Arch-E Stress Test
Credential Hygiene Failure Analysis — Kill Chain & Interventions | Shadow313 NEXUS threat model | Ottawa, ON
6
Cred Failures
30s
Fastest Exploit
3.7min
Full PE Chain
5%
Min Detection
$7.38B
Arch-E Loss
$0.1M
Cheapest Fix
6
Interventions
T+5h
Optimal Window
Key Findings
Shared SWIFT Admin Credentials (CF-01) — CRITICAL
Temenos T24 'swiftadm' reused across all 10 Arch-E institutions. Single theft = 10 instant compromises in 30 seconds. Detection probability: 5%.
Consortium Password Synchronization (CF-02) — CRITICAL
All 10 Arch-E institutions sync passwords monthly via shared T24 management server (10.100.0.5). Attacker who compromises one gets all 10 simultaneously.
No MFA on SWIFT Operator Accounts (CF-05) — HIGH
Password-only authentication means stolen credentials = immediate full access. Exploit time: 10 seconds. Detection probability: 2%.
Full PE Chain Completes in 3.7 Minutes with 0% Detection
SWIFT Operator → SWIFT Admin (10s) → T24 DB Root (30s) → Consortium Server Admin (60s) → All 10 Arch-E SWIFT Admin (120s). Zero detection at any stage.
Data Table
| Scenario | Entry | Delay | Comp. | Loss | vs Hard. | Effective? |
|---|---|---|---|---|---|---|
| #1 | T+5h (simultaneous) | Extend hardening to all Arch-E | $2.4M | 12h | $7.38B | HIGH |
| #2 | T+9.5h (recon) | Deploy MFA on Arch-E SWIFT accounts | $0.4M | 4h | $7.38B | MEDIUM |
| #3 | T+10h (Phase 1) | Cross-institution login velocity SIEM rule | $0.1M | 1h | $7.38B | HIGH |
| #4 | T+10.08h (Phase 3) | Network segment consortium server | $0.2M | 2h | $6.50B | HIGH |
| #5 | T+10.13h (Phase 4) | Out-of-schedule credential sync alert | $0.05M | 0.5h | $6.20B | HIGH |
| #6 | T+10.20h (Phase 6) | SWIFTProcessMonitor (already deployed) | $0 | 0h | $4.10B | DEPLOYED |