Follow the Payload · 21 — The Misattributed Objective: How the Register Reads an Objective Wrong

Follow the Payload — Case 21. This register takes what an intruder leaves behind and reads it for the one thing it cannot hide: its purpose. Closing each case on the objective the payload serves: STEAL COMPUTE · STEAL BANDWIDTH · RECRUIT · STEAL DATA · EXTORT · PERSIST.

Every case so far has read an objective and trusted the reading. This case turns the method on itself and asks the uncomfortable question: how does the register read an objective wrong? Because it does — objectives are misread, sometimes because an adversary engineered the misreading and sometimes because the analyst engineered it himself, and a method that never catalogued its own failure modes would be a method that could not defend against them. So this is the reflexive case, the one where the register audits its own reliability: it lays out the ways an objective-reading goes wrong, sorts them by cause, and states the guardrails that each failure mode demands. It is the least glamorous case in the register and, for exactly that reason, one of the most important, because the value of every other case rests on the register's ability to survive the misreads this one names.

The misattributions sort into two families by their cause, and the distinction organizes everything. The first is adversarial: the operator wants you to misread — he plants a decoy or a false flag, engineering the evidence so the objective you recover is not the one he pursues. The second is methodological: the analyst misreads himself — he reads a benign tool as malicious, or reads the objective off the wrong phase of an intrusion, or off the wrong payload among several. Both produce a wrong objective, but they demand different defenses, because one is an adversary's deception to be seen through and the other is the analyst's own carelessness to be disciplined out. This case works through both families — the decoy and the false flag on the adversarial side, the benign misread and the wrong-element misread on the methodological side — and shows that the guardrails against them are not new inventions but the register's founding disciplines, which exist precisely because misattribution is what an adversary aims for and what a careless analyst commits.

1. Two Families of Misattribution

Begin with the organizing distinction, because it determines what kind of defense each misread requires. An objective is misread for one of two fundamentally different reasons. In adversarial misattribution, the operator has deliberately engineered the evidence to produce a false reading: he planted something loud to hide something quiet, or forged the signatures of another actor, so that a competent analyst reading the evidence carefully still arrives at the wrong objective because the evidence itself was staged. The misread is not the analyst's fault in the ordinary sense — he read what was put in front of him — it is the adversary's achievement, and defending against it means recognizing that the evidence may be hostile, planted to deceive.

In methodological misattribution, there is no adversarial staging; the analyst simply reads wrong. He takes a dual-use tool for a malicious one because it could be malicious; he reads the objective off a snapshot that caught the wrong moment of a changing intrusion; he closes on the conspicuous commodity payload and misses the quiet bespoke one beside it. The evidence was not staged to deceive — it was read carelessly, or partially, or with an assumption the evidence did not support. This misread is the analyst's fault, in the sense that better discipline would have avoided it, and defending against it means holding to the reading rules the register has built across every prior case.

The reason the distinction matters is that the two families feel the same from inside the error — in both, the analyst confidently reports objective X when the truth is objective Y — but they are caught by different means. The adversarial misread is caught by suspicion of the evidence: asking whether this conspicuous thing was planted to be found, whether this family signature was forged to mislead. The methodological misread is caught by discipline over the reading: asking whether the objective was actually executed or merely possible, whether the phase read is the whole intrusion, whether the payload read is the only one present. A register that conflated the two would defend against neither well. So the case sorts the failure modes by family and treats each on its own terms.

2. The Adversarial Misreads: Decoy and False Flag

The first adversarial mode is the decoy: the operator runs a loud, obvious objective to draw attention away from the quiet real one. This is the DDoS-as-cover of the earlier register generalized into a principle — the flood that saturates the defenders' attention while a separate intrusion proceeds — but it takes many forms. A conspicuous coin-miner, deliberately noisy, masks a quiet data exfiltration running beside it. Ransomware is fired precisely to bury the evidence of an espionage operation, the encryption destroying the forensic trail of what was really taken. A noisy vulnerability scan draws the incident-response team to one corner of the network while the real objective advances in another. In every case the conspicuousness is the weapon: the operator makes one objective loud so that the analyst will read it as the objective and stop looking. The decoy weaponizes the analyst's own instinct to close on a clear finding.

