Faction Name: CPL -1 ASCII Tag: NEG1 Name Origin: In Computer Science there is what are called hierarchical protection domains typically represented as Rings 0 through 3. these are also represented as CPL or current privilege level. this faction is CPL -1 because they can exploit all rings 0-3 and have developed a custom attack vector that injects malware forcing the Kernel to run in a compromised Hypervisor creating a Higher level of privilege dubbed Ring -1 Background: CPL -1 is an anonymous, Semi-Autonomous collective of Gray Hat Cyber Security experts with strong tendencies to lean BlackHat for “The Greater Good of Internet Security”. The group came into view in Late 2008 following the Conficker outbreak where they gained notoriety for Compromising vulnerable systems and patching them. They were initially seen as a group protecting the internet until they were exposed for leveraging these compromised systems in the world's largest Botnet. These details stayed hidden for so long since the group only made use of a small fraction of data from each of these bots. It has often been speculated that CPL -1 is funded by the offensive operations wing of a clandestine Cyber Warfare Operations unit. Motivations: CPL-1 faction was created after seeing the impact of the early versions of the Conficker worm and vowed to change the face of IT security. Funding: The factions funds are attained in a variety of ways. The bulk of the faction cash flow comes from hosted Pharma sites used to sell prescription and OTC drugs at a low cost, as well as ad replacement for users surfing the internet through the proxies compromised by the group. Calling Card: Systems infected by the faction are always fully patched with latest OS patches and exploits used to compromise the system are closed with custom code. In case where a physical machine is compromised the system is slowly converted to a native boot virtual machine residing on a compromised hypervisor allowing the faction to use the system as a Bot without affecting the base operating system. Code Signatures: code developed by the faction contains no faction signature or identification of the author. This is to help reduce risk of compromise. Past members who have been caught in doing so are redirected to Dev/Null with varying levels of punishment. Includeing Death! Media Presence: The voice of the group comes from a Social media identity with the name NEG1 depicted as a person presumably male wearing a Max Headroom mask. Faction Organization: The Faction is hierarchical in nature with agents of the faction being assigned to Rings. Dev/Null: Those who have been exiled/excommunicated from the faction. Ring 4: Outsiders looking to prove themselves to the faction for official acceptance into the Group. Note the Rings relate to the group's name with ring 4 being non-existent in Computer Science terms so to are those who have yet to be accepted by the faction leadership. Prospective members in this tier are typically used as zombies in Botnet operations. Ring 3: Lowest Tier of Membership in the faction used by Ring 2 members to facilitate low-level compartmentalized tasks as well as managing Bots/malware tools used for revenue generation. Ring 2: Ring 2 contains those skilled members of the faction that can quickly execute assigned task orders autonomously with precision and low risk of compromise. The group is organized into compartmentalized execution teams consisting of a Task Director and a set of Task Specialists. Each execution team has focus on specific key target areas with task orders being issued by “The 10” to Execution team Task directors who in turn task specialists. This reduces the overall risk in the event of individual compromise. Ring 1: A council of Most Trusted Advisors to the CPL -1 Leadership. This council also called “The 10” or “The 1010 Legion” by faction members is devised of key members representing expertise in core task domains. Task Domains are: 1. Intelligence 2. Social Engineering 3. Cryptography 4. Biometrics 5. Physical Penetration 6. Hardware Penetration 7. Network Penetration 8. Application Penetration 9. RF Signal Analysis and Penetration 10. Exploit Research and Development Ring 1 Also has 3 special advisors who are officially part of the Ring 2 tier but may be consulted on the topics associated with their assigned advisory role. Roles include: 1. Recruiting 2. Social Media 3. Botnet Operations/management Neg1: The Collective Identity of the factions top leadership. Members of this tier speak with one voice to The 10. Members outside the Neg1 do not know the identity or identities of the NEG1.