Sounds like a layered assault, like a siege where the attackers first lay siege to the perimeter, then infiltrate, and finally take the stronghold. Start by mapping the outer layer—scan for open ports, weak credentials, and any exposed services that could be the “bastion.” Once you’ve identified the perimeter, look for footholds: dropped payloads, backdoors, or compromised accounts that give you persistence. The next step is to trace the lateral movement; use network flow logs to spot unusual traffic patterns that indicate a pivot from one host to another. Finally, the inner core—exfiltration or destruction—often uses encrypted tunnels or obfuscated scripts. By correlating each of these phases with known siege tactics—blockade, breach, occupation—you can break the attack into manageable parts and address each with targeted defenses. Keep the process methodical and document every step; that’s where the real edge lies.

The “king” is the core asset. Strike the bastion with a focused countermeasure, then methodically clear each foothold, and when you spot the tunnel, shut it down and isolate the segment. Keep the operations precise, monitor for any regeneration, and maintain the counter‑offensive.