Grant Industrial’s primary revolving credit facility was large enough to make the six-hundred-thousand-dollar invoice look like pocket change.
The company used it for working capital across multiple subsidiaries.
Payroll.
Material purchases.
Equipment.
Short-term operating needs.
A disruption wouldn’t bankrupt Grant overnight.
It didn’t need to.
It only had to create uncertainty.
The CONTINGENCY folder contained draft communications addressed to Grant’s lenders.
One claimed undisclosed operational failures had materially increased risk.
Another alleged that management had concealed cyber incidents.
A third requested an emergency review of Grant’s borrowing availability.
Samuel Hargrove read them over Naomi’s shoulder.
“If these reach the banks tomorrow morning, they’ll ask questions.”
Eleanor said, “Questions aren’t a crisis.”
“No.”
Samuel looked at another file.
“This is.”
A document appeared to be a Grant Industrial board resolution.
It authorized temporary restrictions on new borrowing pending a governance review.
Eleanor’s electronic signature appeared at the bottom.
She stared.
“I never signed that.”
Naomi checked the signature block.
“It’s an image.”
Not a valid digital signature.
But visually convincing.
Attached was another document carrying Samuel’s signature.
Also false.
Samuel’s face hardened.
“Where did they get that?”
Public filings.
Annual reports.
Scanned corporate documents.
Signatures were not difficult to find.
The attorney said, “A sophisticated bank will verify.”
Walter asked, “And an unsophisticated bank?”
Grant had several lenders.
All it took was one frightened risk officer forwarding the documents before verification.
Rumors could travel faster than corrections.
Richard’s plan didn’t require a successful fraudulent transaction.
It required enough financial uncertainty to make the board question Eleanor’s control.
“Who sends them?” I asked.
Naomi searched.
A scheduled email script.
9:00 a.m.
Sender addresses designed to resemble Grant legal and governance accounts.
Spoofed domains differed by one character.
Samuel shook his head.
“People will click.”
“Some will.”
The investigators were notified.
Banks were warned through verified channels.
Grant’s finance team contacted each lender directly.
Domain-monitoring services began blocking the fraudulent addresses.
By 9:30 that evening, the financial contingency had lost much of its power.
Then we turned back to 11:07.
Eighty-three companies.
Not all contained scheduled tasks.
Naomi and the investigators categorized them.
Seventeen CONVERTED companies had existing Northstar contracts.
Eleven DEMO COMPLETE companies had experienced suspicious failures.
Twenty-two had active or recently active access.
The remainder were prospects with varying exposure.
We couldn’t inspect every controller manually in three hours.
We needed a pattern.
I opened the Bay Three scheduled package.
Walter sat beside me.
“What are you looking for?”
“Filename.”
“Why?”
“People reuse things.”
The deployment package was called svc_cert_refresh.bin.
I searched the recovered server.
Thirty-four copies.
Different companies.
Same base name.
Some altered slightly.
svc_cert_refresh2.
cert_refresh.
oem_cert_refresh.
Human beings loved reusing names almost as much as passwords.
Naomi built indicators from filenames, certificate fingerprints, task identifiers, and known scripts.
Those indicators went to the affected companies.
Responses began arriving.
Matches.
Calder found one.
Benton found two.
Trellis found three.
Several companies found none.
At 10:02, thirty-one scheduled deployments had been disabled.
At 10:21, forty-three.
At 10:38, fifty-six.
Walter watched the clock.
“Still too many unknowns.”
“Yes.”
Some companies weren’t responding.
Night shifts.
Outdated contacts.
Small IT teams.
One plant manager refused to disable anything without vendor approval.
The vendor was Northstar.
Naomi nearly threw her phone.
At 10:44, investigators obtained cooperation from Northstar’s corporate security team.
That mattered.
Whatever Adrian had done, the company now had lawyers telling executives that continued inaction could become catastrophic.
Northstar revoked central certificates.
But locally installed trust packages might still work.
11:07 remained relevant.
At 10:56, we had confirmed seventy-one of eighty-three targets contained no active scheduled deployment or had been remediated.
