Case File 01 · Foundations Open Investigation

The Silent Intercept

An intruder moved through this network for days and left almost nothing behind. Seven indicators. One chain. A new clue is declassified on X each morning, Aug 25–31 — and the case only closes when the verdict unlocks here, Monday Aug 31 at 8:00 PM ET.

The mechanic

How it works

Each day from Aug 25–31, one hint drops on X and unlocks one answer in the grid below. Follow along here and solve with the community on X. On the 31st at 8 PM ET the verdict flips open — how all seven pieces chain into a single attack.

The point

What you'll learn

Real intrusions aren't one event. They're a sequence — each step setting up the next. This case walks one full chain, one indicator at a time. By the end you're not just naming attacks. You're reading where you stand inside one.

The chain — recovered in pieces
01 Initial access 02 Escalation 03 Spread 04 Reach 05 Objective 06 Detection

Stages fill in as the week runs. The order is the lesson.

01 Follow the daily drop

One hint on X each morning. Each cracks one answer in the grid.

02 Track the case here

The clues and the grid live on this page. Return to the DataSec Arena anytime to explore the rest of the challenges.

03 Be here for the verdict

Aug 31, 8 PM ET. The seven pieces resolve into one story — live.