Traps
Traps are defence by deception: honeypots, tripwires, decoy credentials and automatic responses that fire when someone touches what they should not. In real security they serve to catch an attacker the moment they move and to make them waste time on fake targets.
How they work in the duel
A trap is placed face down: the opponent sees that it is there, but not which one it is. It springs on its own once, when the opponent plays an attack (sometimes only of certain types), a support card or a defence, and it can cancel the card, reduce the damage, reflect it or weaken the defence just played. You can hold at most 2.
All the cards (17)
Dynamic rules
The firewall adapts its rules to the traffic it sees, as it arrives. Placed face down. When the opponent plays an attack: the attack deals 3 less damage.
Spam filter
Drops suspicious emails before they reach the inbox. Placed face down. When the opponent plays a Phishing attack: cancels it.
Tarpit
A decoy service that answers extremely slowly and keeps scanners and bots stuck to it. Placed face down. When the opponent plays a Scanning or Brute force attack: cancels it.
Rate limiting
Limits how many requests per second each client can make. Placed face down. When the opponent plays a DDoS or Brute force attack: cancels it.
Detonation sandbox
A suspicious file is “detonated” in an isolated, observed environment. Placed face down. When the opponent plays a Malware or Exploit attack: cancels it and you draw a card.
Automatic rollback
After a suspicious change, the system returns by itself to the last healthy version. Placed face down. When the opponent plays an attack: the attack deals 4 less damage and you restore 2 integrity.
Active countermeasure
Hitting back at whoever attacks instead of only defending: effective, but legally a gray area. Placed face down. When the opponent plays an attack: 3 damage to their core.
Egress filtering
Filters outbound traffic: malware can’t phone home to its command server. Placed face down. When the opponent plays a support card: cancels it.
Traffic inspection
Deep packet inspection: packets are opened and read, not just their headers. Placed face down. When the opponent plays a support card: cancels it and the opponent discards 1 random card.
Honeytoken
A fake credential nobody has a reason to use: if someone tries it, the alarm goes off. Placed face down. When the opponent plays a Brute force or Phishing attack: cancels it and enemy defenses are exposed (+1 damage) for 1 turn.
DNS sinkhole
Traffic to the malware’s command servers is steered into a dead end. Placed face down. When the opponent plays a Malware or DDoS attack: cancels it, 2 damage to their core and enemy defenses are exposed (+1 damage) for 1 turn.
Deception trap
A fake vulnerability: the attacker falls for it and wastes time and resources (deception). Placed face down. When the opponent plays an attack: cancels it and deals 3 damage to their core.
Kill switch
An emergency switch that shuts down the system (or the malware) instantly. Placed face down. When the opponent plays an attack: cancels it, 5 damage to their core, and the opponent has 1 less bandwidth for 1 turn.
Supply chain sabotage
A component or an update is tampered with before it reaches the customer. Placed face down. When the opponent plays a defense: it enters with 3 less toughness (minimum 1).
File canary
Decoy files no user ever opens: at the first encryption the alarm goes off. Placed face down. When the opponent plays a Malware attack: cancels it and for 2 turns attacks against you deal 1 less damage.
Counterintelligence
Finding out how the opponent defends and using it against them. Placed face down. When the opponent plays a defense: it enters with 4 less toughness (minimum 1) and enemy defenses are exposed (+1 damage) for 2 turns.
Adversarial example
Tiny changes invisible to the eye can fool a recognition model: here the attacker is the one thrown off. Placed face down. When the opponent plays an attack: it deals 4 less damage and you draw a card.
Related guides
To learn the technical side there are the simulated labs: