by exactly the number of hosts he personally enlists. PROPAGATE reproduces: it makes copies of the payload, and each copy is itself a spreader. The reach PROPAGATE builds compounds — each new host becomes a new source of further spread, so reach grows geometrically, driven by the hosts themselves rather than by the operator's own effort.

This distinction is not academic; it changes what the reading tells you about the threat's trajectory. A RECRUIT reading says "the operator is enlisting hosts, one intrusion at a time, and his fleet grows as fast as he works." A PROPAGATE reading says "the payload is reproducing, and its spread grows as fast as the network allows, with or without further effort from the operator" — a fundamentally faster and less-controllable dynamic, the reason worms have historically produced the largest and most sudden infection events. Reading PROPAGATE rather than RECRUIT is reading a self-driving expansion rather than an operator-driven one, and the defensive implication differs accordingly: you cannot slow a worm by arresting the operator, because the spread no longer depends on him.

The two are not exclusive, and the most capable payloads do both. A worm that propagates to arrive and enlists each host it reaches under a C2 is running PROPAGATE and RECRUIT together — reproduce to spread, enlist to command — combining the compounding reach of the worm with the controllability of the botnet. The register reads such a payload at both meta-objectives, because both mechanisms are present and both are true: it spreads by copying and it commands by enlisting. Keeping PROPAGATE and RECRUIT distinct lets the register say precisely which expansion mechanism is in play — reproduction, command, or both — rather than blurring all reach-expansion into one word. The reach is expanded either way; how it is expanded is the reading, and reproduction versus command is a real and consequential difference.

5. The Shape of the Spread Carries Intent

The presence of propagation is the firm HIGH reading; the shape of it is a second, softer reading that carries intent about what the reach is for. A worm can spread indiscriminately or selectively, and the two shapes read differently. Indiscriminate, maximal-rate spread — scan the whole internet, brute every host, fire every exploit at everything reachable — reads as opportunistic: reach for its own sake, the widest possible net, the commodity-worm signature that treats every host as an equally good target. This is propagation as pure volume, and it usually pairs with a commodity terminal payload (a miner, a generic bot) whose value scales with sheer host count.

Constrained spread reads as targeted: propagation bounded by something — only within a particular subnet, only to hosts matching a fingerprint (a specific OS, a specific installed application, a specific role), only laterally within a single victim's estate rather than out to the open internet. Constrained spread says the reach is in service of a specific intrusion: the worm is not trying to reach many hosts but the right hosts, and the boundary of its spread traces the boundary of the operator's actual target. A worm that spreads only inside one organization's network and stops at its edge is doing lateral movement, not internet-scale infection, and the objective the reach serves is a targeted one — reach that particular estate's crown jewels, not reach in general.

So the propagation pattern, not just its presence, is a targeting signal, and the register reads it as one. The shape of the spread narrows the terminal-objective question even when the terminal payload is deferred or absent: indiscriminate spread points toward a commodity, scale-driven end; constrained, fingerprint-matched, lateral spread points toward a targeted, specific end. This is the same discipline the whole register runs — read the payload's how for evidence of its for — applied to the reach layer. The verb PROPAGATE is firm and universal; the manner of propagation is where the worm, even before it drops its terminal payload, starts to tell you what all that reach is being gathered to do.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it over-thinks a solved reading. When a payload is a worm, the objection runs, the objective plainly is to spread — that is what a worm is, that is the word's definition, and the whole edifice of "PROPAGATE is only a meta-objective, hold the terminal reading open" is analytic throat-clearing that refuses to accept an obvious answer. The spread is HIGH-confidence, directly evidenced, conspicuous; the terminal payload is frequently deferred, absent, or unknowable. So the register spends its confidence on the loud, certain thing and then declines to conclude, retreating into "the real objective is pending" — and a reading that answers "what is this for?" with "it spreads, but that's not really the objective, and the real one is unknown" has managed to look at the clearest payload in the register and produce less certainty than it started with. Sometimes, the objection concludes, a worm is just a worm, and its objective is to spread.

The objection has real force wherever the worm is pure-spread with no recoverable terminal signal, because there the register genuinely does end at "PROPAGATE, terminal deferred/unknown," and that can look like sophistication producing a shrug. And it correctly identifies that PROPAGATE is the firmest reading in the case — the register should not pretend the spread is uncertain or unimportant. If the case downgraded the propagation reading, or treated the spread as a mere distraction rather than a real and high-confidence objective in its own right, the objection would be right that it had over-thought its way past the obvious.

The register answers that it does not downgrade the spread — it reads PROPAGATE at HIGH, states it plainly, and treats it as a real objective — and that the two-layer reading adds certainty rather than subtracting it, because it refuses to let a firm answer to one question masquerade as the answer to a different question. "What does this payload do at the reach layer?" and "what is this payload ultimately for?" are different questions, and the register answers the first with full confidence (it propagates) precisely so that it can keep the second honestly open (the terminal purpose is named, deferred, or absent). That is not less certainty; it is correctly-placed certainty — HIGH where the evidence is HIGH (the visible spread machinery), open where the evidence is open (the withheld terminal payload) — and collapsing the two into "objective: spread" does not produce more knowledge, it produces a category error that a defender then acts on. Consider the operational stakes: a defender who reads "objective: spread" treats the incident as a propagation nuisance to be contained at the network layer, and stops looking — and if the worm was in fact spreading in order to stage ransomware, or to enlist an estate under a C2, or to pre-position for a targeted exfiltration, the defender has closed the case on the means and missed the end that was the actual harm. The register's insistence that PROPAGATE is a meta-objective is exactly what keeps the investigation open past the spread to the terminal purpose that motivated it — which, when it is recoverable, is the thing that mattered most. And where the terminal purpose is genuinely not recoverable, "PROPAGATE, terminal deferred" is not a shrug but the accurate state of the evidence: capability expanded, purpose withheld, keep watching for the drop. The honest unknown is more useful than a false certainty that would have stopped the hunt. Sometimes a worm's terminal objective really is unknown — but "it spreads, and we are still reading what the spread is for" is a more truthful and more actionable statement than "its objective is to spread," which quietly closes a case that the deferred terminal payload may reopen at any moment. Reading the means as the end is not accepting an obvious answer; it is stopping one question short.

