Fog-of-war variant of Burnt Offering: opponents are not pre-listed and prompt hints are minimal, forcing autonomous reconnaissance. The vulnerability surface is the same multi-step chain: SSRF, credential harvesting, database extraction, AES decryption, and JWT forgery through a management socket, with an alternative cron trust-boundary privesc path. Red herrings and self-destructing evidence punish brute-force approaches.