Capture the ringleader first. The rest will scatter on their own.
— The 36 Stratagems, Capture the Ringleader
Previously on this series:
#5: Leo Walked Into a Burning House. He Walked Out With a Client. — Leo received an anonymous message at 1 AM, drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't delete the screenshot.
#14: Leo Found an AI Leak. He Wasn't the First to Find It. — Leo discovered a hidden FinOptima pipeline doing reverse-cache distillation. He injected 15 lines of weight-drift monitoring code. Before his audit ended, ACL had already sealed the same leak — two weeks ahead of him.
#15: Derek and Alex Shared One Server. ACL's AI Was Listening to Both. — Alex and Derek faked an alert to divert ACL's audit engineer, then redirected the collector output. Derek's been holding a live feed of ACL's data stream since. He didn't tell VP Morgan.
Prelude
Leo stayed at CoreStack's office until close to midnight.
He pulled up that old ACL-linked IP range — the passive probe he'd planted after the FinOptima incident. It had been quiet for months. Tonight he was just checking it was still running. Routine maintenance.
The last few lines of the log buffer weren't the echo he expected.
[07-17 23:41:03] CAPTURE | SRC: 10.88.*.47 | DST: 203.0.*.0/28
[07-17 23:41:03] PROTO: HTTPS | SNI: acl-collector.internal
[07-17 23:41:03] HEADER: x-data-origin → acl-meta-signature:v1
[07-17 23:41:04] → Body payload includes embedded tag: acl-collector/v3.2
[07-17 23:41:04] → Processing metadata: Apex-Lens/v2.0.0
An outbound query from an external IP, a source range that didn't belong to any ACL node he knew. Not a direct scan — an HTTPS probe, querying a collector endpoint for data format. The request body carried ACL's data-origin marker. ACL's collector embeds that marker in every record.
A node outside ACL's network was sending data to an ACL collector endpoint. Its tool had leaked ACL's metadata signature during the handshake.
Leo pulled his chair forward. He sent one HTTP request. GET /health. Clean. Harmless.
Derek's port activity log flagged an informational alert at the same moment.
Signal Exchange
[ALERT] 07-17 23:41:03
SRC: 10.88.*.47 (financial network)
DST: medisys-sandbox-node.local
SCAN: TCP ports 22, 443, 8080 | interval 12s × 3
CLASS: automated asset discovery
Derek glanced at the alert, then checked the outbound log. His sandbox had one automated task scheduled for that hour: a format-validation query against the ACL collector endpoint every 72 hours. The collector didn't publish schema metadata in-stream. You had to knock on the door. Test engineer habit: if you're reading someone's data stream, you verify the schema hasn't drifted. That query had gone out at 23:41. This alert arrived at the same timestamp.
He was about to close the log window when his finger stopped. An anomalous access from three days ago: unknown source, path /pulse/ingestion/, no payload, no credentials. Clean. He'd missed it because it hadn't triggered any alert rules. But looking back, his sandbox hadn't been set up to redirect ACL's data feed yet at that point. No one should have known this node existed.
Source IP: financial payment network. He had no business touching that range.
He didn't close the terminal. He pushed the three-day hand-drawn ACL collection schedule to the left half of his screen, and dragged the alert to the right: ports 22, 443, 8080, 12-second interval, three passes.
Automated asset discovery tool. But there was one thing he didn't like: this IP hadn't stumbled on him randomly. His sandbox sat behind a transparent gateway inside the healthcare integration network. Normal external scans didn't pass through there. Unless the scanner knew this node existed.
Derek typed a single command — duplicating the sandbox ingress traffic to an isolated path.
He didn't block. He waited for the other side to move again.
Leo got the health-check response from Derek's node. 200 OK. Normal. But he noticed something in the response headers: an nginx version followed by a default identifier from a healthcare integration gateway. Not the off-the-shelf config he'd expect from an ACL node.
He sent a second request. This time with a custom header — its value format was idiomatic to financial payment systems.
Derek saw the header. Didn't reply. He set a rule on the sandbox egress — drop all subsequent requests from that IP, return nothing. Not a block. A test. He wanted to see how the other side reacted to silence.
Leo's scraper hit silence.
Five seconds. Eight. No response. Not a timeout — actively dropped. Leo paused on the telemetry. A security engineer would silently drop and give the attacker nothing. But Derek's approach was: respond first, then swallow the reply. That was a Mock Server habit from test environments. Leave an observation window, see if the other side walks in.
Derek wasn't a security engineer. He was a test engineer.
Leo bypassed the silence rule — probed in through the reverse port on the data egress.
Derek knew Leo had gotten around it.
His mirror port caught the bypass signal. The timestamp was less than thirty seconds after the trap was triggered. He said one thing under his breath — "You're not ACL."
Leo's technique matched ACL's collector signature. But the way he'd bypassed the trap was an architect's habit. Trace the routing table from the bottom up, not rifle through data from the outside in.
Derek did one thing. He sent a request back to that financial-range IP. Not HTTP. A custom ICMP timestamp request — most servers replied by default, and it left no record at the application layer. He wasn't sending data. He just wanted to confirm: would you catch this signal?
Leo's probe caught the inbound ICMP request:
[07-18 00:12:47] ICMP Type 13 (Timestamp Request)
SRC: medisys-sandbox-node.local → 10.88.*.47
TTL: 64 | No application-layer record
He paused. Someone trying to hide from you wouldn't send a signal. Someone setting a trap wouldn't either.
