For the first time, the pieces on the board stop feeling like guesswork and start feeling like a plan you can explain out loud. **The evidence on the board:** <details> <summary>The intern trail</summary> <p><strong>The intern trail:</strong> A former Blackridge intern posted on social media about "delayed gratification" and "the second marshmallow," apparently quoting something Isabella said during a team meeting. The intern used it admiringly, but the implication is clear: Isabella waits through risk alerts the way someone waits for a marshmallow experiment to pay off. She bets that patience will be rewarded, and she pauses the system to give herself time.</p> </details> <details> <summary>Marc's complaints</summary> <p><strong>Marc's complaints:</strong> Marc Dubois, the trader, has complained that positions he flagged as dangerous sat in "observation hold" for far longer than they should have. He did not know why. Now you do: Isabella was holding the escalation.</p> </details> <details> <summary>The annual report footnote</summary> <p><strong>The annual report footnote:</strong> Blackridge's own annual report contains a footnote about "non-standard observation periods." In plain English, this means someone with authority delayed the normal alert process on multiple occasions during the past fiscal year.</p> </details> <details> <summary>The compliance memo</summary> <p><strong>The compliance memo:</strong> A cached compliance memo warned that repeated non-standard holds can create a misleading picture of how quickly the firm responds to risk. The memo's language was careful and polite, which tells you someone important was being protected from blame.</p> </details> <details> <summary>The silent-alert ticket</summary> <p><strong>The silent-alert ticket:</strong> A support ticket from Blackridge's IT system shows that a PRAP alert was suppressed (put into "silent" mode) during a market dip. The alert should have gone to the risk committee. It did not.</p> </details> <details> <summary>The missing escalation email</summary> <p><strong>The missing escalation email:</strong> An alert entered "observation hold" in PRAP, and the system did not send the required escalation email to senior management. Thirty minutes later, the market recovered, and no one noticed the gap.</p> </details> Here is what you can now tell Mango in plain language: **The firm's weakness:** Blackridge borrows heavily to amplify its stock bets (this is called "leverage"). Their lender (the prime broker) has strict rules: if Blackridge's portfolio drops below a certain value, the lender demands more collateral immediately. This is a margin call. Blackridge has to respond within hours, or the lender starts selling off their positions by force. **Isabella's habit:** When the PRAP system detects that Blackridge is approaching a margin call, it is supposed to escalate the alert to senior management automatically. Isabella has the authority to place a "hold" on that escalation. She does this when she believes the market will recover on its own. She waits. Sometimes she is right and no one notices the delay. But every time she waits, there is a window where the firm is exposed and nobody above her knows about it. **Your attack window:** If you can time the ransomware deployment to hit PRAP during one of Isabella's holds, the firm will be completely paralyzed. The PRAP system will be locked. Isabella will not be able to lift the hold. The lender's margin call clock will keep ticking. Blackridge will have no way to respond, and they will have to pay whatever the cell demands to get PRAP back online before the lender liquidates their entire portfolio. You are no longer improvising on empty air. You have a target, a timeline, and a vulnerability. It's time to craft the bait to reel in Isabella or Marc... [[Cybercrime/The_Phisherman/Assemble The Malware Payload|Assemble the lure, your Malware payload!]].