The guardrail against the decoy is a rule the register has stated since its earliest cases: never let one conspicuous payload close the investigation. What this case adds is the recognition that the conspicuous payload may have been planted to close it — that its very loudness is a reason for suspicion, not reassurance. An objective that presents itself too readily, that is too easy to find, that saturates attention while contributing little of value to the operator, should raise the question what is this drawing me away from? The decoy is defeated by refusing to be satisfied by the first, loudest answer, and by treating conspicuousness as a prompt to keep looking rather than a signal to stop.

The second adversarial mode is the false flag: the operator mimics a known family's signatures to misattribute the objective. He plants another actor's ransom-note, reuses a catalogued family's TTPs, borrows its code or its infrastructure conventions, so that the payload looks like a known financially-motivated ransomware operation when its real objective is destruction or espionage — or, in the reverse, dresses a state operation in commodity-crime clothing to hide the state hand behind it. The false flag misattributes the author (the mimicked family gets blamed) and, at the objective layer, misdirects the objective-appearance (the payload looks like EXTORT). The guardrail is the register's most fundamental: read function from behaviour, not the objective from the label. A wiper that displays a ransom note still wipes — it does not decrypt for payment, because it has no decryption capability, because destruction was always the function — and the behaviour betrays the mimicry the appearance was built to sell. The false flag can forge the label; it cannot easily forge the function, and the register reads the function.

3. The Methodological Misreads: Benign, Wrong-Phase, Wrong-Payload

The methodological family begins with the benign misread: reading a legitimate tool as a malicious objective because the tool is capable of one. PsExec, PowerShell, a remote-access product, a backup utility, a network scanner — these are dual-use, run every day by administrators for legitimate work and by attackers for illegitimate ends, and the error is to read the malicious objective from the capability rather than from the use. This is the exact mirror of a discipline the register has held throughout: just as it refuses to call benign activity malicious without function-evidence — refuses to read an attack from a scan that might be legitimate — it must refuse to read a malicious objective from a tool that is merely able to serve one. The guardrail is the register's executed-or-present-in-code standard: the objective is what the payload actually did, or is present-in-code to do — not what a dual-use tool could do in other hands. A backup utility that backed up files pursued no malicious objective, however easily it could have exfiltrated them; the objective is read from the act, not the potential.

The second methodological misread is the wrong-phase error: reading the objective off a snapshot that caught the wrong window of a changing intrusion. This is the Case 19 error — mistaking the early staging objective (PERSIST) for the terminal one, or reading a late phase as though it were the whole. Because the objective is a timeline, sampling one moment and reporting it as the objective misreads the intrusion whenever the sampled moment is not representative — and the staging phase, being early and quiet, is disproportionately likely to be the one caught, disproportionately likely to be misread as the purpose. The guardrail is the timeline discipline: read the objective as a sequence, do not close on the first entry, and mark the phase you are reading as a phase.

The third is the wrong-payload error: reading the objective off a conspicuous commodity payload that coexists with a quiet bespoke one. This is the composition-versus-coexistence problem the register has met before — several payloads present, and the analyst reads the objective of the loud, easily-recognized commodity one (a public miner, a generic RAT) while the real objective runs in the quiet bespoke payload beside it. It resembles the decoy, but it is methodological, not adversarial: the operator did not necessarily plant the commodity payload to mislead — it may simply be there, coexisting — and the analyst misreads by attending to the conspicuous element rather than surveying all the elements present. The guardrail is the survey discipline: read every payload present, distinguish composition (payloads serving one objective together) from coexistence (payloads serving separate objectives), and do not let the recognizable one stand for the set. In all three methodological misreads the analyst reads a true objective — of a dual-use tool, of the wrong phase, of the wrong payload — and errs by reporting it as the objective of the intrusion.

4. The Master Guardrail: Function Over Appearance

Step back from the four modes and a single guardrail is visible beneath all of them: read function, not appearance. This is the register's founding discipline, stated at the outset and vindicated here as the defense against every misattribution the case catalogues. The objective is what the payload does — mines, wipes, exfiltrates, encrypts, floods — read from its behaviour or from the capability present in its code, and never from its name, its label, its ransom-note text, its family signature, or its resemblance to something previously catalogued. Appearance is the layer that lies; function is the layer that does not.

