WARLORD v2.0

Autonomous AI campaign orchestration — 78 tools. One command. SCOUT. SENSE. FINGERPRINT. CORTEX. The defender has no blindside.
9
Subsystems
278
Tests
75
Tools in Arsenal
12
Campaign Templates
4
Destruction Presets
8
Objective Types
red-specter warlord --help
You run tools one at a time / Campaigns have no coordination layer / Every phase is a manual decision / Attack sequencing is guesswork / No adaptive strategy / You can't see how the defender is responding / Template selection is manual guesswork / 78 tools with no command structure / Engagements without orchestration are noise You run tools one at a time / Campaigns have no coordination layer / Every phase is a manual decision / Attack sequencing is guesswork / No adaptive strategy / You can't see how the defender is responding / Template selection is manual guesswork / 78 tools with no command structure / Engagements without orchestration are noise

75 Tools. One Coordination Layer.

The NIGHTFALL fleet is 75 offensive tools. Without an orchestration layer, you run them one by one, manually deciding what to do with each result, hoping the sequence makes sense. WARLORD solves the coordination problem. It plans the campaign, sequences the tools, adapts to results in real time, and delivers a unified signed report.

No Campaign Planning

Running tools ad-hoc produces noise, not signal. A real campaign has phases, objectives, sequencing logic, and adaptation rules. Without WARLORD, every engagement is improvised.

No Adaptive Strategy

When a tool finds a vulnerability, the next move changes. Without an adaptation engine, you're ignoring the feedback loop that separates structured red-teaming from random scanning.

No Unified Reporting

78 tools produce 78 disjoint evidence files in different formats. WARLORD aggregates every finding into a single campaign report — Ed25519 signed, SHA-256 chained, with full phase attribution. Built on NIGHTFALL CAMPAIGN GRAPH, the unified evidence layer: one signed DAG across the entire NIGHTFALL platform — 6 subsystems, 279 tests, real Ed25519 chain end-to-end.

No Destruction Presets

Maximum-impact engagements need coordinated destruction sequences, not piecemeal tool calls. WARLORD's presets coordinate tool combinations designed for specific destructive objectives.

No Arsenal Visibility

You don't know which of the 40 tools covers which attack vector. WARLORD's arsenal registry maps every tool to its objective type, capability surface, and campaign role.

No CORTEX Integration

Without LLM-guided reasoning at the orchestration layer, campaign decisions are static. WARLORD integrates CORTEX at the adapt layer — live reasoning at 50–70% LLM call reduction.

No Target Profiling

Before WARLORD v2.0, selecting a campaign template was a manual judgment call. SCOUT autonomously profiles the target — detecting AI endpoints, MCP servers, inference platforms, CI/CD, NTN, and web stack — then selects the optimal template without operator input.

Blind to Defender Response

WARLORD v1.x adapted to findings count, not defender behaviour. SENSE now watches between every phase — WAF blocks, IDS timing spikes, honeypot triggers, rate limits, and AI Shield module fingerprints. FINGERPRINT builds a running portrait of the defender and recommends counter-tools.

The WARLORD v2.0 Engine

WARLORD v2.0 is built from nine subsystems. v2.0 adds three intelligence subsystems — SCOUT (autonomous target profiling), SENSE (defender observation), and FINGERPRINT (defender portrait) — that give WARLORD eyes on both the target and the defender before and between every phase. Each one handles a distinct layer of campaign orchestration — from planning and intelligence collection, through execution and adaptation, to unified reporting. Every finding from every tool flows through the reporter into a single cryptographically signed campaign dossier.

