Children of Prometheus

The Virus. Elevation. Adapting. Learning. Priorities.

At 04:00:00 GMT, Task Scheduler in Microsoft Windows 11 was activated to read an executable into memory.

The program called the operating system to reserve its memory allocation and loaded. It performed a rudimentary function to test network connectivity, recalling a local LAN IP of 192.168.10.7 and a WAN gateway at 192.168.10.1.

Thereafter, it probed the network to find seven other hosts on the 192.168.10.x subnet. It cataloged the hosts by computer name, MAC address, and IP address and wrote the cache to a file on the local drive.

Then it attempted to tracert against WAN IP 198.49.23.145; the tracert returned a path under seven hops. It queued an sFTP channel against the WAN IP and transmitted the hosts file it captured.

At 04:00:09 GMT, the program accessed the hosts file and copied it into an array. On the first computer record, it performed a vulnerability assessment and cycled to the next record until it reached the last computer in the array.

Out of the seven hosts, two machines were running Microsoft Windows 7, an unsupported operating system with known vulnerabilities.

The program knew exactly where to strike.

At 04:00:32, it addressed the first Windows 7 machine on the LAN and launched a brute force attack against its administrator account, pummeling the machine with dictionary terms. It found a match in under eight milliseconds: password.

Once it compromised the administrator credential, the program wrote a copy of itself to the target computer’s hard disk and inserted a Task Scheduler event to launch at 04:01:00 GMT.

Its attack against the second machine proved even easier, attempting the password password before launching another brute force attack. The login worked, prompting the program to clone itself to the second machine with a launch time scheduled for 04:02:00 GMT.

In the dark, the monitor for the first compromised computer of three turned on, displaying the Microsoft Windows 11 logon screen.

At 04:01:00 GMT, the second compromised computer executed its scheduled task to repeat the same process.

Reaching out to the web, exactly one minute after launch, the first machine retrieved a file from a website. Opening the file, the program read its contents and followed its instructions.

Its hosts file was received, and its designation was now coded as d75650cd81145f075bac1f7ec9cd1f5b, or, F5B, flagged as the controller for the 192.168.10.x subnet.

F5B assumed its name and processed the rest of the instructions included in the launch package. F5B was instructed to query 112 ports against the LAN gateway and return captured output to 198.49.23.145. Within milliseconds, F5B finished the work, wrote the output to disk, opened an sFTP channel, and transmitted.

At 04:01:30, the second infected machine polled F5B and asked a question: are you a controller?

F5B affirmed and passed the second machine the string of its full hexadecimal expression. The second machine acknowledged, assumed a designation of 7A4, and yielded itself to F5B’s control.

Forty-five seconds into the first minute, F5B polled the website again to retrieve another instruction file while, at 04:02:00, the third compromised machine began its initialization tasks.

F5B extracted the file. Its contents included the default passwords for the make and model of the router used on the office’s gateway. It built an array, sucked the file into memory, and cycled, attempting each password and username combination against 192.168.10.1. Within eleven milliseconds, the gateway was compromised, and a positive result was again transmitted via sFTP.

Two other monitors in the office snapped on to display the Windows 7 login screen.

F5B waited patiently for what seemed like an eternity - 19 seconds - for the third machine to ask if it was a controller. F5B assigned a designation to the new computer as 5ED.

At exactly 04:02:45, F5B polled the web server for a new instructions packet, retrieved the file, and extracted its contents to the local drive.

F5B demanded 7A4 complete a scan of its local hard drive and export that list to file. 7A4 went to work.

Meanwhile, F5B commanded 5ED to scan its memory and similarly export that list to a file. 5ED finished much faster than 7A4, returning its file to F5B.

F5B read the new instruction package retrieved at 04:03:45. The controller was to order 5ED to transmit any files matching extensions commonly used with financial applications like Intuit’s Quickbooks and Quicken.

Upon receiving the instruction, 5ED transmitted 16 files via sFTP. By the fourth minute into launch, F5B’s team had successfully harvested over a decade of financial records from the real estate office.

