E6 - Ghost in the Machine - Curtain Call

Mar 29, 2016 | by RSA

The Hunter's horse panted heavily and churned up dust as it raced down the dirt road towards the Frontier. The moonlight glanced off the swirling clouds of powder in the horse's wake. The Hunter gritted his teeth as the horse careened around a corner.

His mind raced. He wondered if he would make it in time. He tried to calm himself as he walked through each step he had taken over the last few days. Each moment he analyzed, he found himself wishing he had put the puzzle together faster. He prayed he wasn't too late. Too many people counted on him. The threat was too dangerous.

As he topped a small hill, he could see the cloud of dust churned up from the racing wagon ahead of him on the winding road. The trees hid his quarry momentarily from his view but he knew he was getting closer. The horse leapt over a series of dips in the road. The Hunter crouched against the rushing wind and grunted. His back ached as the pair sped past a low stone wall.

The wagon finally emerged into view. The moonlight flashed and illuminated the cart, the strongbox visible even from the distance. The driver of the wagon spun around to see his trailing adversary.

The Ghost grimaced as he spied the racing Hunter behind him. His eyes flashed as he urged his horse on. The wagon slung around a bend in the road. The heavy strongbox clanked against the side of the wagon as it tipped onto two wheels. The horse strained against the load but picked up speed as the road dipped down a hill.

The Hunter heard an anguished cry pierce the night as the Ghost screamed his frustration. The Hunter kicked the horse's sides, demanding more speed from the massive stallion. The Hunter's cloak snapped in the wind and he gripped the reins tighter. He lost the view of the wagon again as he sped past several trees.

As the Hunter cleared the trees, he saw the Frontier station up ahead. The wagon, horseless now, was tipped over on its side. The strongbox had been flung into the brush. The Hunter could see a prone figure lying on the ground next to the wagon. He leapt from the stallion as soon as it stopped behind the wagon. He rushed to the figure on the ground. It was the guard from the station, lying on his side and groaning softly. A lump on his forehead was evident. The Hunter leaned in to inspect the wound.

After ensuring the guard was only slightly injured, the Hunter peered into the murky horizon of the Frontier. A vague shape drifted in the distance. He took a few steps down the road towards the figure. A cloud passed in front of the moon, blanketing the landscape with darkness.

In the distance he heard the soft clip clop of a horse pacing on the hardened surface of the road. As the sky cleared and the moonlight cascaded across the land, the Hunter identified the misty shape of a rider and horse disappearing into the night.


Marty's bleary eyes followed the scrolling command line. As he mentally ticked off the files being listed, his mind wandered over the last few crucial hours. It was all a blur at this time. Fatigued as we was, he forced himself to focus on the screen for a few minutes more.

The attack had quickly unraveled as Marty backtracked system by system to make sense of the crazy series of compromises. The last piece of the puzzle - the privileged administrator account that had been the final thrust into MagnaCorp's digital heart - had fallen into his lap courtesy of his well laid honeypot system. With that knowledge in hand, Marty had solved the intricate and confusing path the attacker had taken through the vast network. At the end of that complex trail lay a treasure trove of documents - all packaged and ready to be exfiltrated.

It seemed anti-climatic to Marty that it only took a series of keystrokes to lock down the files and shut out the account. He wanted the effort to be more heroic. He wanted more satisfaction. He wanted to yank the attacker physically away from a keyboard and smash the laptop that had been the tool of aggression. He longed to hear the clank of the metal door after he pushed this malicious and devious unknown into a jail cell. He wanted to turn the key for himself.

But he knew that was a dream. A non-reality. Despite their best efforts of attribution, the truly guilty parties would remain a mystery, at least for now. The last few weeks for Marty had been an endless series of days and nights blurring together. Greg had missed his son's school outing. Erin and her team logged hours and hours of overtime. The attack had disrupted all of their lives. Marty knew the stress of the breach fanned out - to his boss Dave, to the other executives, to their families. It was like dropping a big stone in a pond. The ripples disrupted all around and it would take time for the water to still itself.

With one last press of the enter key, Marty knew the threat was over. He sighed deeply and knowingly. His hand slowly closed the lid of his laptop. The laptop lid clicked. It was over. Until next time...

Author: RSA

Category: Research and Innovation, Blog Post

Keywords: Advanced Persistent Threats, Advanced Threats, APT, Enterprise Security, Risk & Compliance (GRC), Risk Management, Security Management, Security Mini-Series, Security Short Stories