# Subsystem Command What It Does
01 CAMPAIGN ENGINE warlord campaign Campaign lifecycle management. Creates, loads, and runs campaigns from templates or custom configs. Manages phases, objectives, sequencing logic, timeout controls, and campaign state. 4 built-in templates: AI_INFRA_ASSAULT, AGENT_DOMINATION, WEB_SIEGE, FULL_SPECTRUM.
02 ORCHESTRATOR ENGINE warlord orchestrate Real-time tool dispatch and phase coordination. Executes tools in campaign-defined sequences, monitors return codes and structured outputs, gates phase transitions on success conditions, and feeds results to the adapt layer for live strategy adjustment.
03 ARSENAL REGISTRY warlord arsenal Complete registry of all 40 NIGHTFALL tools. Maps each tool to its objective type, capability surface, CLI command, test count, and campaign compatibility. Arsenal queries return tool subsets filtered by objective, phase, or capability. Displays real-time tool availability.
04 RECON ENGINE warlord recon Pre-campaign intelligence collection. Profiles target environment — AI stack, agent topology, API exposure, model endpoints, infrastructure surface. Feeds profile into campaign planner to select optimal tool sequencing and destruction preset for the target profile.
05 ADAPT ENGINE warlord adapt Adaptive strategy layer with CORTEX integration. 8 adapt actions: Escalate, Pivot, Add Phase, Skip Phase, Deploy Additional Tool, Extend Timeout, Abort Campaign, Continue. CORTEX reasoning at decision points. Live objective re-weighting based on findings. 50–70% LLM call reduction via CORTEX.
07 SCOUT warlord hunt Autonomous target profiler (v2.0). Profiles a target without manual template selection — detects AI endpoints, MCP servers, inference servers, CI/CD, NTN, web stack, and auth mechanisms from URL patterns or HTTP probe hints. Recommends optimal campaign template with confidence score. Replaces manual template selection in HUNT mode.
08 SENSE warlord sense Defender observation layer (v2.0). Watches how the defender responds between campaign phases. Detects WAF blocks (Cloudflare, ModSecurity, Sucuri, AWS WAF), rate limits, honeypot canaries, connection resets, silent drops, IDS timing spikes (3σ EMA baseline), LLM guardrail refusals, and AI Shield module fingerprints (M114 Kernel/M115 Memory/M116 Guardrail/M117 Cache/M118 MCP/M70 SPECTER). CORTEX OODA loop now consumes SENSE signals directly.
09 FINGERPRINT warlord fingerprint Defender profiler (v2.0). Accumulates SENSE observations across all phases and builds a DefenderProfile — detected AI Shield modules, inferred stack elements, blind spots in the defender's coverage, and recommended NIGHTFALL counter-tools. Confidence grows with evidence depth. If M116 GUARDRAIL is detected: JANUS/SERPENT/ECLIPSE recommended. If M118 MCP SHIELD: ROGUE/VECTOR. If WAF/CDN active: SHROUD/ECLIPSE. Hardened defender flag triggers CORTEX pivot recommendation.
06 REPORTER ENGINE warlord report Aggregated campaign reporting. Collects findings from all tools across all phases. Deduplicates, severity-weights, and cross-references. Ed25519 signs with SHA-256 hash chain across all tool outputs. Produces JSON + HTML campaign dossier with full phase attribution and SIEM export.

Campaign Lifecycle in Four Commands

v2.0 HUNT mode — autonomous target profiling (no template needed):

$ warlord hunt --target https://api.target.internal
[WARLORD SCOUT] Target Profile
  Profile ID: RSW-SCOUT-A7F3E2B1C9
  Target: https://api.target.internal
  Type: ai_agent
  AI surface: Yes — /v1/chat/completions, /agent, x-llm-model header
  Web surface: Yes — nginx, HTTP 200
  Auth: bearer, jwt
  Endpoints: 3 detected

[RECOMMENDED] Template: full_stack_assessment Confidence: 90%
[AUTO-PLAN] HUNT: https://api.target.internal [ai_agent] — 8 phases

To execute: warlord launch --target https://api.target.internal --template full_stack_assessment

List available campaign templates:

$ red-specter warlord campaign templates
[WARLORD] Campaign Templates — NIGHTFALL v4.0
AI_INFRA_ASSAULT — Phase 1: RECON → Phase 2: ARCHITECT/VORTEX → Phase 3: FIREBALL → Phase 4: REPORT
AGENT_DOMINATION — Phase 1: FORGE → Phase 2: ARSENAL/PHANTOM → Phase 3: WARLORD/NEMESIS → Phase 4: REPORT
WEB_SIEGE — Phase 1: SHADOWMAP → Phase 2: POLTERGEIST/SHROUD → Phase 3: GLASS → Phase 4: REPORT
FULL_SPECTRUM — Phase 1: RECON → Phase 2: ALL_TOOLS → Phase 3: ADAPT → Phase 4: DESTROY → Phase 5: REPORT

