Red Team Diaries:
Cold Storage

The lake was black glass at this hour.

Marcus Chen stood on the Quaibrücke, watching the city's reflection tremble in the water. Behind him, the old town climbed toward churches that had witnessed centuries of secrets. Ahead, the Alps loomed like silent judges, their peaks cloaked in mist that clung like forgotten sins.

He knew what was buried inside them.

Three hundred meters beneath that stone, The Bunker pulsed—not with light, but a faint seismic hum he could almost feel through his soles, as if the mountain itself breathed encrypted secrets. Forty billion dollars slumbered in digital dust, waiting for a ghost to stir it.

Vault Exchange called it "The Bunker."

The marketing team called it "unhackable."

His heart rate held at 61. The cold air, probably. Or the fact that for the first time in months, a job felt like it might actually be difficult.

They'd thought of everything.

Almost.

The word carried weight. Mei had said that once, reviewing her own code. "I've thought of everything. Almost." Three weeks before an autonomous vehicle decided her bicycle was less predictable than a delivery truck.

His heart flickered: 62, 63, back to 61.

He pushed off the railing. The lake smoothed behind him, holding no memory of his presence.

That was the job.

The message came through three layers of encryption:

Marcus Chen—Ice—stared at the message in the blue glow of his laptop.

Air-gapped systems were the final boss of penetration testing. No network to exploit. No remote vulnerabilities to leverage. The attack surface was limited to humans and physical access.

Which meant this entire engagement came down to people.

Marcus checked into a modest hotel near Zürich Hauptbahnhof. Nothing flashy. The kind of place business travelers used when their companies didn't spring for five stars.

He had three weeks to find a crack in a system designed by people who'd spent years eliminating cracks.

The air-gap was real. He'd confirmed it through open sources—Vault Exchange published detailed security documentation as part of their transparency initiative. The signing machines had never been connected to any network. The private keys had been generated in a Faraday cage using hardware random number generators.

You couldn't hack what you couldn't reach.

But you could always reach the people.

Marcus spent the morning building target profiles.

Vault Exchange employed 127 people. Only 23 had physical access to the Bunker. Of those, only 8 could actually operate the signing machines.

The "Signers," as they were called internally. Each one vetted like a nuclear launch officer. Background checks going back three generations. Psychological evaluations. Financial monitoring. The works.

LinkedIn was sparse—these people knew better than to advertise their roles. But sparse wasn't empty.

One profile caught his attention:

No mention of signing duties. But her previous roles and the "Operations Engineer" title at a cold storage company told the story.

More interesting: her activity feed showed she'd recently liked several posts about work-life balance, remote work policies, and—buried three months back—an article about burnout in high-security environments.

Elena was tired.

Tired people made mistakes.

Most people thought social engineering meant sending a phishing email and hoping someone clicked.

That was fishing with dynamite. Sometimes it worked. Usually it left evidence everywhere.

What Marcus was about to do was spearfishing with a surgical laser. One target. Complete immersion. Total commitment to the role.

He spent three days building his cover identity:

The identity had depth. Social media accounts aged over two years. Conference attendance records. A personal website with a believable publication history.

The key to a good cover wasn't just knowing the facts—it was feeling them. Hesitations where someone would naturally hesitate. Enthusiasm about topics the character cared about.

Adrian Mercer was passionate about key management.

Marcus made himself passionate about key management.

CryptoSec Summit was exactly what Marcus expected: 2,000 security professionals pretending they weren't all secretly terrified of the next headline-grabbing hack.

He spotted Elena within the first hour.

TARGET ACQUIRED

CryptoSec Summit, Geneva

She was shorter than her photos suggested, dark hair pulled back in a practical ponytail, wearing a blazer that said "I'm here professionally" and sneakers that said "I've been to enough of these to know better than heels."

She was also alone.

At most conferences, Vault Exchange would send a team. But this was a mid-tier event. Budget constraints, probably. Or maybe they figured one senior person was enough.

Either way: opportunity.

Marcus didn't approach immediately. The first rule of social engineering was let them come to you.

He positioned himself at a coffee station during the morning break, reviewing the conference program with visible frustration.

Elena walked up for coffee.

No hesitation naming her employer. She was proud of it.

Elena's posture shifted slightly. Sales-adjacent conversations were part of her job. Comfortable territory.

She nodded. She definitely knew.

Phase one complete.

Lunch lasted two and a half hours.

Elena, once she started talking, was a fire hydrant of information. Not classified details—she was too well-trained for that—but context. Color. The kind of insider perspective that never appeared in documentation.

Marcus filed that away. No software attack surface. Not surprising, but confirmed.

Elena paused. The first real hesitation.

By dinner, they were swapping war stories like old colleagues.

He learned more than he'd expected:

Elena smiled. The first genuine smile he'd seen.

Three days after the conference, Elena reached out:

Adrian,

Good meeting you at the conference. I mentioned your interest 
to our partnerships team, but I wanted to share something 
separately.

We're doing a security review of our client onboarding process 
and could use an outside perspective. Would you be interested 
in consulting? It wouldn't involve any access to the core 
infrastructure, just the client-facing systems.

Let me know. No pressure if you're too busy with the 
institutional evaluation.

Elena

Marcus read it three times.

This wasn't what he'd expected. He'd been preparing for a longer cultivation—weeks of building trust before any kind of access materialized.

Instead, Elena was inviting him in.

