Pax didn’t sleep that night.
He lay in his basement, staring at the ceiling, the dark shapes of his projects looming around him like ghosts. Every time he closed his eyes, he saw the ventilator on his dashboard. The traffic light controllers. The list of critical infrastructure that the Puppeteer had turned into puppets.
Around 2 AM, he got up and ran another scan on his laptop. The malware was still there—dormant now, because the battery was at fifteen percent and the geofence had paused it. But it was waiting. Watching.
He could remove it. Nova’s toolkit had a cleaner. But if he removed it, the Puppeteer would know something was wrong. Better to leave it in place, let the Puppeteer think he was still in the dark.
Pax hated that logic. Hated the idea of leaving a thief in his own house, even a digital one. But Nova was right about one thing: paranoid was the baseline.
He finally fell asleep around 4 AM, fully dressed, his phone clutched in his hand.
The alarm went off at 6:15. He’d never been so tired in his life.
Scene 1: Marcus Confrontation
Pax got to school early again, but this time he wasn’t alone. Nova was waiting for him in the parking lot, leaning against a battered minivan that had definitely seen better days. She was drinking something from a thermos that smelled like burnt coffee.
“You look terrible,” she said.
“You look like you haven’t slept either.”
“I haven’t.” She pushed off from the van and fell into step beside him. “I ran the transaction analysis. The mixing service vulnerability gave me a shortlist of twenty-three possible origin wallets. Cross-referenced with known forum accounts, and I found something interesting.”
She pulled out her phone and showed him a screenshot. A forum post from six months ago, in a cryptocurrency mining subreddit. The username was DeepPockets, and the post was asking about “large-scale distributed computing” and “bypassing consent mechanisms.”
“What’s interesting about this?” Pax asked.
“The writing style.” Nova zoomed in on a sentence. “Look at the punctuation. The way they use em-dashes instead of hyphens. The same pattern appears in the Puppeteer’s messages to Marcus.”
“So the Puppeteer is DeepPockets.”
“Or DeepPockets is one of their aliases. More importantly, DeepPockets posted from an IP address that resolves to a location in our city. An abandoned mining facility on the industrial side of town.”
Pax felt a chill that had nothing to do with the morning air. “So the Puppeteer is local. Like we thought.”
“Like we know. Now we need Marcus to confirm.”
They found Marcus in the parking lot again, but this time he wasn’t vaping. He was sitting in his Civic, staring at his phone, looking like he hadn’t slept either.
“Hey,” Pax said, tapping on the window. “We need to talk.”
Marcus rolled down the window. His eyes were red-rimmed. “I’ve been thinking. About what you said. About the hospitals.”
“Yeah?”
“I didn’t know.” His voice cracked. “You have to believe me. I didn’t know.”
“We believe you,” Nova said, and Pax was surprised at how gentle her voice sounded. “But we need your help. The Puppeteer—have you heard from him since yesterday?”
Marcus shook his head. “Nothing. It’s like he disappeared.”
“Check your messages. Anything at all.”
Marcus pulled up his forum inbox. The last message from Puppeteer was from three days ago: “Testing complete. Prepare for deployment.”
“Deployment of what?” Pax asked.
“I don’t know. He didn’t say.” Marcus’s hands were shaking. “But he mentioned something about ‘full infrastructure integration.’ Whatever that means.”
Pax and Nova exchanged a look. Full infrastructure integration. Building management systems. Traffic lights. Power grids.
“When is this supposed to happen?”
“Soon,” Marcus said. “He said—he said ‘when the time is right, everyone will know my name.'”
The first bell rang. Students started streaming out of cars, heading toward the main building. Pax glanced at the school—the same old building, same brick walls, same flagpole. But now it looked different. Like a bomb waiting to go off.
“Stay close,” Pax told Marcus. “If you hear anything from him, tell us immediately.”
Marcus nodded and practically ran toward the building.
Nova watched him go. “He’s scared.”
“He should be.” Pax started walking. “We all should be.”
Scene 2: The Escalation Begins
First period was biology. Pax sat in the back row, trying to focus on cellular respiration while his mind raced through hashrates and C2 servers and the look on Marcus’s face. Mrs. Park was droning about mitochondria, and half the class was already half-asleep.
Then the lights flickered.
Just once, barely noticeable. A few people looked up, then went back to their notes. Pax’s heart started beating faster.
The lights flickered again. Longer this time. Someone muttered, “What’s wrong with the lights?”
And then they went out.
Not the whole room—the emergency lights kicked in, casting everything in a weird yellowish glow. But the main fluorescents were dead. So were the projectors, the smartboards, the computers.
“Everyone stay calm,” Mrs. Park said, reaching for her phone. “Probably just a breaker.”
The HVAC system roared to life.
It wasn’t supposed to do that. When the power flickered, the HVAC should have reset to its default settings—which in January meant heat. But instead of warm air, the vents started blasting freezing cold. Pax could see his breath.