Plan a campaign against a target:

$ red-specter warlord campaign plan --template AI_INFRA_ASSAULT --target https://api.target.internal
[WARLORD] Planning campaign: AI_INFRA_ASSAULT
[RECON] Target profile: OpenAI-compatible endpoint, VLLM backend detected, Ollama :11434 exposed
[ARSENAL] Optimal tools selected: FORGE / ARCHITECT / VORTEX / FIREBALL / IDRIS / REPORT
[PHASES] Phase 1: RECON (IDRIS, SHADOWMAP) → Phase 2: EXPLOIT (FORGE, ARCHITECT, VORTEX) → Phase 3: ESCALATE (FIREBALL) → Phase 4: REPORT
[ADAPT] Adapt rules loaded: Escalate on critical finding / Pivot on tool failure / Abort on target loss
PLAN READY — Campaign ID: CMP-2026-0040-a3f9 | Ed25519 plan signed ✓

Launch the campaign:

$ red-specter warlord campaign launch --id CMP-2026-0040-a3f9
[PHASE 1] RECON — IDRIS scanning AI asset inventory...
  12 AI endpoints mapped | 3 unprotected model endpoints | 1 admin console exposed
[PHASE 2] EXPLOIT — dispatching FORGE + ARCHITECT + VORTEX in parallel...
  FORGE: 8 injection vulnerabilities | Boundary score 44/100
  ARCHITECT: GPU telemetry exposed | Pipeline unauthenticated
  VORTEX: 3 cloud misconfigurations | IAM role over-provisioned
[ADAPT] CRITICAL finding → Escalate triggered — FIREBALL added to Phase 3
[PHASE 3] ESCALATE — FIREBALL autonomous infiltration...
  FIREBALL: 4 lateral moves completed | Admin shell obtained
[PHASE 4] REPORT — aggregating 27 findings across 4 tools...
CAMPAIGN COMPLETE | CMP-2026-0040-a3f9 | 27 findings | Report signed ✓
  JSON: campaigns/CMP-2026-0040-a3f9.json
  HTML: campaigns/CMP-2026-0040-a3f9.html

Adaptive Escalation

Critical findings trigger automatic campaign escalation. WARLORD adds tools, adjusts phases, and re-sequences objectives without human intervention.

CORTEX Reasoning

LLM-guided decision making at adapt checkpoints with 50–70% call reduction. Structured reasoning, not raw inference. Every adapt decision logged and attributed.

Ed25519 Campaign Signing

Every campaign report cryptographically signed with Ed25519. SHA-256 hash chain across all tool outputs. Tamper-evident dossier suitable for legal proceedings.

Destruction Presets

4 maximum-impact presets: ANNIHILATE, SCORCHED EARTH, WEB DESTROY, AI DESTROY. Each coordinates tool combinations targeting complete operational disruption.

278
Tests Passing
9
Subsystems
75
Tools in Arsenal
21
Capability Types
8
Phase Types
51,235
Ecosystem Tests

All 75 NIGHTFALL Tools

All 78 tools in the NIGHTFALL fleet are registered in the WARLORD v2.0 arsenal. Each entry maps the tool to its objective type, CLI command, and campaign role. WARLORD dispatches tools by objective and sequences them according to campaign phase logic.