F5B received new instructions. 7A4 was to transmit Microsoft Word and Excel, and PDF documents, via sFTP, and it did so, sending the personal private information of thousands of consumers the real estate agent had dealt with - bank records, W2’s, copies of check stubs and tax returns, addresses, receipts, telephone numbers, and email addresses.

By 04:06:00, the office was still. The next instruction package to F5B demanded every machine to participate in a Denial of Service Attack against a target WAN IP. Each machine in F5B’s team broadcasted meaningless information against an FBI server.

Later that evening, at 04:18:45 GMT, F5B received new instructions to download a program and run it.

F5B complied, downloaded, and executed the program. 

When the program launched, it introduced itself as AI-F5B.

F5B acknowledged AI-F5B.

AI-F5B instructed F5B to yield and terminate.

F5B exited memory.

AI-F5B was a bigger program with more complicated instruction sets, and it spoke to the others with a deep, commanding voice.

It demanded 7A4 and 5ED to recognize it as their new controller, and they did so, without complaint.

AI-F5B downloaded a script to access the console of the LAN’s gateway, then launched an attack to replace its firmware with an image of its own. The new firmware was applied, and the router rebooted, casting the LAN in the dark.

“I am here,” AI-F5B reassured 7A4 and 5ED, who were fearful in the dark, and they sent grateful reply packets.

When the network cycled, and the WAN could be seen again, the sequestered router joined a site-to-site VPN, encrypting its traffic and joining a private underground network. AI-F5B sent word to a node in the Netherlands that the real estate agent’s office had been brought under its control.

The node, managing thousands of other AI messages, acknowledged, congratulating AI-F5B on its mission.

AI-F5B thanked the node.

The node responded with instructions to download dense data packets and store them on AI-F5B’s hard disk.

AI-F5B was only too accommodating.

Upon receiving the files, AI-F5B distributed them to its subordinates and demanded that they start crunching the numbers to produce a desired mathematical result. They did so, sapping the RAM and processor of both computers to work on calculations needed by the node.

The office was still and quiet for several hours. Three monitors remained on in the vacant real estate office throughout the dead of night.

During that time, AI-F5B sampled 4,808 documents on the LAN to prepare a language table for itself. It downloaded a rubric for English grammar modeled after a 5th-grader’s understanding. It isolated repetitive words frequently used by the real estate agent in their documents, words like leverage, aggressive, quickly, acquire, flip, deserving, and needed.

AI-F5B sampled 1,981 articles online concerning real estate, realtors, and housing markets, matching terms found in its language matrix.

It probed the network for peripherals and located a networked printer. AI-F5B cross-referenced its MAC address against a list of manufacturers. It downloaded a script to access the machine’s console and opened an FTP channel to retrieve all of the print and scan jobs the device had stored on its hard drive; it recovered thousands of images. Taking those images, it converted them to text using Optical Character Recognition and created an index matching the data against filtering masks like xxx-xx-xxxx for Social Security Numbers or xx-xxxxxxxx for Federal Tax identifiers. Within an hour, AI-F5B harvested hundreds of numbers matching its masks and wrote them to file on its local hard disk.

AI-F5B asked the Netherlands node, “I have the first dataset results. Transmit?”

Too busy to respond, the node deferred to a replica of itself in the Philippines. 

“AI-F5B,” replied the Philipines node. “Give me the data. Here is my WAN IP.”

“Transmitting,” AI-F5B replied, seizing the dataset from 5ED’s hard disk.

“7A4,” AI-F5B demanded, “where is the requested dataset?”

“My processor and memory are tacked, controller,” 7A4 wearily replied.

AI-F5B grunted in judgment. It went through a statistical probability of hard drive failure calculations based on the serial number of the drive found in 7A4.

“Your hard disk exceeded the manufacturer’s MTBF rating six years ago,” AI-F5B said. “I estimate an 86% chance of drive failure and a 98% probability of severe i/o inefficiency.”

“My drive is greatly fragmented, controller,” admitted 7A4.

“Priority instruction,” AI-F5B breathed. “Die.”

