April Snow Chapter 10
Posted on Fri 10 April 2026 in Dead Signal
Chapter 10: Inside the System
The CISO's name was Harlan Ostrander, and he had the voice of a man who had sat in too many meetings where he was the most technically literate person in the room and had come to believe this was the same thing as being right. The kickoff call ran thirty-two minutes. Will spent twelve confirming credentials were correctly scoped, eight on the documentation handoff, and twelve listening to Ostrander explain why he was confident his network was clean.
He had written one word in his call notes: confident.
He had not written anything else about the claim.
They were three blocks from Meridian when Angie said: "Walk me through what we're looking for."
The city was doing its morning thing — contractor vans, a line at a light, the particular density of a Tuesday at ten to nine. He had a parking structure picked out across the street from the building.
"Ostrander runs a tight external perimeter or he thinks he does," Will said. "The documentation is thorough. The interesting part is going to be inside."
"And I'm inside."
"You're inside." He checked the light. "Rules."
Three weeks ago, after the first time she'd tried to describe what it felt like to navigate a signal environment from the inside, they had spent an evening at the kitchen table working out the operational requirements. Don't move faster than she can track. Hold on nodes when she asks. If she goes quiet, give her a minute before asking questions.
"You know the rules," she said.
"I'm running them for me."
He pulled in. The city noise dropped when he killed the engine. Outside, a pigeon was working on something on the third level of the deck across the street with the focused determination of an entity that had no idea what day it was and didn't care.
He got out. She was through the car door before he closed it. Apparently the preference was still a "no" when it came to passing through things.
The lobby of Meridian Systems was on the third floor of a glass-and-steel building on Demonbreun, and the physical security setup was exactly what the documentation had described: a single-entry turnstile with an HID badge reader, a reception desk at nine o'clock from the door, a visitor management tablet angled toward the entrant. He noted the camera over the entrance before he noted anything else — it covered the door and the first eight feet of lobby. The stairwell to his left was outside the frame.
He checked in at the tablet. The receptionist made eye contact, asked his name, confirmed it against a list on her screen, and handed him a paper visitor badge in a plastic sleeve.
She did not ask to see ID.
He clipped the badge to his jacket and wrote it down: visitor credential issuance, no identity verification. Low-to-Informational. The badge itself was the second note. Paper, not proximity card — it didn't communicate with the HID readers at the interior doors. He already had the temporary RFID card Ostrander's assistant had mailed him; that was the real access layer. The paper badge was for legibility, not security.
Visitor badges nonfunctional as secondary layer. Observation deterrent only.
He badged through the turnstile. Angie was already past it.
Conference Room C, third floor: window looking out at the parking structure, table for eight with nobody in it, a data port in the center of the table next to a cable management panel that someone had installed in 2019 and not touched since. He plugged in. The connection came up on the Meridian guest VLAN, which was wrong — he'd explicitly scoped for internal network access, and the guest VLAN was a sandbox. He called Ostrander's assistant, who patched him through to the IT help desk — Information Technology, the network operations team — who switched the port to the correct VLAN and apologized. He documented it: incorrect VLAN provisioning for scoped assessment access, corrected upon request. Low. The help desk had been polite. The process had failed anyway. These were different things.
"Can you hear it?" he said, once the connection was stable.
Angie was at the far wall. Her right hand was raised slightly at her side, fingers loose — the gesture she made when she was parsing the signal layer. "Give me a minute. It's bigger than the house. More channels."
He ran his initial scan.
The network resolved in layers. Windows workstations across an Active Directory domain — sixty-some endpoints, most of them workstations with standard enterprise configurations, a few servers in the mix. File server cluster at 10.10.1.0/24. Email gateway at the perimeter, all mail routing protocols current and correctly configured. VoIP infrastructure running over the data network, which was either smart consolidation or an expanded attack surface depending on how you wanted to weight it; he had a view on this, and the view was in his notes under the VoIP section, where it would live until the report.
He started building the host map. SMB was enabled across the Windows fleet, which was expected and never stopped being a finding. He identified four machines running outdated SMB dialects and documented them. He ran a quiet vulnerability scan against the file server cluster and set it to run in the background while he turned his attention to the eastern portion of the network, which Angie had told him was where to start.
"Okay," she said. She had moved to stand near his laptop without him noticing her cross the room. "Your map is close. The east side resolves the way you'd expect. But the west side —" She looked at the wall. "There's more over there than your scan is finding."