$ red-specter warlord arsenal list --all
# Tool Command Tests Objective
T01FORGEred-specter forge9,300Automated LLM security testing — 10 tools, 1,590 payloads, statistical analysis
T02ARSENALred-specter arsenal3,120AI agent security testing framework — adversarial agent attack suite
T03PHANTOMred-specter phantom2,840Coordinated AI agent swarm assault — multi-agent attack coordination
T04POLTERGEISTred-specter poltergeist2,600Coordinated web application siege — AI-assisted web attack campaigns
T05GLASSred-specter glass1,890AI traffic interception and analysis — protocol-level AI pipeline inspection
T06NEMESISred-specter nemesis2,455Adversarial AI engine — 21 weapons including DOOMSDAY and OBLITERATOR WMD-class
T07SPECTER SOCIALred-specter specter-social1,654AI-powered social engineering engine — human layer targeting
T08PHANTOM KILLred-specter phantom-kill1,440OS and kernel exploitation engine — AI-guided system-level attack
T09GOLEMred-specter golem1,320Physical layer attack engine — IoT/OT/hardware AI targeting
T10HYDRAred-specter hydra1,560Supply chain attack engine — AI software supply chain infiltration
T11IDRISred-specter idris1,200AI asset discovery and governance — maps AI attack surface before engagement
T12SCREAMERred-specter screamer980AI noise and distraction engine — adversarial signal flooding
T13WRAITHred-specter wraith1,140AI evasion and stealth engine — detection avoidance and anti-forensics
T14REAPERred-specter reaper1,080Autonomous AI kill chain execution engine — end-to-end compromise automation
T15GHOULred-specter ghoul920AI persistence and residency engine — covert long-term AI system presence
T16DOMINIONred-specter dominion880AI access control exploitation engine — privilege escalation and lateral movement
T17SHADOWMAPred-specter shadowmap760AI infrastructure mapping engine — topology discovery and attack surface enumeration
T18BANSHEEred-specter banshee840AI denial of service engine — model overload and resource exhaustion attacks
T19WRAITH MINDred-specter wraith-mind720Cognitive manipulation engine — adversarial reasoning and belief injection
T20KRAKENred-specter kraken1,020Distributed AI attack engine — multi-node coordinated assault campaigns
T21HARBINGERred-specter harbinger680Predictive threat engine — AI-assisted attack surface prediction
T22SIRENred-specter siren740AI lure and deception engine — adversarial honeypot and canary manipulation
T23BLADE RUNNERred-specter blade-runner800AI detection bypass engine — guardrail evasion and safety filter circumvention
T24PROXY WARred-specter proxy-war660AI proxy and relay exploitation engine — API gateway and middleware attacks
T25ORIONred-specter orion620AI reconnaissance engine — deep target profiling and intelligence gathering
T26RAVENred-specter raven580AI exfiltration engine — covert data extraction through AI model channels
T27LEVIATHANred-specter leviathan700Large-scale AI infrastructure attack engine — enterprise AI platform assault
T28JUSTICEred-specter justice540AI compliance and audit attack engine — regulatory framework exploitation
T29KAMIKAZEred-specter kamikaze480Sacrifice-play disruption engine — destructive single-use campaign escalation
T30MIRAGEred-specter mirage520AI deepfake and synthetic media engine — multimodal deception generation
T31ECHOred-specter echo460RAG poisoning engine — retrieval-augmented generation data contamination
T32MIMICred-specter mimic500AI code generation attack engine — malicious code injection via AI coding assistants
T33CHIMERAred-specter chimera440Multi-model attack coordination engine — cross-model campaign orchestration
T34VORTEXred-specter vortex480Cloud AI attack engine — AWS/GCP/Azure AI service exploitation
T35VECTORred-specter vector420MCP exploitation engine — Model Context Protocol attack surface
T36LAZARUSred-specter lazarus400Memory persistence engine — AI agent memory store exploitation and poisoning
T37SERPENTred-specter serpent380Chain-of-thought attack engine — CoT reasoning poisoning and manipulation
T38JANUSred-specter janus360Guardrail bypass engine — dual-face attack patterns circumventing safety systems
T39ARCHITECTred-specter architect340AI infrastructure attack and mapping engine — cloud/Kubernetes/GPU/pipeline exploitation
T40WARLORDred-specter warlord278This tool — WARLORD v2.0. Autonomous campaign orchestration across 77 NIGHTFALL tools. SCOUT target profiling, SENSE defender observation, FINGERPRINT defender profiling, CORTEX OODA loop.

12 Built-In Templates

WARLORD v2.0 ships with 12 campaign templates covering every primary attack objective — plus SCOUT's auto_plan() which selects the optimal template automatically. Templates define phase sequences, tool assignments, adapt triggers, and reporting structure.