Trace each misread back to appearance and the pattern is exact. The decoy manipulates appearance — it makes one objective appear to be the objective by making it loud. The false flag forges appearance — it makes the payload appear to belong to another family by borrowing its signatures. The benign misread over-reads appearance — it takes a tool that appears capable of harm and reads harm as its objective. The wrong-phase and wrong-payload misreads read appearance in a different sense — the apparent objective of the visible moment or the visible payload, mistaken for the real one. Every misattribution in the case is, at root, a reading of appearance where the register should have read function, and the master guardrail defeats every one of them by insisting the objective be recovered from what the payload does, not from what it looks like.

This is why function-reading is not merely a guardrail but the guardrail. Appearance is exactly what an adversary can stage — he can make things loud, forge signatures, dress one thing as another — and exactly what a careless analyst can assume — reading capability as use, a phase as the whole, the recognizable as the total. Function is the layer the operator cannot fully fake (a wiper cannot be made to actually decrypt-for-pay; a miner cannot be made to actually exfiltrate; the behaviour is constrained by what the code truly does) and the layer the analyst cannot lazily assume (he has to observe the act or read the code, not infer from the label). By anchoring every objective-reading in function, the register places itself on the one layer that resists both the adversary's staging and the analyst's assumption — which is precisely why "read function, not appearance" has been the register's first rule from the beginning, and why this reflexive case ends by re-affirming it as the answer to how objectives get read wrong.

5. Objective-Attribution Is Separate From Author-Attribution — and the Honest Close

One more distinction completes the defense, and it is the one that lets the function-read survive even a well-built false flag: objective-attribution and author-attribution are separate readings, and the register keeps them separate. A false flag misattributes the author — the mimicked family gets blamed, the real hand hidden behind borrowed signatures. If the register fused "who did this" with "what is this for," a forged author would automatically corrupt the objective read: blame the ransomware gang, inherit the assumption of a financial objective, and the wiper's destructive purpose vanishes behind the forgery. But the register does not fuse them. It reads the author from one set of evidence (signatures, infrastructure, TTPs — the forgeable layer) and the objective from another (function, behaviour, present-in-code capability — the resistant layer), and holds the two as independent findings.

So the wiper wearing a known gang's ransom note produces two separate readings that do not contaminate each other. The author-attribution is misdirected — the note points at a gang that did not do this, and the register, reading carefully, marks the author LOW or forged rather than inheriting the note's claim. The objective-attribution is not misdirected, because it is read from function: the payload wipes, it has no decryption capability, it does not offer recovery for payment — so the function reads destruction, not EXTORT, regardless of what the note says. Keeping the two attributions separate is exactly what lets the true objective survive the forged author: the false flag fooled the author-read (as designed) and failed against the objective-read (because function does not lie), and the register reports both truthfully — author unknown/forged, objective destruction — rather than letting the forgery on one axis collapse the other.

This is the meta-point on which the whole register rests, and the honest close of the case. The register's entire apparatus — confidence-grading, the honest-unknowns, function-over-label reading, executed-versus-staged, conspicuous-versus-terminal, intent-versus-author — is not an accumulation of incidental habits. It is built to survive misattribution, each guardrail answering a specific misread: the honest-unknowns against the decoy's premature close, function-over-label against the false flag, executed-versus-staged against the benign misread, the timeline discipline against the wrong-phase, the survey discipline against the wrong-payload, intent-versus-author against the forged family. The register is not incidentally robust to being fooled; it is engineered to be, because misattribution is the thing an adversary works to achieve and the thing a careless analyst falls into, and a threat-intelligence method that could not survive both would be worthless the first time either occurred. The vectors do not lie — but appearance does, and adversaries stage it and analysts assume it. We read function, hold the attributions separate, refuse the easy close, and let people judge — knowing that the discipline of how we read is the only thing standing between a true objective and a misattributed one.

6. The counter-narrative, steelmanned

The strongest objection to this case is that its guardrails are unfalsifiable in the wrong direction — that "read function, not appearance" and "never let one conspicuous payload close the investigation" license the analyst to override any evidence he dislikes by crying decoy or false flag. If a payload looks like ransomware, the objection runs, the register can now always say "ah, but that may be a false flag hiding a wiper" and read whatever objective it prefers, treating the actual evidence (the ransom note, the family signature, the encryption) as presumptively deceptive. That is not discipline, the objection says; it is a licence for the analyst to disbelieve the evidence in front of him whenever it is convenient, substituting his own theory of the "real" hidden objective for the plain reading. And the methodological guardrails cut the same way: any confident objective-read can be dismissed as "wrong-phase" or "wrong-payload" by an analyst who wants a different answer. A case that catalogues how readings go wrong, the objection concludes, has handed the analyst a toolkit for rationalizing away any reading he doesn't like — which is more dangerous than the misreads it claims to prevent.

