Operation Mycelium

Some attacks announce themselves. This one grew. For three years a small autonomous system near the frontier did nothing remarkable, a clean routing history, tidy registry objects, the odd appearance of a Fungolian prefix under a second origin that came and went like weather, and by the time it mattered that second origin had become part of what the prefix’s normal looked like. Shadow6, the Borogravian regency’s cyber wing, was not in a hurry. The payload was never this week’s traffic; it was the freedom to act later, on ground already prepared.

The Establishment is the one party with a memory long enough to notice. Routing is a commons, and the city has read the global table for years, so when a Fungolian prefix finally arrived from the wrong place at a useful moment, the question was not whether the route was valid, it was, but whether anyone still remembered that the prefix had not always looked this way. Most monitors compare today with last week. This prefix had been taught, patiently, that last week was already strange.

On the backbone

  • FungusFiber Internet: the regional registry whose unsigned spaces and habit of trusting registry data leave the ground soft enough to root in.

  • Shadow6, the Borogravian regency’s cyber wing: patient to a fault, ageing an autonomous system and a registry presence near the frontier for a use it has not arrived at yet.

  • The Civic Defence Establishment: which has read the global table long enough to know what the prefix used to look like, and which finds nothing to drop in the present tense.

  • The Civil Observers’ Society: the amateurs, who logged the prefix’s flaky multiple-origin habit months ago and long since stopped finding it interesting.

The slow rooting

Shadow6 sent no decisive announcement for most of this. It tended a garden, and the Establishment, reconstructing from years of its own archive, found the shape only because it had kept the record that far back.

  1. Looking boring: the autonomous system grew a stable history, no leaks, no flaps, plausible business relationships near FungusFiber, so that anything odd later would read as a mistake rather than malice.

  2. The registry board: route and aut-num objects entered in a registry that checks no entitlement, asserting a Fungolian prefix on paper, while the spaces meant for later use were kept unsigned and their RPKI adoption stalled, quietly, in the kind of committee Fungolia’s consensus politics makes easy to stall.

  3. Normalising the anomaly: the prefix announced from an alternate but plausible origin and withdrawn, on a slow and irregular cycle, until the multiple-origin alerts blurred into background noise and the recorded baseline widened to include the anomaly Shadow6 would one day need.

  4. The take, when it came: timed to a spell of churn, brief and modest, blending into noise that was already there, and riding ground three years in the making.

What the Establishment sees, in the present tense, is a route that is valid or merely not-found, nothing a filter would refuse. The tell is not in the announcement; it is in the history, a prefix whose normal has been moved a hand’s width at a time, visible only against a baseline kept long enough to remember where it started. The recent record, the one the tooling learned, says routine.

Decision points

  • Whether to trust the long memory over the recent baseline. The detectors have been taught that this prefix is habitually strange, so acting means overriding the tooling’s own sense of normal with an analyst’s memory of a cleaner past, on a route that is, today, valid.

  • Whether to push the ally to sign. The durable answer is FungusFiber signing the spaces with tight ROAs and the registries checking entitlement, which moves at the speed of Fungolian consensus and a foreign ministry persuaded of a problem it cannot see.

  • Whether the city keeps history at all. The only reason the Establishment caught this is that it kept a baseline longer than the campaign was patient, which is a budget decision made years before the incident, not a control bought after it.

When the routes turn

  • The groundwork outlasts the people. Staff change, tickets close, and the dirty baseline, the conflicting history, and the shrugged-off anomaly remain, so the prepared ground is still there for the next hand.

  • The freedom was the prize. Shadow6 banked the ability to announce, one day, something odd that reads as routine, which is worth more than any single take.

  • The fix is institutional, not a filter. The routing system does not remember; it evaluates and drops in the present tense, so what defeats Mycelium is signed space, entitlement-checked registries, and a memory that outlasts staff turnover, none of which a router supplies.

Behind the announcement