What Happened Here
The company’s AI infrastructure optimisation project went live on a Tuesday. By Thursday, the printers had unionised.
The first change was routine: move the directory and mailboxes. ThreatLokkr blocked the authorised migration utility five minutes into the window because the utility had spent six months in the project plan and no time in the allowlist. Then the approved operator lost the passkey on the only recovery device. While three people asked who owned the exception, attackers used a compromised customer account to send plausible approvals faster than the help desk could close them. For several hours, the incident had better staffing than IT.
The route out of the Warehouse is the incident report nobody wanted to write. In the Jungle, a trusted customer relay exposes stale memberships, forgotten service identities and years of interdepartmental trust. In the Cave, the retired on-prem directory keeps rebuilding access after the cloud team removes it. In Magma, two independent power and cooling paths arrive in the same equipment room under the same leaking pipe. Labels A and B turn out not to be a resilience strategy.
Frozen Peaks holds the missing paper trail and an offline token carried by a technician whose shift Payroll never managed to close. At the Dock, that token releases the genuine executive warning, which Northstar Mail quarantined for sounding unusually sensible. The malicious copy got through with the right names, the right thread and one routine change to the bank account. The next payment batch is stopped only after somebody verifies the request outside the email chain.
In the Flooded Ruins, every component dashboard is green and the service is completely unavailable. Walking the route proves that each team owns a healthy fragment and nobody owns the journey between them. The surviving path loops through Maintenance, where a forgotten contractor identity still runs the pumps, cooling and meeting-room power. The credential has to be rotated without turning off the building, a requirement Facilities submitted under “preferably.”
Both trails meet in the Server Farm. The evidence reveals one estate-wide impersonation campaign run by local AI agents through the trusted automation route. Worse, the optimisation project woke the legacy system nobody could retire, and it has been running the attackers’ work as an overdue batch job with excellent uptime. Your last change window is a live retirement: revoke the lookalike domains, rotate the privileged accounts and shut the job down while it argues that every buried quarterly process is business critical.
The controls worked. Ownership, legacy dependencies and human verification did not keep pace. Your job is to rebuild one verified route across the estate, then close the oldest ticket on it.