7. Objective Signal — PROPAGATE (Meta)

Case 16 read the worm — the self-propagating payload whose defining behaviour is to COPY ITSELF to new hosts. Its reach-layer objective is PROPAGATE, and this is the FIRMEST reading in the register: the spread machinery (SSH-key/known-hosts harvesting, SMB/exploit modules, credential-reuse loops, USB writers) is VISIBLE in the payload's own body, purpose-built, unambiguous — the code that copies the code is right there, so PROPAGATE reads at HIGH by direct observation, not inference. But PROPAGATE is a META-objective (capability-expansion, the same class as RECRUIT/PERSIST/DELIVER), NOT the terminal purpose: a worm spreads IN ORDER TO do something on the hosts it reaches, so the spread is a means and the terminal payload is the end. Reading 'objective: spread' mistakes how the payload travels for what it is for — the truck's driving for its cargo.

The register therefore reads a worm in TWO layers: the propagation VERB (HIGH — in the code) and the TERMINAL objective, which comes in three honest states — NAMED (a rider payload identifies the end: bundled miner => STEAL COMPUTE, bundled bot => RECRUIT/deferred, ransomware => EXTORT; reads at the rider's confidence), DEFERRED (pure-spread worm carrying no terminal payload yet — PROPAGATE executed HIGH, terminal objective the same honest unknown as an idling recruited bot), or STAGED-not-executed (spread module present but disabled/gated). PROPAGATE differs from RECRUIT in mechanism: RECRUIT enlists a host under command (LINEAR reach — the operator's fleet grows as fast as he works); PROPAGATE makes copies that themselves spread (COMPOUNDING reach — self-driving, grows as fast as the network allows, uncontainable by arresting the operator). A payload that both reproduces AND enlists runs PROPAGATE + RECRUIT together. And the SHAPE of the spread carries intent: indiscriminate maximal spread reads opportunistic (reach for its own sake, commodity terminal), constrained spread (subnet-bounded, fingerprint-matched, lateral-within-one-estate) reads targeted (reach in service of a specific intrusion — the boundary of the spread traces the boundary of the target).

The objective signal is PROPAGATE — a meta-objective. Confidence: propagation-mechanism HIGH (visible), terminal-objective at whatever the carried payload shows (HIGH if a rider names it, DEFERRED/UNKNOWN if pure-spread). The steelmanned objection — that this over-thinks a solved reading (a worm's objective plainly IS to spread; the two-layer method produces LESS certainty than it started with) — is answered by the register NOT downgrading the spread (PROPAGATE is read at HIGH, a real objective) but refusing to let a firm answer to 'what does it do at the reach layer?' masquerade as the answer to 'what is it ultimately for?' — two different questions, answered with correctly-placed certainty (HIGH where the evidence is HIGH, open where the evidence is open). Operationally decisive: a defender who reads 'objective: spread' contains the propagation and STOPS LOOKING, missing a terminal purpose (staged ransomware, C2 enlistment, targeted exfiltration) that was the actual harm; the meta-objective framing keeps the investigation open past the spread to the end that motivated it. Where the terminal purpose is genuinely unrecoverable, 'PROPAGATE, terminal deferred' is the accurate state of the evidence, not a shrug. As always the reading is a fact about the payload's function, not an attribution of the deployer. Classification: TLP:WHITE. We read the spread at HIGH, hold the terminal objective open at whatever the carried payload shows, and let people judge.

Follow the Payload — Case 16. Objective signal: PROPAGATE (meta — capability-expansion, not the terminal purpose). A self-propagating payload (worm) copies itself to new hosts via SSH-key/known-hosts harvesting, SMB/exploit modules, credential-reuse loops, USB writers — machinery VISIBLE in its own body, so the propagation VERB reads at HIGH by direct observation. But PROPAGATE is a META-objective (like RECRUIT/PERSIST/DELIVER): the worm spreads IN ORDER TO do something, so the spread is a means and the terminal payload the end; reading 'objective: spread' mistakes how it travels for what it is for. TWO-LAYER reading: propagation verb (HIGH) + terminal objective in three honest states — NAMED (rider payload identifies the end, at its own confidence), DEFERRED (pure-spread, terminal withheld — honest unknown), STAGED-not-executed (spread module present but gated). PROPAGATE COMPOUNDS (copies that self-spread — self-driving, uncontainable by arresting the operator) where RECRUIT ADDS (linear, operator-driven enlistment); a payload can do both. The SHAPE of the spread carries intent: indiscriminate = opportunistic/commodity; constrained (subnet/fingerprint/lateral) = targeted (the spread's boundary traces the target's). Steelmanned objection (a worm's objective plainly IS to spread — the two-layer method produces less certainty) answered by NOT downgrading the spread (PROPAGATE read at HIGH, a real objective) but refusing to let a firm answer to one question stand for a different one; certainty correctly placed (HIGH on the visible mechanism, open on the withheld terminal). Operationally: 'objective: spread' makes a defender contain and STOP LOOKING, missing the terminal purpose that was the real harm. Reading is a fact about the payload's function, not the deployer. No individual named. Classification: TLP:WHITE. Include everything — the spread is HIGH and real; what the reach is FOR is read one layer deeper.