The objection identifies a real hazard and the register should name it as a genuine failure mode: the guardrails can be abused as licence, and an analyst who invokes "decoy!" or "false flag!" to override clear function-evidence with a preferred theory has inverted the discipline, not applied it. If the case were read as "distrust the obvious objective and substitute a hidden one," it would indeed license exactly the rationalization the objection fears. That abuse is real, and the register must rule it out explicitly rather than pretend the guardrails are self-limiting.

The register answers that the guardrails, correctly stated, do the opposite of licensing substitution — they are evidentiary, not skeptical, and every one of them demands more function-evidence rather than permitting less. "Read function, not appearance" does not say disbelieve the ransom note; it says read what the payload actually does, and if the payload encrypts and offers decryption for payment, the function reads EXTORT and the register reports EXTORT — the note is corroborated by function, not overridden. The false-flag reading is only available when the function contradicts the appearance — when the payload wears a ransom note and has no decryption capability, actually wiping — and that contradiction is itself function-evidence, observed, not assumed. The analyst may not cry "false flag" against a payload whose function matches its appearance; the guardrail gives him nothing to say there, because there is no contradiction to read. Likewise "never let one conspicuous payload close the investigation" does not say disbelieve the conspicuous objective — the miner that mines is really mining, and the register reports it — it says keep surveying for other payloads, and a second, quiet objective may be reported only if it is found and read from its own function, never merely posited. And the methodological guardrails are symmetric: "wrong-phase" is a valid caution only when there is evidence of other phases (a timeline, prior activity), not a free dismissal of a clean single-phase read; "wrong-payload" applies only when another payload is actually present, not as a blanket doubt. Every guardrail, properly stated, raises the evidentiary bar — it demands the analyst read function, survey exhaustively, find the second payload, establish the other phases — and none of them ever permits substituting a theory for a reading. The register's rule against the abuse is therefore built into the guardrails themselves: a hidden objective must be found and read from function like any other; it may never be inferred from the mere possibility of concealment. The analyst who says "the real objective is a wiper" must show the wiping; the analyst who says "there is a quiet exfiltration behind the miner" must find the exfiltration. So the case does not hand the analyst a licence to disbelieve evidence — it hands him an obligation to read more of it, and the misattributions it catalogues are defeated not by distrust but by more complete function-reading, which is the register's discipline intensified, not suspended.

7. Objective Signal — NONE (Methodology; the Failure Modes of Objective-Reading)

Case 21 turned the register on itself and catalogued how it reads an objective WRONG — the reflexive methodology case. Misattributions sort into two families by cause. ADVERSARIAL (the operator WANTS you to misread — the evidence is staged): the DECOY (a loud objective run to draw attention from the quiet real one — DDoS-as-cover generalized: a conspicuous miner masking exfiltration, ransomware fired to bury espionage, a noisy scan drawing IR while the real objective advances) and the FALSE FLAG (mimicking a known family's signatures/note/TTPs so the payload LOOKS financially-motivated when its real objective is destruction or espionage, or a state operation dressed as commodity crime). METHODOLOGICAL (the analyst misreads himself — no staging): the BENIGN MISREAD (a legitimate/dual-use tool — PsExec, PowerShell, a backup utility — read as a malicious objective because it COULD be one, the false positive of objective) and the WRONG-PHASE (reading the objective off the wrong window — the Case 19 snapshot error, staging mistaken for terminal) / WRONG-PAYLOAD (reading it off a conspicuous commodity coexisting with a quiet bespoke one — the composition-vs-coexistence error). The two families feel identical from inside the error (confidently report X, truth is Y) but are caught differently: the adversarial by SUSPICION OF THE EVIDENCE (was this planted to be found? forged to mislead?), the methodological by DISCIPLINE OVER THE READING (executed or merely possible? the whole intrusion or one phase? the only payload or one of several?).

