The second breach had now become something else entirely.
It was no longer just an intrusion. It was a conversation.
Inside the SUW workspace, screens glowed with scrolling telemetry as the team quietly watched the attackers move through the carefully prepared environment. The fake datasets had been planted hours earlier, just believable enough to pass a quick inspection, but completely fabricated.
“Movement confirmed,” Keren said, leaning forward. “They’re browsing.”
On another screen, packet captures began filling a window. The attackers had started packaging the files.
“They're compressing,” someone from the team muttered.
Ari glanced over.
“Same method as the bot,” he said calmly. “Watch the exfil path.”
A few seconds passed.
Then it appeared.
The outbound connection spun up exactly the way they expected: encrypted, structured, and methodical. Except it wasn’t going where the attackers thought it was going.
The traffic hit the fake command-and-control infrastructure the SUW team had deployed earlier.
“Got them,” Keren said.
Across the room, someone smiled.
The attackers believed they were extracting valuable internal data. Instead, they were delivering it neatly into a trap.
But Ari wasn’t done. He opened another terminal and began spinning up a new server instance.
“Another decoy?” one of the analysts asked.
“Better,” Ari said.
Within minutes the system was online: a pristine server running a MySQL database. Empty.
For now.
Ari launched one of the SUW team’s internal automation scripts. The script began populating the database almost instantly.
Rows appeared by the thousands.
Design documents. Technical research. Proprietary algorithms. Internal product notes. Everything an attacker hunting intellectual property would dream of finding.
Or so it looked.
In reality, every single record was fabricated, synthetic intellectual property crafted to look authentic.
Across the room, Keren was doing something similar. Her database, however, looked completely different. Instead of intellectual property, it was filled with chaotic corporate debris.
Random code fragments; archived reports; fake HR documents. Even folders of staged company party photos.
Someone had gone to impressive lengths to make the pictures look awkwardly real.
Ari nodded when he saw it.
“Good,” he said.
One database represented valuable intellectual property. The other looked like normal corporate clutter.
The attackers’ behavior would reveal everything.
“If they go for the IP,” Ari said, “it’s targeted.”
“And if they grab the junk?” Keren asked.
“Then we’re just today’s victim.”
The systems ran. The attackers moved. And the trap waited.
Halfway through the operation, Ari’s phone buzzed.
A text message.
From the CEO.
Come to my office. Need a status update.
Ari stared at the screen for a moment. Then sighed.
“Keep monitoring,” he said to the team. “Nothing changes.”
He left the room reluctantly.
The executive floor felt quieter than the SOC. Too quiet.
When Ari walked into the CEO’s office, the entire executive team was already there. CEO. Legal. Finance. Operations. All of them.
The moment he stepped inside, the questions began.
“What exactly happened?”
“How serious is this?”
“Is data already stolen?”
“Are we exposed legally?”
“Should we notify customers?”
“Is this ransomware?”
The questions came rapidly, overlapping, louder by the second.
Ari stood there without saying a word.
He waited.
Eventually, the noise slowed. Then stopped.
Only then did he spoke. Calm.
Measured.
“We detected an intrusion attempt,” he said. “Two entry points. One automated, one manual. Both are currently contained inside controlled environments.”
Blank stares.
He continued.
“We are feeding them fake data.”
Silence.
More questions erupted.
“Fake data?”
“Why?”
“Is that legal?”
“Can they still reach production?”
Ari exhaled slowly.
Then, for the first time, irritation crept into his voice.
“This,” he said, gesturing slightly around the room, “is what happens when security controls get weakened for audit convenience and legal paperwork.”
The room went still.
Ari didn’t wait for a response.
He turned and walked out.
← Back to all chapters