You pick up your phone and call Dane. The line connects before the first ring finishes. "Let me guess," Dane’s voice is dry. "Mango terrifies you?" "No," you lie. "I just feel comfortable speaking with you about the job." "Fair enough. You’ll get the full brief soon, but first, what’s your plan? And the target?" "Blackridge Capital." The name alone twists your stomach. Your heart sinks. "Old friends of yours." You can *hear* Dane’s smirk. "We need access to deploy our ransomware, clean, effective. What’ve you got?" You scan your cramped room, the walls closing in. "I don’t have direct access to their systems," you admit. "But I’ve seen the names, **Isabella Laurent**, **Marc Dubois**, in the emails I handle. They’re high-value targets. If we can get to them, we can get to Blackridge." *See [[Glossary#Spear Phishing]] for details.* "Sounds smart." Dane’s tone shifts, all business now. "I’ll talk to Mango. You’ll get clearance soon." The line goes dead. Ten minutes later, your inbox pings. The brief is there. You slurp noodles straight from the pot, the salty broth burning your throat. It’ll have to last until tomorrow. The money from this job isn’t just a payday, it’s a lifeline. The mission aligns with your discussion: the Cell wants to hit Blackridge Capital, a listed investment firm, $3 billion in assets, mostly equity. But to you, Blackridge isn’t just a firm. It’s the devil. The brief lays it out in plain language, the kind of plain that means someone has done this before: > **Objective:** Deploy ransomware to freeze Blackridge’s Portfolio Risk and Authorisation Platform (PRAP). Time the attack during a market downturn, ideally when their pharmaceutical-heavy portfolio is already under pressure. With PRAP locked, Blackridge cannot authorise margin call responses or rebalance positions. The lender demands collateral. Blackridge pays the ransom to regain access, or collapses trying to stall. > > **Your role:** Initial Access Broker. Social Engineer. Blackridge's security filters out the low-tech, all-rounder spam easily. We need a high-tech, bespoke spear-phishing campaign. Build trust, create personas, manipulate timing. Open the door. Mango's rented infrastructure and encryptors (the technical team) handle the rest. Whoever assembled the brief did their homework. They’ve included spear-phishing options, employee names. Two stand out. You’ve seen their names in emails, but that’s all you know. First, **Isabella Laurent**, her name appears in high-priority threads. She must be someone important. If you can make her *your* puppet, you’ll have access to a goldmine of company data. Then there’s **Marc Dubois**, another name from the emails. Nobody seems to know much about him. If he disappeared tomorrow, he’d be replaced by lunch. That makes him *perfect* for intelligence gathering. He won't have the keys to the kingdom, but he'll know where they're kept. Isabella and Marc sit at opposite ends of the same scale. Both offer advantages. Both come with risks. Chasing both is unrealistic. You must choose: **one spear-phishing target**. [[Cybercrime/The_Phisherman/Opening Echo Dane|Choose your spear-phishing target]]