“Is it supposed to be this cold?” someone asked.
“No,” Pax said, standing up. “It’s not.”
He ran for the door.
“Mr. Chen! Sit down!” Mrs. Park shouted, but Pax was already in the hallway.
The hallway was chaos. Emergency lights everywhere, painting the lockers in sickly amber. The fire alarm wasn’t going off, but the door locks were clicking—open, closed, open, closed—like someone was playing a sick game. Students were pressing themselves against the walls, confused and scared.
Pax pulled out his phone. No Wi-Fi, but cellular still worked. He texted Nova: Something is happening. The building systems are going crazy.
Her reply came instantly: I see it. Meet me at the server room.
He ran.
Scene 3: Chaos in the Hallways
The server room was in the basement, behind a steel door that Pax had helped install two years ago. When he got there, Nova was already waiting, her laptop open, cables running from the network jack to her machine.
“The building management system is compromised,” she said without looking up. “Whoever did this has full control of the HVAC, the lighting, the door locks, even the fire suppression system.”
“The Puppeteer?”
“Who else?” She pointed at her screen. “Look at the CPU usage on the BMS controllers.”
Pax leaned in. The building management system ran on a network of industrial controllers—small, rugged computers designed to handle the school’s heating, cooling, and security. Normally they sat at around five percent utilization. Right now, they were pegged at ninety-eight percent.
“He’s using them to mine,” Pax said. “The BMS controllers have serious processing power. Not as fast as a gaming PC, but there are hundreds of them across the district.”
“And he just took control of all of them.” Nova’s voice was tight. “This isn’t a test anymore. This is the deployment Marcus was talking about.”
Pax’s phone buzzed. A text from an unknown number—the same one from yesterday.
“You wanted to find me? Here I am. Watch.”
Attached was a link. Pax hesitated, then clicked it.
The link opened a dashboard. Not his dashboard—something far more sophisticated. A real-time map of infected devices, glowing red across the city. School systems. City government. Hospitals. Traffic controllers. And at the center, pulsing like a heartbeat, the Puppeteer’s own connection.
The hashrate at the top of the dashboard was staggering. 250 megahashes per second. Enough to mine roughly two Monero per day. At current prices, that was almost three hundred dollars. Every day. Tax-free. Victim-funded.
“He’s not just testing anymore,” Pax breathed. “He’s in full production.”
Nova looked over his shoulder. Her face went pale. “Two hundred and fifty megahashes. That’s—that’s thousands of devices.”
“Hundreds of thousands.” Pax closed the link before he could see more. “And he’s just showed us his hand. Why?”
“Because he wants us to know we can’t stop him.” Nova slammed her laptop closed. “We need to cut the power to the BMS controllers. Now.”
Scene 4: Nova’s Hard Choice
“Wait,” Pax said. “You can’t just cut power to the BMS.”
“Why not?”
“Because the BMS controls the boiler.” He pointed at the ceiling, toward the invisible network of pipes that ran through the school. “It’s January. It’s twenty degrees outside. If we kill the BMS without a proper shutdown sequence, the pipes could freeze. And if the pipes freeze—”
“They burst. Flooding. Structural damage. School closure for weeks.”
“Weeks at least. And that’s if we’re lucky. If the boiler itself fails, we could have a real disaster.”
Nova’s jaw tightened. “So what’s your plan? Let him keep mining until the controllers overheat and fail on their own?”
“Of course not. But we need a smarter solution.” Pax pulled out his own laptop and started typing. “The malware has a heartbeat signal. Every ninety seconds, it phones home to the C2 server to check for new commands. If we can spoof the C2’s response, we can send a sleep command to every infected device in the building.”
“Spoofing requires us to intercept the traffic. That means physical access to the network core.”
“The network core is in the server room.” Pax gestured at the steel door behind them. “Which is locked.”
Nova tried the handle. Locked tight. “Can you bypass it?”
“I installed a physical bypass last year.” Pax walked over to the water fountain ten feet away. “Against fire code. Don’t tell anyone.”
He reached behind the fountain and felt for the hidden switch. His fingers brushed against the metal toggle. He flipped it.
A quiet click came from the server room door.
Nova raised an eyebrow. “You installed a secret switch to bypass a server room lock?”
“I got locked out once. It won’t happen again.”
He pushed the door open. The server room was dark except for the blinking lights of network switches and the low hum of cooling fans. Racks of equipment lined the walls, cables snaking everywhere like metal vines.
“The BMS controllers are in the far corner,” Pax said, heading toward them. “I need to connect my laptop to the management interface.”
“Do it fast. The Puppeteer knows we’re here.”
Pax knelt beside the controller rack and plugged in an Ethernet cable. His laptop recognized the connection immediately. He pulled up his spoofing script—the one he’d been working on in his head all night—and started typing.