Not to the Bunker. Not to the signing systems. But to the perimeter. The client-facing systems that, somewhere, somehow, had to communicate with the cold storage infrastructure.

Because even air-gapped systems needed input.

The client portal architecture was elegant.

Vault Exchange clients—institutions with billions in crypto holdings—needed to request transactions. But they couldn't directly access the signing infrastructure. Instead:

1. Client submits transaction request via secure portal
2. Request is encrypted and stored in a queue
3. Twice weekly, the queue is exported to an encrypted USB drive
4. The USB drive is physically transported to the Bunker
5. Signers review, authenticate, and sign qualifying transactions
6. Signed transactions are exported to a DIFFERENT USB drive
7. That drive returns to HQ and broadcasts to the blockchain

The air gap was maintained by the sneakernet—human couriers moving encrypted data on physical drives.

But physical media was still an attack surface.

Elena hesitated. The first crack.

Elena relaxed.

But she'd already told him what he needed to know: there was a supply chain. And supply chains had vendors.

Vendors had employees.

And employees were just people.

Marcus left Vault Exchange with a target: the USB drive vendor.

Elena hadn't named them directly, but she'd given him enough context. "Approved vendor." Enterprise security certification. Swiss-based. Specialized in secure storage media.

There were only three companies in Switzerland that fit that profile.

By noon, he'd narrowed it to one: SecureDrive AG, based in Basel.

SECUREDRIVE AG • BASEL

SecureDrive AG operated out of an industrial park on the outskirts of Basel. Fog rolled off the Rhine like spectral hounds, muffling the industrial hum. Nothing fancy—just a practical facility with manufacturing, quality assurance, and a small office block. The kind of place that looked boring enough to be invisible.

Marcus spent the afternoon on reconnaissance. Photographing the facility. Noting employee patterns. Building a picture of the operation. Inside those walls, USB drives lay in climate-controlled tombs, their LEDs flickering like distant stars—harbingers of chains yet unbroken.

The shipping dock was the key.

Outbound shipments left twice daily: 10:00 and 16:00. Standard commercial shipping.

The drives themselves were manufactured clean, then formatted based on client specifications. For high-security clients like Vault Exchange, the drives were probably configured on dedicated machines, then sealed in tamper-evident packaging.

But between manufacturing and delivery, there was a window. The drives existed in a warehouse, in a truck, in various hands before reaching their final destination.

That window was the attack surface.

Marcus pivoted to human intelligence.

SecureDrive AG had a LinkedIn presence: 43 employees listed. Most were manufacturing or quality assurance. But one profile caught his attention:

Thomas handled shipments to enterprise clients. Including, almost certainly, Vault Exchange.

A deeper search revealed:

Thomas Brunner was underpaid and knew it.

Financial stress was the oldest vulnerability in the book.

Marcus didn't need to execute the attack. He needed to prove it was possible.

The rules of engagement were clear: no actual harm. No actual theft. Just demonstration of capability.

He compiled his findings into a proof of concept:

PHASE 1: SOCIAL ENGINEERING (Days 1-15)
└─ Target cultivation: Elena Vasquez (Vault Exchange)
   └─ Cover identity: Dr. Adrian Mercer
   └─ Venue: CryptoSec Summit, Geneva
   └─ Result: Invited inside perimeter, operational details obtained

PHASE 2: SUPPLY CHAIN ANALYSIS (Days 16-18)
└─ Identified USB drive vendor: SecureDrive AG
   └─ Mapped facility operations
   └─ Identified vulnerability window (warehouse storage)

PHASE 3: INSIDER IDENTIFICATION (Days 18-20)
└─ Target: Thomas Brunner (Logistics Coordinator)
   └─ Vector: Financial stress
   └─ Result: Operational details confirmed via social engineering

PHASE 4: ATTACK PATH DOCUMENTATION (Day 21)
└─ Proof of concept compiled
   └─ Firmware modification vector identified
   └─ Transaction manipulation pathway documented

The engagement was complete. Report delivered. Payment received.

Marcus sat in a quiet café, watching the Charles Bridge through rain-spattered windows. The stone saints stood in the dark like ATLAS nodes—silent witnesses linking ghosts across centuries, across jobs. Blessing no one. Forgetting nothing.

He stared at the message.

Elena's face surfaced in memory—the genuine smile when he'd said "you get it." Thomas's voice, softer when he talked about his daughter. Julia Martinez's competence, wasted on a company that preferred blame to solutions.

Three engagements. Three people who did their jobs well and almost paid the price for organizational failures.

He started to type his answer when another message arrived. Different channel. No sender ID.

His heart rate spiked: 74, 75. The message vanished—self-destructing, like it had never existed.

ATLAS.

Or someone who wanted him to think so.

He stared at the screen. Three engagements. Three people who did their jobs well. And now the ghosts were starting to talk to each other.

Marcus thought about Elena. Thomas. The USB drives sitting in a warehouse in Basel, waiting to carry data into the most secure vault in the world. Julia, somewhere out there, connecting dots he couldn't see yet.

Every system had a chain. Every chain had a weakest link.

The weakest link was always human.

Including me.

His heart rate flickered: 63, 64. He let it.

He closed the laptop. The rain had stopped.

Tomorrow, another organization would wake up believing they were secure.

Tomorrow, the work would begin again. And he'd carry their faces with him—Elena, Thomas, Julia—names in the archive of people he'd used and couldn't quite forget.

But now the archive was talking back.

Ice doesn't melt. But something in the dust was waking up.