Leo’s blood went cold. Door 47B was on the test bench’s floor. But the test bench wasn’t connected to the live system.

At 3:11 AM, his director’s email auto-replied: Out of office until Monday. Leo stared at the blinking red light on Door 47B—now permanently unlocked—and realized the scariest part of the story wasn’t the malware.

He checked the panel logs. The flash had completed at 2:58 AM. At 3:01 AM, an SSH session had opened from an IP address in Minsk. At 3:02 AM, a command had been issued: enable_ghost_mode –all_doors . At 3:03 AM, the same IP had downloaded the entire employee database—names, badge IDs, fingerprint templates.

It was real.

It was that somewhere, someone was already inside. And they hadn’t left yet.