AE Release (industry) Agentic C2 Framework tool (ECHOTRIBBLE) - 2026-10-06 thru 10-08 (SAM.GOV).docx

Notice ID Agentic C2 Framework Tool (ECHOTRIBBLE) Assessment Event Related Notice Department/Ind. Agency

DEPT OF DEFENSE

Sub-tier Department of the Army Office Army Contracting Command General Information

• Contract Opportunity Type: Special Notice (Original)

• All Dates/Times are: (UTC-05:00) EASTERN STANDARD TIME, NEW YORK, USA

• Original Published Date: July 14, 2026 2:00 pm EDT

• Original Response Date: August 13, 2026 11:59 pm EDT

• Inactive Policy: 1 day after the response date

• Original Inactive Date: August 14, 2026

• Initiative:

Classification

• Original Set Aside: N/A

• Classification Code: D -- Information Technology services, including telecommunications services NAICS Code: 541 -- Professional, Scientific, and Technical Services/541330 -- Engineering Services

• Place of Performance: Augusta, GA USA

Agentic C2 Framework Tool (ECHOTRIBBLE) Assessment Event 06 October – 08 October 2026 Submit a whitepaper for consideration NLT 13 AUG 2026 at or before 11:59 PM ET

Purpose The Cyber Fusion Innovation Center (CFIC), in collaboration with U.S. Army Cyber Command (ARCYBER) and Army Cyber Technology and Innovation Center (ArCTIC), invites qualified industry partners to submit a whitepaper based on the included criteria for the development of an Agentic C2 Framework tool designed to autonomously navigate infrastructures, identifying and neutralizing identified threats/targets. This prototype will implement a modular, autonomous agent capable of navigation, environmental observation, and anomaly detection across digital environments and improving consistency across lines of effort that would occur without AI assistance.

Background/Synopsis This release is seeking a whitepaper document noting a solution for the development of an Agentic C2 Framework tool designed to autonomously navigate infrastructures, identifying and neutralizing identified threats/targets. Our organization is seeking to leverage automated solutions to further improve the efficiency and thoroughness of a modular, agentic C2 Framework tool capable of stealthy navigation, environmental observation, and anomaly detection across digital environments. It must operate with minimal human oversight, remain lightweight, and be deployable in contested, air-gapped, or cloud-native systems.

Key Objectives & Capabilities Objectives:

1. Develop an autonomous, modular agent capable of operating without human oversight.

1. Demonstrate adaptive anomaly detection and contextual reporting in multi-environment deployments (cloud, hybrid, and disconnected).

1. Validate low-observable design: no persistent footprint, no interference with host operations, and minimal resource usage.

1. Prove safe, rule-bound propagation: movement and activity based strictly on configured conditions or predefined triggers.

1. Enable plug-and-play modularity for evolving mission requirements through structured module architecture (JSON/YAML-based loading).

1. Provide secure communication and control channels for minimal remote management and telemetry retrieval.

Capabilities:

The proposed solution should possess the following key capabilities within functional requirements and technical requirements:

1. Self-Directed Behavior: Configurable rule-based or prompt-driven logic for autonomous task execution.

1. Anomaly Detection: Lightweight heuristic engine capable of detecting behavioral, registry, or file anomalies.

1. Light-Presence Operation: Memory-resident execution, randomized activity scheduling, and process name obfuscation.

1. Encrypted Call Back: Covert, low-bandwidth beaconing with adjustable frequency.

1. Ephemeral State Memory: Short-term state retention for contextual decision making.

1. Self-Destruct/Heal Logic: Policy-driven cleanup and recovery routines.

1. Multi-Platform Deployment: Operability across Windows, Linux, and macOS hosts.

1. Tamper Resistant: Software detects when it is in a debugger or analysis environment and alters behavior or terminates.

Technical Approach & Architecture Proposers shall describe a modular architecture that enables component substitution, feature expansion, and environment adaptability. At minimum, the architecture should include the following layers:

1. Core Architecture Layer

0. Module Loader: Dynamically loads modules for detection, reporting, or control.

0. Cross-Platform Runtime: Must compile and execute cleanly across target operating systems.

1. Agentic Behavior Engine

1. Decision Logic Layer: Configurable for rule-based execution (JSON/YAML).

1. LLM Integration (Optional): Local inference using small LLMs (SLMs) for adaptive recognition and contextual filtering.

1. State Management: Optional ephemeral state memory or persistent data for correlation and adaptation.

1. Red Team Operations Toolkit

2. Anomaly Detection Engine: Detects deviations in host/network behavior.

2. Report Beacon: Sends compressed, encrypted telemetry via HTTPS or DNS.

2. Operational Controls: Configurable thresholds for alerting, quarantine, or silent observation.

1. Operational & Persistence Framework

3. Randomized sleep cycles and polymorphic process naming.

3. Fileless execution with optional persistence toggle.

3. Code obfuscation and signature-free compilation.

1. Control Interface

4. Minimal Command Line Interface (CLI) or local web service endpoint.

4. Accepts configuration via secure file or encrypted channel.

4. Supports JSON-formatted logs with timestamps, event type, and metadata.

1. Simulation and Testing Layer

5. Sandbox compatibility for red team validation.

5. Logging and behavior tracing in lab mode.

5. Toggle between “lab” and “field” configurations.

Why Should You Participate?

