“And you’re saying that’s what he did?” Abe asked.

“Apparently so. It’s not on file with any of the groups that track malware. I’ve only had a couple of days to dissect it, but it looks like a variant on Sasser. Has some Nimda DNA floating around in it too.”

“English, Vaughn,” Hendricks said.

“It’s a well-written virus by someone who knows their trade. And he’s crafty. Whoever it is learned the lessons of some of the big viruses of the last ten years and improved on them. It’s not destructive so far as I can tell. So that’s the good news.”

“And the bad?” Jenn asked.

“It’s busy downloading files from your servers.”

“What!” she said. “What files?”

“Anything it wants. I assume it’s targeting files pertaining to Suzanne Lombard, but it would take a cyber forensics team to know for sure. And that’s not my area.”

“Jesus Christ.” Hendricks threw his pen against the wall.

“Again, no,” Rilling said. “We monitor outgoing traffic. Everything’s been normal. We haven’t seen any uptick in volume, no abnormal IP address hits.”

“Well, unfortunately, he was prepared for that too. It’s downloading at a rate of twelve kilobytes per second. Slow but steady. Taking its time. That volume would just blend into the background of a company this size. Right, Mike?”

Rilling nodded morosely.

“If it’s been working around the clock since we opened that e-mail,” Abe said, “how much could he have?”

Rilling scribbled figures on a legal pad and slid the pad across to Abe, who nodded grimly.

“Actually that’s the cool thing about it. It isn’t working around the clock,” Gibson said. “It stops every day at five.”

“Oh, does it take weekends off too?” Hendricks asked.

“Actually, yes,” Gibson replied. “This is strictly a nine-to-five virus. See, it’d look strange if someone was surfing the Washington Post at two in the morning.”

“The Post?” Rilling asked.

“Yeah, WR8TH is using an ad on the Washington Post home page as a relay point.”

“That can be done?” Jenn asked.

“Sure, it’s increasingly common among hackers. Corrupt an ad on a mainstream website that won’t look unusual in a company’s browser history and use it as a relay point to send hacked data to its intended recipient.”

“Well, we need to pull the plug immediately,” Hendricks said. “Shut down until we can scrub this thing from our system.”

“Agreed,” Jenn said. “This is a disaster.”

“You could do that, but I wouldn’t advise it. Not if you want to catch this guy.”

Abe raised a hand to quiet the others. “Why not?”