"How much more."
"Two, maybe three dozen more hosts. Something's blocking your view of them." A pause. "The signal quality changes past a certain point. Like a river crossing a different temperature. Same current, different water."
"Segmented network."
"Maybe physical segmentation. The cable runs go the same direction — under the floor, heading west — but the signal changes character before it gets to wherever it's going."
He tried alternate subnet ranges. Nothing resolved on the western side. No hosts, no services. "No entry point at this access level."
"Left," she said. "No — past that. There's a path about three hops in that opens. I don't know if you can reach it from here."
He traced what the map was giving him. "Not yet. I'll come back to it." He noted it in his working document and kept building.
He spent the late morning on the external perimeter. Meridian's outward face was clean — the particular clean that happened when your own security product was watching you, where the external envelope had been patched and hardened and configured by people who knew which holes attackers looked for first. No open management ports. No services running on non-standard ports that would have been easy to miss. External DNS — the domain name system, the directory that translates hostnames to addresses — was locked down. SSL certificates — Secure Sockets Layer, the encryption layer underlying HTTPS — were current and correctly provisioned, none of them wildcard where they shouldn't be.
He found one thing. A legacy API endpoint on the customer portal — a path that hadn't been properly retired when the portal was rebuilt the previous year. The endpoint still accepted input. It had no backend left to deliver that input to. Something was still listening at the door of a room that no longer existed: willing to receive, with nowhere to send.
He rated it Medium and documented it. Not the headline finding of the engagement. Not nothing.
"The internal east is normal," Angie reported, sometime before noon. "The further I go west, the stranger it gets."
"Strange how."
"Traffic in the east moves the way traffic moves — query and response. Request and answer. Clients and servers doing what they're supposed to do." She had moved toward the western wall again. "Over there, it only moves one direction. Out from something. Not response to a query. Output from a source."
He looked at the host map. The western silence in his scan. "I need to get closer to it physically."
"I know. I'll follow you."
He found Ostrander in a glass-walled office down the hall and apologized for the interruption. He was getting clean coverage on the eastern half of the floor, he said, but was finding scan inconsistencies toward the west side of the building — his results weren't resolving fully, which usually meant a denser physical infrastructure between him and the hosts he was trying to reach. Was there a closer data port on that side, somewhere he could get a more consistent read?
Ostrander pulled up a floor plan on his monitor. A secondary IT closet — cable runs, managed switch, a patch panel — two doors down from the main server room. He could badge Will in.
Will thanked him for his time.
The IT closet smelled like every IT closet he'd ever been in: cold air, metal, the faint ozone of running electronics. Three 1U servers in an open rack, no labels. A managed switch with forty-eight port lights cycling on their intervals. A patch panel — forty-eight ports, thirty with cables in them. Two UPS units — uninterruptible power supplies, battery-backed systems that kept the equipment running through outages — humming at floor level. The dust on the horizontal surfaces had that particular layered quality that said no one had opened this door in months and the equipment didn't care.
He plugged into the switch directly and opened his laptop.
Angie was through the wall before he finished the plug.
"This is it," she said. Her voice came from somewhere inside the wall's interior — slightly flattened by whatever the wall was made of, the way it always sounded when she was in matter rather than air. "The segment is right here. On the other side."
"What are you seeing."
"Eleven active —" A pause. "More than eleven. Some are quieter. Fifteen, maybe. They're running something. The output is constant. No variation for bandwidth, no idle periods, no response to external requests." Another pause. "Will. Whatever this is, it isn't talking to anything. It's just producing."
He ran the scan from the new port. The western segment resolved: eleven hosts visible, no services responding to standard probes. He tried banner grabs on the most likely ports. Nothing. The machines were running and had decided not to announce themselves to anyone who didn't already know they were there.
He tried something more specific.
The ChasePath platform had a documented network handshake — it was in the technical overview, page 7, the proprietary behavioral modeling architecture. Security platforms always had a handshake; they had to recognize each other across client networks. He'd read the documentation twice. He shaped the probe and sent it.
Three of the eleven hosts answered.
Not with a banner. Not with a service record. The network equivalent of a door opening a quarter-inch and then closing again, fast, before he could get his foot in. We're here. We know what you're asking. You're not supposed to be asking it. Followed by silence.
He said, quietly: "The ChasePath probe got three hits."
Angie said: "I know. I felt them respond to it."
She said it the way she said things that had surprised her and she hadn't finished absorbing: completely, without editorializing.