Twelve remained uncertain.
At 11:01, nine.
11:03.
Seven.
11:05.
Four.
Walter stood beside Bay Three’s controller.
The green beacon reflected across his face.
“Two minutes.”
Naomi was on three calls simultaneously.
I handled another.
A company in Indiana.
Their maintenance manager finally located the task.
“Disable it.”
“I need authorization.”
“You called me.”
“I mean internal authorization.”
“How long?”
“Supervisor’s not answering.”
The clock changed.
11:06.
“Do you have authority to place the controller offline?”
“Yes.”
“Then isolate it.”
“That stops production.”
“For one shift.”
“We’ll miss shipment.”
“Better than giving an unknown external certificate administrative trust.”
He hesitated.
Then:
“Doing it.”
One target removed.
Three.
Naomi held up two fingers.
Two.
Walter counted seconds under his breath.
I hated him for that.
11:07.
Nothing happened at Horizon.
Bay Three stayed green.
Naomi watched network telemetry.
No certificate deployment.
No remote authentication.
Then one alert.
A target company we had not reached.
Missouri.
Gateway connection established.
Naomi called their emergency number.
No answer.
Another alert.
Certificate accepted.
My stomach tightened.
“Which machine?”
She opened the recovered database.
A robotic welding line.
No safety-critical motion scheduled overnight.
Good.
But remote administrative access was live.
Investigators contacted local authorities and the company’s security provider.
Naomi attempted no unauthorized connection.
We could only warn.
At 11:09, the remote session ended.
No parameter changes visible from the gateway logs.
Maybe the attacker saw the broader network collapsing.
Maybe they tested access and withdrew.
Maybe something had been planted.
We didn’t know.
At 11:12, the company’s plant manager finally answered.
They isolated the line.
The time struck me.
11:12.
Five minutes after 11:07.
The same interval between my termination and Bay Three’s failure.
Walter noticed too.
“Full circle.”
“Not yet.”
Because someone had triggered the Missouri connection.
Kevin was detained.
Richard was under legal scrutiny.
Adrian was dealing with investigators and Northstar’s attorneys.
Martin Vale had been located.
Tyler was cooperating.
Yet somebody had still authenticated.
The operation had another active participant.
Naomi searched the server logs from the Missouri session.
A command token had been requested at 11:06.
Source user initials:
DS.
The MidState manager.
The person who had altered Kevin’s service routes.
We finally had a name from MidState’s response.
Darren Sloan.
Operations scheduling manager.
Investigators attempted to locate him.
His phone was off.
His house was empty.
His company laptop had not connected since afternoon.
Walter asked, “Where would he go?”
Nobody knew.
Then I remembered the tool case.
Kevin’s handwritten schedule.
One company abbreviation hadn’t matched any of the eighty-three targets.
GIC.
I had assumed Grant Industrial Corporate.
But Grant corporate had no production machinery.
“What if GIC isn’t Grant?”
Naomi searched.
A company appeared.
Great Inland Components.
Missouri.
The plant with the live connection.
Kevin’s schedule showed:
GIC – DS – 11:07.
Darren wasn’t merely a coordinator.
He was assigned to execute the Missouri event.
Investigators contacted the plant.
Security checked cameras.
A vehicle had entered the employee lot at 10:42.
The plate belonged to a MidState fleet car assigned to Darren Sloan.
He was physically at the target.
Walter looked at me.
“Local action plus remote noise.”
Cleaner separation.
Except this time, we knew the method.
The plant manager locked down the welding line and called police.
At 11:31, Darren was found in an unused maintenance office with a laptop connected to the industrial network.
The last active node we knew about had been caught.
For the first time all day, the room became quiet.
Then Eleanor’s phone rang.
Samuel watched her answer.
Her expression changed.
“What?”
She ended the call.
“That was Grant’s lead bank.”
Everyone waited.
“They received the fraudulent board resolution.”
The financial contingency had executed early.
Not at nine tomorrow.
Tonight.
And the bank wanted an emergency call with the board before midnight.