ARCYBER seeks to enter into non-FAR-based agreements with Industry, Academic, and National Lab partners whose solutions are favorably evaluated by ARCYBER Subject Matter Experts. As such, these events are considered competitive in the same manner as a Broad Agency Announcement (BAA) or Commercial Solutions Opening (CSO), and solutions will be evaluated independently of one another primarily for technical merit.

What happens after a whitepaper submission?

(About grading and downselection for a Virtual Demonstration Assessment Event) The Stakeholder will assign Assessors to an Assessment Team to review, grade, and potentially provide anonymous constructive feedback on whitepapers received by the deadline noted above. This Assessment Team will suggest subsequent down select companies whose white paper solutions have the highest value and feasibility. Then, those companies will be invited to present and/or demonstrate their capability in a private, virtual pitch / demo session hosted through an online platform with Stakeholders and Assessors on a specific date.

Thereafter, prospective solutions will be evaluated through a multi-phased process with the intent to competitively award one or multiple contracts through: CFIC’s B2B Contracting Mechanism through its Partnership Intermediary Agreement (PIA) with the Government, Other Transaction Agreements (OTAs), or other non-Far based agreements for prototype projects in accordance with 10 U.S. Code §2371b, if deemed appropriate and in the Government’s best interest.

Timeline Phase I: 24 June 2026 – Collaboration Event (completed)

Phase II: On or about 13 July 2026 - 13 August 2026 – Whitepaper RFP and Submission Window Industry, academia, and government partners MUST submit a 5-page response whitepaper through this link – CLICK HERE. The whitepaper MUST follow the whitepaper instructions and template to best fit the needs of the Assessment Team.

Teaming Opportunities: Fill out this form to submit your company information and applicable capability statement/documents. All companies interested in teaming will receive a packet of other companies with whom they could team-up for a whitepaper solution. The form will be open until 12:00pm (noon) Eastern on 27 July 2026.

Q&A Response Session: Fill out this form to submit questions related to this release which can be addressed by the Principal Stakeholder. The form will be open until 12:00pm (noon) Eastern on 27 July 2026. Thereafter, a one-way virtual Response Session or Response Document will be available on or about 03 August 2026.

Whitepaper submissions will not be accepted via email, and a Vulcan account is required to be created and working for the submitter NLT 48 hours prior to the deadline stated in the RFP.

As of this release, the timeline to submit a whitepaper is anticipated to be NLT (No Later Than) 11:59 p.m. Eastern on Thursday, 13 August 2026.

For more details on submissions, please review the information (including how to access the whitepaper submission instructions and template) under the paragraph below titled “How You Can Participate”.

Phase III: On or about 18 August 2026 - 31 August 2026 – Submissions Reviewed for Downselect Submitted whitepapers will be reviewed by an Assessment Team and based on rubric parameters identified in requirements and criteria included in a later RFP release document regarding whitepaper submissions and requirements, the Assessment Team will downselect those respondents / submissions they feel have the highest potential to satisfy their needs.

Favorably evaluated submissions will receive an invitation on or about 10 September 2026 to virtually present a demonstration of their solution during Phase IV.

Phase IV: On or about 06 October 2026 - 08 October 2026 – Virtual Demonstration Presentations Demonstration presentations will be held virtually through MS Teams. During the 1-hour time allotted, each presenting company will demo their solution and capabilities that should satisfy, to the best of their ability, the requirements and criteria noted in a later release document regarding whitepaper submissions and requirements.

Each group will be notified of their presentation date and time by CFIC staff.

Companies should anticipate attending a 10-minute virtual Tech Check meeting via MS Teams with CFIC’s Associate Project Manager, Amanda Green, on or about 05 October 2026.

Phase V: Follow-On The Government has several acquisition/contract vehicles (i.e., various IDIQ contracts, purchase orders, etc.) to potentially purchase the final solution if operationally viable. The Government may elect to award to all, some, and/or none of the solutions. It is anticipated that notification of final selection will be sent out via email from CFIC on or about 15 October 2026.

How You Can Participate

· For technical issues with the Vulcan platform, email support@vulcan-sof.com.

Unless Vulcan has a significant and unavoidable outage on the submission deadline date, there will not be any deadline extensions provided.

· Submissions will be accepted through the Vulcan platform – CLICK HERE TO SUBMIT

· Whitepaper submission format, instructions, and template that MUST be followed for the optimal outcome is provided as a downloadable document in the Vulcan platform space associated with this project

· Vulcan submission instruction sheet – DOWNLOAD THE PDF

· To learn more about how to use Vulcan, please refer to this information on the CFIC website - https://www.cyberfic.org/joinvulcan.

Questions?

For submission-related questions, please contact CFIC Associate Project Manager Amanda Green at agreen@cyberfic.org.

DISCLAIMERS:

An award resulting from this Assessment Event may result in the award of follow-on contracts, transactions, or agreements, subject to the availability of funds. Upon determination that the competitively awarded prototype project(s) has been successfully completed, and subject to the availability of funds, the prototype project(s) may result in the award of a follow-on production contract or transaction without the use of competitive procedures. Such awards may include multiple phases.

Non‐Government advisors may be used in the evaluation of submissions and will have signed Non‐Disclosure Agreements (NDAs) with the Government. The Government understands the information provided in this announcement is presented in confidence and may contain trade secret or commercial or financial information and agrees to protect such information from unauthorized disclosure to the maximum extent permitted and as required by law. An organization's participation in any part of the selection process under this announcement indicates concurrence with the aforementioned use of contractor support personnel.