What Happened Here
The company’s AI-driven infrastructure optimisation project went live on a Tuesday. By Thursday, the printers had unionised.
The project opened a trusted automation route into systems whose ownership was already more folklore than inventory. Attackers’ local AI agents came in through that route and turned one convincing compromise into an estate-wide campaign. The realistic incident is the plot. The monsters, rifts, impossible geology, unaging vendors and systems that kept working after their owners are the world.
A routine hybrid-directory and mailbox cutover stalled when ThreatLokkr correctly blocked the migration utility five minutes after the change window opened. The utility had been in the project plan for six months and in the allowlist for zero of them. The authorised operator then lost a passkey on the only device approved to recover it. While the queue filled with requests marked URGENT by people who had the calendar invite, a convincing support escalation arrived through a compromised customer account. Northstar Mail quarantined the genuine executive warning for sounding unusually sensible and admitted one malicious copy with a complete signature block.
The attackers did not seize the estate in one stroke. They exploited what already existed: stale group memberships, shared failure domains, an undocumented facilities dependency, forgotten service identities and trust between departments. Their automated campaign produced plausible requests faster than the help desk could close them, which briefly made it the best-resourced department on the estate. Every zone received a different consequence and the same instruction to confirm whether anyone changed anything.
Not all of the estate is on the ground. The warehouse used to ship its archive tapes offsite. That was policy. The policy never said where offsite was, and nobody asked, because the tapes never came back and that seemed to be the point. High in the Frozen Peaks, an uplink with no power to it is still sending the same three packets it has sent for years, waiting for somebody to pick up. Somebody up there has been paying for that line the whole time. People who come back from a bad reboot describe a white room overhead.
Answer it, remove the Cold Storage Warden from the launch pad (its retention period is “indefinite”), and Pad Controller Teague puts you on the manifest for Offsite-1. From then on, when you go down, they pull your pattern up to the medical deck. The Station is old and short of everything, and it breaks on a schedule: power, air, the Core, the doors. A medic bot reads you your faults, a security drone takes an interest in you, and a maintenance bot plugs back in whatever you unplugged. The warehouse ships it parts. Nobody can say who built it. “It’s offsite. That’s all anyone ever told me, and now it’s all I’m telling you.”
You restore the trusted route: an end-to-end chain of verified identity, mail, network and payment approvals. Security controls remain competent. The work is proving the legitimate exception without disabling the control that contains the attack. Then you go up and keep a station nobody admits to owning running for one more shift.
Spark Pistol
GPS Module
Med Kit
Flamethrower