Beneath all four is a single MASTER GUARDRAIL: read FUNCTION, not APPEARANCE. Every misread traces back to appearance — the decoy manipulates it (loudness), the false flag forges it (signatures), the benign misread over-reads it (capability), the wrong-phase/payload reads the apparent objective of the visible moment/element. Function is the layer the operator CANNOT fully fake (a wiper cannot be made to actually decrypt-for-pay; the behaviour is constrained by what the code truly does) and the analyst CANNOT lazily assume (he must observe the act or read the code). And OBJECTIVE-attribution is held SEPARATE from AUTHOR-attribution: a false flag misdirects the author (the mimicked family is blamed) but the FUNCTION still reads the true objective from behaviour (a wiper wearing a ransom note still WIPES, has no decryption capability, reads destruction not EXTORT) — keeping the two attributions independent is what lets the function-read survive the forged author (report 'author forged/unknown, objective destruction'). The meta-point: the register's whole apparatus (confidence-grading, honest-unknowns, function-over-label, executed-vs-staged, conspicuous-vs-terminal, intent-vs-author, the timeline and survey disciplines) is ENGINEERED to survive misattribution, each guardrail answering a specific misread.

The objective signal is NONE — methodology, a reflexive case about the failure modes of objective-reading and the guardrails against them. The steelmanned objection — that the guardrails license the analyst to OVERRIDE any evidence he dislikes by crying 'decoy!' or 'false flag!', substituting a preferred hidden objective for the plain reading — is answered by the guardrails being EVIDENTIARY not SKEPTICAL: 'read function not appearance' does not say disbelieve the ransom note, it says read what the payload DOES (if it encrypts-and-decrypts-for-pay, the function CORROBORATES EXTORT and the register reports EXTORT); the false-flag reading is available ONLY when function CONTRADICTS appearance (a ransom note on a payload with no decryption capability, actually wiping — itself function-evidence, observed not assumed); 'never let one conspicuous payload close the investigation' demands surveying for a SECOND payload read from its OWN function, never a posited one. Every guardrail RAISES the evidentiary bar (read function, survey exhaustively, find the second payload, establish the other phases) — a hidden objective must be FOUND AND READ FROM FUNCTION like any other, never inferred from the mere possibility of concealment. The case hands the analyst an obligation to read MORE evidence, not a licence to disbelieve it; the misreads are defeated by more complete function-reading, the discipline intensified, not suspended. No individual named. Classification: TLP:WHITE. We read function, hold the attributions separate, refuse the easy close, and let people judge.

Follow the Payload — Case 21. Objective signal: NONE (methodology — how the register reads an objective WRONG, and the guardrails against it). Misattributions in two families by cause. ADVERSARIAL (operator wants you to misread — evidence staged): DECOY (a loud objective hiding a quiet one — DDoS-as-cover generalized; guardrail: never let one conspicuous payload close the investigation, and treat conspicuousness as a prompt to keep looking) and FALSE FLAG (mimic a known family's signatures/note/TTPs to misattribute the author and misdirect the objective — a wiper wearing a ransom note; guardrail: read function from behaviour, not the objective from the label). METHODOLOGICAL (analyst misreads himself): BENIGN MISREAD (a dual-use/legitimate tool read as a malicious objective because it COULD be one; guardrail: the objective is what the payload DID or is present-in-code to do, not what a tool could do) and WRONG-PHASE (objective read off the wrong window — Case 19 error) / WRONG-PAYLOAD (read off a conspicuous commodity beside a quiet bespoke one — composition-vs-coexistence; guardrails: timeline and survey disciplines). Caught by different means — adversarial by suspicion of the evidence, methodological by discipline over the reading. MASTER GUARDRAIL: read FUNCTION not APPEARANCE (every misread is a read of appearance — loudness, forged signatures, capability, the visible moment — where the register should read what the payload DOES; function is the layer the operator can't fully fake and the analyst can't lazily assume). OBJECTIVE-attribution held SEPARATE from AUTHOR-attribution (a false flag misdirects the author, but the function reads the true objective — a wiper still wipes — so the function-read survives the forgery). The register's whole apparatus is ENGINEERED to survive misattribution. Steelmanned objection (the guardrails license overriding any evidence by crying decoy/false-flag, substituting a preferred hidden objective) answered by the guardrails being EVIDENTIARY not skeptical: the false-flag reading is available only when function CONTRADICTS appearance (itself observed function-evidence), a hidden objective must be FOUND AND READ FROM FUNCTION never inferred from the possibility of concealment; every guardrail raises the evidentiary bar and demands MORE reading, not less. No individual named. Classification: TLP:WHITE. Include everything — appearance lies, function does not; we read the function and let people judge.