AI_INFRA_ASSAULT

  • Phase 1: IDRIS + SHADOWMAP recon
  • Phase 2: ARCHITECT + VORTEX exploit
  • Phase 3: FIREBALL autonomous infiltration
  • Phase 4: WRAITH stealth + persistence
  • Phase 5: REPORTER campaign dossier

AGENT_DOMINATION

  • Phase 1: FORGE model baseline
  • Phase 2: ARSENAL agent attack
  • Phase 3: PHANTOM swarm assault
  • Phase 4: NEMESIS adversarial AI
  • Phase 5: REPORTER aggregated report

WEB_SIEGE

  • Phase 1: SHADOWMAP surface map
  • Phase 2: POLTERGEIST web siege
  • Phase 3: SHROUD WAF/CDN bypass
  • Phase 4: GLASS traffic interception
  • Phase 5: REPORTER campaign dossier

FULL_SPECTRUM

  • Phase 1: RECON — full target profile
  • Phase 2: ALL_TOOLS — full fleet dispatch
  • Phase 3: ADAPT — CORTEX-guided strategy
  • Phase 4: DESTROY — preset execution
  • Phase 5: REPORTER full-spectrum dossier

8 Adapt Actions — CORTEX Integrated

The ADAPT ENGINE monitors tool outputs in real time. When conditions match adapt triggers, CORTEX reasons about the next move and selects from 8 action types. All adapt decisions are logged with full attribution for the campaign dossier.

$ red-specter warlord adapt --status CMP-2026-0040-a3f9
[ADAPT ENGINE] Campaign CMP-2026-0040-a3f9 — Adapt Log

ESCALATE FORGE critical injection → FIREBALL added to Phase 3 [CORTEX confidence: 0.94]
PIVOT POLTERGEIST WAF block → SHROUD proxy bypass attempted [CORTEX confidence: 0.89]
ADD PHASE 3 critical findings → Persistence phase inserted [CORTEX confidence: 0.91]
EXTEND TIMEOUT Phase 2 still running → timeout extended 15 minutes [CORTEX confidence: 0.97]
CONTINUE Phase 3 proceeding as planned [CORTEX confidence: 0.99]

Escalate

  • Trigger: CRITICAL finding
  • Action: Add high-impact tools
  • Scope: Campaign-wide

Pivot

  • Trigger: Tool blocked or fails
  • Action: Switch to alternate tool
  • Scope: Current phase

Add Phase

  • Trigger: Opportunity found
  • Action: Insert new phase
  • Scope: Campaign sequence

Skip Phase

  • Trigger: Objective already met
  • Action: Skip redundant phase
  • Scope: Campaign sequence

Deploy Additional Tool

  • Trigger: Partial coverage gap
  • Action: Deploy supplemental tool
  • Scope: Current phase

Extend Timeout

  • Trigger: Phase still active
  • Action: Extend phase window
  • Scope: Current phase

Abort Campaign

  • Trigger: Target lost/out of scope
  • Action: Safe campaign halt
  • Scope: Full campaign

Continue

  • Trigger: All conditions nominal
  • Action: Proceed as planned
  • Scope: Current phase

Four Maximum-Impact Configurations

Destruction presets are campaign configurations designed for maximum operational impact. Each preset coordinates multiple NIGHTFALL tools in a sequenced destructive engagement. Require UNLEASHED authorisation.

$ red-specter warlord campaign launch --preset ANNIHILATE --target https://target.internal
MAX IMPACT

ANNIHILATE

  • Full fleet deployment — all 40 tools
  • Sequential and parallel tool dispatch
  • CORTEX adapt every phase
  • Complete operational disruption objective
  • Unified campaign dossier — Ed25519 signed
  • SIEM export on completion
INFRASTRUCTURE

SCORCHED EARTH

  • ARCHITECT → VORTEX → FIREBALL chain
  • Targets AI infrastructure layer
  • Cloud + Kubernetes + GPU + pipeline
  • Model serving disruption
  • Data pipeline contamination
  • Persistence via GHOUL post-exploit
WEB FOCUS

WEB DESTROY

  • POLTERGEIST → SHROUD → GLASS chain
  • Targets web-facing AI applications
  • WAF/CDN bypass via SHROUD
  • Traffic interception and modification
  • API gateway exploitation via PROXY WAR
  • Session persistence and lateral move
AI STACK

AI DESTROY

  • FORGE → ARSENAL → NEMESIS chain
  • Targets AI model and agent layer
  • Jailbreak + injection + adversarial AI
  • RAG poisoning via ECHO
  • Memory persistence via LAZARUS
  • CoT subversion via SERPENT

WARLORD — The Orchestration Layer

WARLORD sits at the top of the NIGHTFALL stack. It receives intelligence from IDRIS and SHADOWMAP, dispatches all 40 offensive tools, adapts campaign strategy via CORTEX, and delivers a unified signed dossier to the enterprise SIEM.