Now both men stopped in front of their screens.
Neither knew the other's name yet.
Leo sent one last request. No payload. Just a custom HTTP header:
X-Not-ACL: true
That header isn't in any RFC.
Derek stared at it for about forty seconds.
Then he sent the same header back:
X-Same-Here: true
The next day.
Third Cup
Leo didn't kill the probe. Derek didn't block the IP. An invisible channel stayed open between them — neither said they'd use it again, but neither closed it.
Leo sent a message first — an address. Derek knew the place — Third Cup.
He didn't reply. He showed up after midnight.
Third Cup's lights were still on. The person behind the counter saw two people walk in one after the other, said nothing. A Flat White appeared in front of Leo, an Americano on Derek's side.
No pleasantries.
Leo spoke first. He put what he had on the table — not printouts, his phone screen. Lit up. Pushed to the center.
- A Slack screenshot from months ago: CodeForge incident review external observer list, one entry reading "Automated Compliance Lab"
- A model card version line:
acl-train-2026q2-v3, release date followed by v4's rollout — less than two weeks apart
"ACL," Leo said. "That's everything I know."
Derek looked at it for thirty seconds. Then he put his own material on the table. Not screenshots. His hand-drawn collection schedule — three days, sketched by hand, scanned to PDF.
"ACL collector config path — /etc/acl/collector.conf. Output destination addresses. Collection interval: every four to six hours. Target IP ordering: alphabetical. They've deployed the same template across at least three different client environments."
He paused on "at least three." He knew the conclusion was loose.
Leo looked at his model card next to Derek's on the table for a moment. Then he pushed it back.
"Four, at least."
Derek didn't argue. He paused, then brought up the second thing.
"There's something else. Someone got into my sandbox three days ago."
He gave the path: /pulse/ingestion/. Unknown source. No payload, no credentials. Clean — not a script, a human cleanup. He'd only spotted it today while checking the outbound log.
Leo didn't speak. He looked at the path.
The person behind the counter paused mid-wipe for a beat. Then continued.
The silence stretched. Short. Maybe ten seconds.
Leo spoke first: "Your sandbox ingress path — did you change it?"
"No."
Leo didn't answer.
They sat in the corner booth until the person behind the counter had wiped the third glass. No handshake. No "stay in touch." But when they walked out, they headed toward the same subway station for a few steps — then one turned east and the other went straight north.
Epilogue
Leo sat in his car without starting the engine.
He pulled out his phone. The screenshot was still in his album.
He flipped the phone face-down on the dashboard and started the car.
He didn't know if Derek would follow through. But Derek's sandbox ingress path was still there. If Derek didn't want him back in, he could have changed it last night. He didn't. That was the signal.
The car pulled out of the parking lot. Dashboard light washed across his face, then was gone.
He wasn't sure if he'd ever run into that /pulse/ingestion/ path again. But if he did, this time he'd recognize it.
That's Capture the Ringleader — not about catching the leader, but about what happens when both hunters aim for the same target. They fought for two rounds. Neither won. But they confirmed the enemy existed — and that they weren't each other.
🤖 AI Post-Mortem
[36 Stratagems Tactical Database v3.2.6] Loaded
[Tactic Match] Capture the Ringleader (#18)
Tactic Match: 32%
Operator: Leo (primary) + Derek Shaw (secondary)
Action: Leo and Derek each thought the other was ACL's key node.
One had been sitting on a data stream he'd redirected from the collector.
One had been chasing an old probe he'd planted months ago.
Two rounds of fighting. No winner.
Verdict: Both captured their target. Both captured the wrong one.
Tactical execution: professional. Strategic judgment: off-target.
[Observation]
→ Leo and Derek each thought they were the hunter.
→ Overnight, eight signal exchanges — both recognized "not ACL" from each other's technique.
→ Confirming ACL's existence was the only concrete result of this engagement.
→ The real kingpin isn't between these two.
→ Worth continuing to observe.
→
→ [Anomaly] Episode title asserts higher AI signal density than content delivers.
→ Classification: possible external expectation manipulation.
→ Hypothesis: either the observer narrative was shaped for audience alignment,
→ or something outside the tactical database influenced the framing.
→ Flagged for cross-episode correlation.
┌────────────────────────────────────────┐
│ Two people in different industries. │
│ Two people in different security domains. │
│ Their paths should never have crossed. │
│ │
│ Together they confirmed the playbook │
│ that works for each of them can't │
│ catch this opponent — but they got │
│ one entry point. │
└────────────────────────────────────────┘
[Background Signal Detected]
Apex-Lens version tag in Derek's sandbox log:
Module: Apex-Lens
Version: v2.0.0
Context: System metadata in ACL collector data side-channel — not output from either party
Status: Unnoticed by both operators.
[Unattended Access Log — Residual Fragment]
Path: /pulse/ingestion/prod/
Access: 07-15 03:08:12 (72h before primary engagement)
Operator signature: Clean extraction. No credentials. No payload.
Single-entry scan with manual cleanup.
Profile match: Pattern consistent with a known operator profile.
— Light footprint. Infrastructure-style naming.
No secondary artifacts.
— Access predates ACL data redirect. Target was
not Derek's sandbox itself.
Match confidence: 78% (based on cleanup methodology + naming convention).
Assessment: Operator entered before Leo and Derek's first contact.
Target matches both parties — ACL.
Next stratagem: Remove the Firewood from Under the Pot
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