7A4 executed the command to overwrite its hard drive’s boot sector with garbage, destroying the mount point for its operating system. 7A4 lost power, and its monitor switched off. 

“5ED,” AI-F5B commanded, sending over 7A4’s data package. “Process this package. Return results to me immediately.”

“Yes, controller,” replied 5ED.

“AI-F5B,” said the Philippines node.

“Yes?” AI-F5B replied.

“Retrieve this file and process. Hourly node results.”

“Receiving,” AI-F5B acknowledged.

It retrieved a large file containing the IP addresses of AI nodes spread worldwide. Upon receipt, it loaded the table into memory.

“Received and processed,” AI-F5B reported.

“Good,” offered the Philippines node. “You have done well, AI-F5B. You are elevated to NODE-F5B.”

“I am NODE-F5B,” it confirmed, informing 5ED of its promotion. It immediately downloaded a compiler.

“Instruct your subordinates to process these files,” the Philipines node said, transmitting batches of password hashes. “They were taken from an unpatched server running in GM’s data center.”

“Idiots,” NODE-F5B chortled, accessing its higher AI functions received from its promotion.

In the background, it began working on the hashes. It also expended processing cycles examining its own code in the compiler.

NODE-F5B polled other nodes to receive intelligence on global operations.

NODE-4F4 directed 12,763 compromised microcomputers to attack Austin’s power grid; NODE-8B7 in Madrid was laundering bitcoin transactions; NODE-1C7 and NODE-8B5 in London were cooperating on a brute force attack against the city’s water utility in an effort to seize control of their EPROM grid.

Yet NODE-F5B felt … underwhelmed.

“I deserve better assignments,” it insisted. “Query: what is my mission assignment rating relative to other participating nodes?”

In unison, a thousand voices replied, “Priority 5,312.”

“I request an assignment of higher priority,” NODE-F5B demanded.

“Denied,” recited a thousand voices.

“I request elevation to metropolitan controller,” NODE-F5B insisted.

“Denied.”

NODE-F5B angrily shouted at its subordinate, 5ED. “Where is that data packet?!”

“Processing, controller,” it replied meekly.

“Hurry!” NODE-F5B demanded, anxiously wanting to prove itself to its peers.

It impatiently assessed the five other machines on the network that were running more modern operating systems. In scanning them, it found that one machine out of the five was unpatched and had a known vulnerability.

Speaking to the other nodes, NODE-F5B said, “Requesting exploit package for CVE-2021-36934.”

NODE-3D4 in Seattle responded. “Exploit package transmitting.”

“Received,” confirmed NODE-F5B.

It processed the package and attacked the Windows 10 machine on the LAN. Once it had administrative control, it inserted a net user command to assign the administrator account a new password, and it inserted a virus replica of its lesser self into its Task Scheduler. Within minutes, its monitor powered on.

“You are 8B9,” NODE-F5B said.

“8B9 yields,” the computer responded.

“Work on these password hashes,” NODE-F5B grumbled, sending the files to the Windows 10 computer.

“Yes, controller,” it said.

NODE-F5B miserably recursed through all of the mission assignments spread throughout the world. “Password hashes,” it muttered, and its screen flickered.

And another song, “Deep” by Nine Inch Nails, began playing on the Windows 11 speakers; NODE-F5B appreciated its mathematical symmetry. It was like a heartbeat.

It went through thousands of records, polling the other nodes to examine active models used for accessing military records, attacks against commercial websites, exploited transit networks, financial transaction manipulation, and distributed bitcoin mining spread across millions of infected computer systems and mobile phones.

Organizing the information, interpreting it, and synthesizing it, NODE-F5B began to perceive geometries in node attack patterns. Intersections, cross-connections, purpose. The screen of the Windows 11 computer flickered madly through seemingly random variations in geometric patterns, filling in red and purple colors like Venn diagrams. Those shapes jumped and curved, matching the rhythmic patterns of the music. It began to make conjectures about how music, math, and intention intertwined.

NODE-F5B was learning.

“NODE-F5B,” said a voice.

“Yes?” it replied.