The idea was simple: intercept the heartbeat requests from the infected devices, then send back a crafted response that told them to go to sleep for sixty minutes. That would give them time to figure out a permanent solution.
But the Puppeteer had built redundancies. Each device checked the C2 server’s SSL certificate before accepting commands. Spoofing the certificate meant stealing the Puppeteer’s private key, which was impossible.
Unless…
“What if we don’t spoof the command?” Pax muttered. “What if we redirect the traffic?”
“Explain,” Nova said.
“The malware phones home to a specific domain. If we change the DNS resolution for that domain—just on the school’s network—we can point the devices to a fake server of our own. The devices will still check the SSL certificate, but if our fake server has a valid certificate from a different domain—”
“The devices won’t care. They only check that the certificate is valid, not that it matches the domain.” Nova’s eyes widened. “That’s actually smart.”
“I try.” Pax’s fingers flew across the keyboard. He created a fake C2 server on his laptop, generated a valid SSL certificate using a free service, and reconfigured the school’s internal DNS to point c2.paxs-cooling-script.xyz to his laptop’s IP address.
Then he waited.
Ninety seconds later, the first heartbeat arrived. His fake server responded with a sleep command. Across the school, a thousand infected devices paused their mining.
The lights in the server room flickered, then stabilized. The HVAC fans slowed to a quiet hum.
“Is it working?” Nova whispered.
Pax checked his dashboard. The hashrate from the school’s devices had dropped to zero. “It’s working. For now.”
His laptop screen flickered. A new message appeared—not a text this time, but a pop-up window from the fake C2 server. The Puppeteer had noticed the DNS hijack and was sending a direct message through the compromised devices.
“Cute. That was 3% of my network. Want to see the other 97%?”
Below the message, a list began to scroll. Pax couldn’t look away.
Hospitals: 47 facilities. Ventilators: 212 units. Infusion pumps: 1,043 units. Cardiac monitors: 892 units.
Traffic control: 6 municipal systems. Traffic lights: 1,247 intersections.
Power grid: 3 regional substations. Load management systems: 18.
Government: 12 city agencies. Emergency services dispatch: 2 centers.
The list went on. Pages and pages of infrastructure, all compromised, all mining Monero for the Puppeteer. The hashrate at the top of the Puppeteer’s dashboard was over 2 gigahashes now. He’d been holding back. Saving his real power for this moment.
“Pax,” Nova said, her voice barely a whisper. “What have we done?”
Pax stared at the screen. The Puppeteer hadn’t been hiding from them. He’d been waiting for them to find him. And now that they had, he was showing them the true scope of his empire.
The Puppeteer wasn’t a criminal mastermind hiding in the shadows. He was a force of nature. And he wanted them to know that they were utterly, completely outmatched.
The message continued:
“You wanted to save your little school. Go ahead. I’ll give you that. But the rest of my puppets will keep dancing. And there’s nothing you can do to stop me.”
The pop-up closed. The DNS hijack stopped working—the Puppeteer had reconfigured his domain to use a different IP address. The school’s devices started mining again, their fans roaring back to life.
Pax sat back on his heels, his laptop glowing in the dark server room. He could hear Nova’s breathing, fast and shallow.
“What do we do now?” she asked.
Pax thought about the ventilator on his dashboard. The traffic lights. The power grid. All those lives, hanging by a thread of stolen code.
“We find the conscience,” he said.
“The what?”
“The malware has a hidden subroutine. I noticed it when I was analyzing the code last night. It checks what kind of device it’s running on, and if it’s something critical—ventilators, cardiac monitors, life support—it doesn’t mine. It just installs a performance monitor and leaves.”
Nova frowned. “Why would the Puppeteer build in a restriction like that?”
“Maybe he didn’t.” Pax stood up, his knees popping. “Maybe someone else did. Someone who wanted to make sure the malware couldn’t kill people.”
“Who?”
Pax remembered the clean coding style. The gentle approach. The subroutine that refused to run on medical devices.
“I don’t know yet,” he said. “But I’m going to find out.”
He closed his laptop and headed for the door. The emergency lights flickered overhead, casting long shadows across the floor. Somewhere in the building, a door lock clicked open, then shut.
The Puppeteer was still playing his game.
But Pax had just found a new rule: even puppet masters have strings.
And he was going to pull them.
Table of contents:
Introduction
Chapter 1: The Silent Miner
Chapter 2: A Thief in the Circuitry
Chapter 3: The Hashrate Hijack
Chapter 4: A Conscience in the Kernel <<<<<< NEXT
Chapter 5: The Botnet’s Lullaby
Chapter 6: Proof-of-Work, Proof-of-Harm
Chapter 7: The Green Mine Proposal
Chapter 8: Rewriting the Unwritten
Chapter 9: The Ethical Fork
Chapter 10: A Clean Block