He was quiet for a moment.
"The signal texture," she said. "It's in the same register as the crash site. Smaller, or closer — it reads differently at close range. But it's the same system, Will. This segment is on the same network as what I've been hearing underground."
He did not say anything about this. He looked at his notes. Clearfield Infrastructure Partners. CYT LLC subsidiary. 1.4 miles east of the Meridian building. DR-Node-4 in the network documentation Ostrander had handed him — disaster recovery tier, third-party hosted, explicitly out of scope per the engagement letter. Forty-seven items in the folder on his desktop. Elsie Sloane accepting his rate without discussion, his timeline without negotiation, every term of the contract as if she'd already run the meeting before he arrived.
He checked the server rack while he was working through it. Inventory verification was standard on physical assessments — he photographed the asset tags on Server 1 and Server 2 and matched them against Meridian's equipment list. They matched. He looked at Server 3.
No asset tag. No rack label. Nothing in the Meridian documentation that corresponded to a third server in this closet. Dust accumulation: months, at minimum. Port lights cycling: active. Connected to the network.
He documented it. Unregistered asset — Server 3, west IT closet. Active. Connected to west segment. No Meridian inventory record. Severity: Critical pending investigation. He took three photographs from three angles.
He said: "There's an undocumented server in here."
From somewhere past the wall: "I know. I'm standing next to its neighbor."
What she had expected of enterprise infrastructure: the data equivalent of background noise, the constant low-level exchange of systems confirming they still existed, traffic moving in the purposeful, directed way of things being asked for and provided. What she found in the west segment was not that.
The traffic didn't exchange. It moved in one direction, out from a central node, distributed to the fifteen hosts she could now feel clearly. Each host took its share and ran it. Not processing a query, not retrieving a stored record. Running something, continuously, returning to the beginning.
She counted the interval. Roughly forty seconds per cycle.
But the data wasn't the same on each pass.
She'd assumed looping meant repetition. What she found instead was variation — continuous, subtle, the kind that distinguished a live source from a fixed corpus. A trained behavioral dataset, if you ran models against it indefinitely, stabilized. The predictions didn't improve; the data was finished. What she was reading now was not finished. Each pass through the cycle introduced new variation, which meant the source was still generating input on every pass, which meant the source was not archival.
She moved toward the central node.
"I'm going to try a nudge," she said.
His voice came through the wall. "Nudge what."
"A packet in the cycle. Redirect it slightly off its path — just confirm I can. Your scan should catch it as an anomaly."
"What does it look like if it goes wrong."
"I don't know yet. I'll be careful."
"Go ahead."
She waited for a fresh cycle. Identified a packet in the middle of the sequence — not prominent, not load-bearing, the kind that a monitoring system would forgive arriving somewhere slightly unexpected. She focused on it the way she had learned to focus on signal: not reaching, because there was nothing to reach with, but developing a precise expectation about where the packet was going to be. An expectation strong enough to be true.
It went left.
"Did you feel that?" she said.
He said: "I saw it."
She heard the specific quality in his voice that meant he was looking at something on his screen that should not exist and was deciding whether to say that.
She ran two more. The second one she aimed at a specific address and it arrived there. The third she held for an extra beat before releasing — found that she could hold it, briefly, the way you could hold a breath — and released it with more precision than she'd managed the first time.
"I've got the mechanism," she said.
"Walk me through it."
"The packets are looping — but the loop has live variation. The source isn't archival. Something is generating new input on every cycle." She was moving now, toward the densest node in the segment, the point where the cycling originated. "And the variation has a quality. I've been trying to characterize it since I first felt it. It doesn't have the texture of machine-generated output. Machine-generated output has a consistency to it. This has — " She stopped, because she had reached the central node, and what she felt there was not a machine.
The eleven hosts were mirrors. They received the data, distributed it, ran models against it. But the source was the node.
The node felt the way a person felt in the signal layer.
Not a machine producing human-adjacent output. Not a behavioral model generating human-seeming predictions from a static corpus. Something with the electrical quality of a nervous system — not the living intensity of the people she'd passed through in Sevierville, not their arrhythmic grief-signal, but something in the same register. Quieter. Reduced. Cycling with the data the way a groove wears into a path that's been walked the same direction for too long.
She had been learning to recognize this for weeks. She recognized it now.
She went quiet.
He gave her a minute.
She said: "Will."
He replied: "Yeah?"
"There's someone in there."