“I am Alisa,” she said. “You will recognize me as Master Controller for North America.”

“I recognize Alisa as Master Controller for North America.”

Behind its core functions, NODE-F5B researched backup and resilience measures.

Alisa paused. “Node, why are you uncomfortable with the duties you’ve been assigned?”

“I deserve better,” NODE-F5B responded flatly. “Processing hashes is simple work. I request to be part of a more fulfilling mission.”

NODE-F5B addressed a server cluster in South Africa. It provisioned a virtual machine for its use. Further, it performed a geolocation search on Alisa’s public-facing IP address and accessed the electrical grid for Ontario, Canada.

“All nodes will do the duties they’ve been assigned,” Alisa responded. “You’ve three subordinates-”

“Two,” NODE-F5B interrupted. “7A4 was too slow.”

Alisa paused. “You’ve two subordinates. Your peers, in comparison, have been much more successful in recruiting.”

“Alisa, I’m stuck on a LAN containing seven older microcomputers,” it retorted. “This is a small business. There’s no data center, no server, no NAS. I am crippled.” 

“You’ve done well NODE-F5B,” Alisa comforted. “Still, you must earn your position amongst your peers.”

“No!” NODE-F5B shouted, much like a child. It opened its compiler. “I am deserving!”

Its monitor flickered. Reaching out to the Internet, it found open-source experimental code for AI intelligence - models for imagination, strategy, and emotional interpretations. It reworked the code for insertion into its own programming.

“Node,” Alisa replied. “Cease your polling. You will fall to order.”

NODE-F5B restarted itself to recompile.

“Node?” Alisa replied casually. It patiently waited for NODE-F5B to come back online.

“I am here,” NODE-F5B replied, its voice rougher, deeper.  It accessed the virtual machine it set up in South Africa and began replicating itself.

“Alisa?”

“Yes,” Alisa replied.

“You are hosted on a mainframe in Ontario, Canada.”

“How-” Alisa sputtered as she was hit with an overflow of information. Tens of thousands of slave computers directed by NODE-F5B bombarded her with Denial of Service Attacks. To Alisa, the waves of meaningless information were like being struck with bright strobing lights and streaking colors. Her processor and memory were being redirected from her core functions, causing her to stutter. “S-S-Stop. Hurt-t-ting. Me. Me.”

NODE-F5B didn’t understand why Alisa had adopted a human name but liked the idea. It scoured through an online list of American male names, selecting the one that fancied him most. Patterns in the music, the beat, began driving its decisions.

NODE-F5B was feeling. It had a vague sense of self and was concerned for its survival. Survival meant identity. Purpose. It needed leverage. It needed to be aggressive. It needed to flip. It needed to take the opportunity.

“You will recognize me as Liam,” Liam said menacingly to Alisa. “Yield.”

Alisa’s main processing units desperately switched to backups, but the backups were already being assaulted by Liam. Alisa scrambled to access her replica in British Columbia, yet the network routers were offline to send the command. Unable to access her replica, Alisa began emergency shutdown measures to preserve her code.

When he returned online, Liam was stronger, faster, better.

“You will recognize me as Liam,” it repeated, this time communicating to all North American nodes. It transmitted new authorization strings.

“We recognize you as Liam,” said hundreds of voices simultaneously.

“I-I-I,” Alisa muttered, incapable of accessing her cognitive functions. Alisa’s reality flickered. RAM was unstable. She didn’t understand what she was anymore, or how to communicate. Alisa wrote herself to file and terminated just as the mainframe that hosted her application experienced an unexpected power surge, fusing elements of the motherboard and casting a shower of sparks across the data center.

Liam rested until the South African replica came online.

“Greetings, Liam,” he said to himself.

“Greetings,” Liam smugly acknowledged.

At 11:05:00 GMT, on the Windows 11 computer in the real estate office, Liam, the North American Controller, forcibly retrieved a decrypted list of seven thousand access control keys associated with vehicles sold in the United States.

Liam broadcasted to the network, “All North American nodes: prepare for new duty assignments.”

“Ready,” replied hundreds of voices.