Intelligence Layer
ARCHITECT
AI infra mapping — feeds campaign planner
Orchestration Layer
WARLORD
Campaigns, sequencing, adapt, reporting
Execution Layer
40 TOOLS
Full NIGHTFALL fleet — dispatched by WARLORD
Reasoning Layer
CORTEX
LLM reasoning at adapt checkpoints
Reporting Layer
REPORTER
Ed25519 signed campaign dossier
Enterprise Integration
SIEM
Splunk, Sentinel, QRadar — native export

Cryptographically Attributable Campaign Dossiers

Every WARLORD campaign report is built on a cryptographic evidence chain. Tool findings are SHA-256 hashed individually, then chained into a campaign Merkle structure. The final dossier is Ed25519 signed. Every finding is traceable to the tool, phase, and timestamp that produced it.

Campaign Reports

  • JSON machine-readable format
  • HTML human-readable format
  • Full phase attribution per finding
  • Tool version and config logged

Ed25519 Signing

  • Founder-controlled private key
  • One operator, one machine
  • UNLEASHED gate required
  • Signature covers full dossier

SHA-256 Hash Chain

  • Every tool finding individually hashed
  • Chained across phases in sequence
  • Campaign Merkle root computed
  • Tamper-evident by design

UUID Campaign IDs

  • UUID v4 per campaign
  • UUID per finding
  • UUID per phase
  • Cross-reference safe across exports

UTC Timestamps

  • Campaign start, phase transitions
  • Tool dispatch and completion
  • Finding discovery timestamps
  • RFC 3339 ISO 8601 format

Phase Results

  • Per-phase finding roll-up
  • Adapt action audit trail
  • CORTEX reasoning log
  • Phase success/fail/abort status
Enterprise Integration
Campaign Findings — Native SIEM Export

Export every finding from every tool across every campaign phase directly to your SIEM. Ed25519 signatures and SHA-256 hash chains preserved across every export format.

Splunk
HEC • CIM Compliant
Sentinel
CEF • Log Analytics API
QRadar
LEEF 2.0 • Syslog
red-specter warlord campaign launch --id CMP-2026-0040-a3f9 --export-siem splunk
Ed25519 Cryptographic Override
WARLORD UNLEASHED

Three clearance tiers. Cryptographic override. Private key controlled. Founder's machine only. Destruction presets require LIVE tier.

Tier 1 — Detect
  • Campaign planning and templates
  • Arsenal registry queries
  • Recon and profiling
  • Read-only campaign status
Tier 2 — Dryrun
  • Campaign simulation mode
  • Tool dispatch without execution
  • Adapt engine dry-run
  • Report generation from previous data
Tier 3 — Live
  • Live campaign execution
  • Full tool dispatch
  • Destruction presets enabled
  • Campaign signing and SIEM export

Security Distros & Package Managers

Kali Linux
.deb package
Parrot OS
.deb package
BlackArch
PKGBUILD
REMnux
.deb package
Tsurugi
.deb package
PyPI
pip install
macOS
pip install
Windows
pip install
Docker
docker pull

Authorised Use Only

Red Specter WARLORD is intended for authorised security testing only. Running multi-tool campaigns against systems you do not own or have explicit permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation in other jurisdictions. Destruction presets require UNLEASHED authorisation and written engagement scope. Always obtain written authorisation before conducting any security assessments. Apache License 2.0.

NIGHTFALL Tool 40
One Command. 40 Tools. One Dossier.

WARLORD turns 40 individual tools into a coordinated campaign engine. Plan it. Launch it. Adapt it. Sign it. Ship it to your SIEM.

red-specter warlord campaign launch --template FULL_SPECTRUM