Operation 'Garden' — Unified Supply Chain Attack Correlation Report

Executive Summary This report documents a sophisticated, multi-year supply chain attack campaign targeting a security researcher. Evidence correlates firmware-level device compromise, NVRAM persistence, credential harvesting infrastructure, and open-source build system vulnerabilities into a unified attack chain. Key Finding The postmarketOS build infrastructure (bpo) vulnerabilities are NOT separate from the personal device compromise—they are components of the SAME attack infrastructure used by the SAME threat actor. Attack Duration February 2025 – Present (11+ months) Evidence of Adversary Response When forensic evidence was compiled on November 6, 2025, the researcher's MacBook was remotely wiped within 6 hours, confirming real-time adversary monitoring and evidence destruction capability. Contents Complete attack timeline (Feb 2025 – Jan 2026) NVRAM "Garden" framework analysis BCM4388 WiFi firmware evidence iPhone Alpine rootfs staging documentation postmarketOS/bpo vulnerability correlation Attribution indicators Legal violations documented Related Records This report correlates with Trust Anchor v1.0.2 (DOI: 10.5281/zenodo.18209371) and Attack Surface Analysis (DOI: 10.5281/zenodo.18209379). Disclosure Statement Published under adversarial disclosure conditions. Standard coordinated disclosure is not possible as evidence indicates the vendor organization includes the threat actors.