A Very Normal Monday

Monday, 9:00am

The weekly operations meeting at Nordvik Polymers started on time, as usual.

There were three items on the agenda. The printer on the second floor was jamming again, though only for certain people. The server migration was now four months overdue and had reached the stage where postponing it again would require intervention from higher powers. And the rollout of multi-factor authentication was halted because the CEO got locked out during a very important meeting.

Petra, the IT manager, chaired the meeting, kept it under an hour, and left everyone with a reasonable action list. It was, seemingly, a very normal Monday.

Nobody mentioned the successful login from an unfamiliar network at 2:24am on Friday because nobody except the monitoring platform knew about it. Unwillingly, it kept the event to itself, next to millions of others.

The visitors had spent the weekend being unremarkable. They had logged in, looked around, then arranged a secondary way in. A small insurance in case the first one was closed. Then they did the thing that separates professionals from amateurs. They did absolutely nothing at all. No malware fireworks, no strange traffic, no haste. An intrusion that behaves like nobody goes unnoticed by anybody.

Through an authentication bypass in the outdated software, they compromised a long-forgotten administrator account, created during the pandemic so systems could be reached from kitchen tables. Its description field still read: TEMPORARY — remove after remote work project. The remote work project had ended. The account had not. It had survived a pandemic, two password policy updates, and one security audit.

The temporary account celebrated its fourth birthday in March, about the same as the average employment at Nordvik Polymers.