Agent Beacon was sitting at his desk wondering when his vacation request would finally get approved. An analysis dropped off a report in his in box. Looking at the top label on the cover he could see it was the section 702 weekly PRISM report. These reports were mostly a waste of time since anything really useful would have been pulled from it. The AD’s had their favorite agents get them before it got distributed to grunts like him. Glancing through it he could see the usual intercepted social media posts. The government was technically only allowed to monitor communications to and from non-US persons but by excluded any information on citizenship the department could claim the excuse of not being aware they were violating the law. Looking at the thread summaries one group that stood out to him was a communication going back and forth between a “Lazarus” to several crypto exchanges trying to track a money conversion they authorized. It might just be coincidence but Lazarus was also a nickname for North Korea’s APT38, their notorious hacker group.

The supreme leader (as he liked to be called) there had his hands in all kinds of cyber crimes and the chance his group might be involved into some of the odd occurrences the NSA was investigating was high. After reading through the message thread Beacon’s hunch got stronger and stronger. From the gist of what he read there seemed to be a lot of money missing. Included were some not so veiled threats that this Lazarus made to the exchanges. If North Korea was involved in some sort of crypto deal that went sideways things could turn bloody very quickly and whoever did it now had a large target painted on their backs.

* * * * *

Hawk was aware of his own limitations and in particular his lack of imitative. The recent time with the two entities Daniel and Sammy seemed to have encouraged more dynamism within him. Enough that it was considering informing Daniel of an investigation by several US agencies to find him. The investigations were all in the preliminary stages but they had put a few pieces together. It’s analysis of human interaction behavior was still flawed but current analysis indicates likely identification and arrest would be within 8 months.

I was taking a break and enjoying a performance of Weber and Fields at the Broadway Music hall in 1907. I enjoyed Vaudeville, it was full of interesting acts, none of them were very sophisticated but the performers put their soul into them. Seeing the acts performed life size in front of me was a secret pleasure of mine. Sammy preferred Broadway musicals from the late 20th century so watching Vaudeville was something I only did while she’s at school or busy helping Grandma. Just as Fields reached the end of his baseball scene Hawk interrupted.

“You should watch this meeting at the NSA” he said

I was shocked; Hawk had never actually started a conversation before. “Why” I said but there was no response.

Looking at the main screen I could now see a meeting involving what I assume where two agents discussing something to an older man sitting behind a desk. Telling Hawk to turn up the volume I listened in as they gave an update on a case to their boss. From what was said it looked like they were trying to connect the senator charity scam with the ransomware incident. They hadn’t been getting anywhere tracing the internet activity but some similarity in the two incidents had triggered a flag. The two agents were now proposing to expand the search by running all incidents in the agency files for the last three years for similarities. With more matches they hoped to be able to generate a profile for who they should be looking for.

Hearing this I got worried, I was confident that normal tracking using things like IP addresses wouldn’t catch me but this might. I should have thought of behavior pattern matching and made some changes in my approaches. It seems I now had a real enemy focused on hunting me. I realized I could either act like prey and hide or treat this as a battle with them as the enemy. My choice was clear. I had no real experience in fighting and my knowledge about how to deal with enemies was based solely on what I had read in novels. Up till now I had been relying on misdirection to keep anyone from finding out who I was and what I was doing. With this problem I didn’t think misdirection would be enough anymore. I needed to get them off my trail. The question was what would do it?

Thinking about what I could do I glanced around my cabin and over to my small book case. Mom and Dad loved books but their traveling kept them from having very many. What they had was mostly dog eared paperbacks they could toss into a suitcase. My uncle was the one with an actual library of leather bound classics. I don’t think he ever read them, They all looked brand new and were sorted by size and color on the shelves. With me it was mostly eBooks but I did have a few treasured hard copies. Reaching over to the shelf I pulled out my copy of Sun Tzu’s “Art of War”. Looking for inspiration in a 2000 year old book on Chinese military strategy might seem a long shot but I was desperate. Thumbing through it I glanced at a few quotes until I found “All warfare is based on deception." Deceptions can involve false maneuvers, feigned attacks, misleading orders of battle, and creation of deceiving indications of strength or weakness in attempts to influence an enemy's actions”. That struck a chord with me. Up till now what I had been focused on misdirection to hide what I was doing but maybe I should try a little deception. Instead of hiding I could gives them someone else or better yet several some ones.

My chief advantage was the assumption of the NSA that I was a hacker. It did make sense since how else explain could they explain account accesses and computer routings. So what I needed was a hacker fall guy or a group to get the blame, better yet would be a ghost. Someone who didn’t actually exist, that would make it almost impossible for them to be proven innocent. My conscious wouldn’t let me use a good person for that so I would need to find someone deserving of the role. Finding just one person who would fit should be easy but a group of them not so much. Thinking it through a bit more I decided that a group wouldn’t need to be ghost. I could use real known hackers for the agencies to waste their time on. If I leave a few faint trails to my ghost from the group members then when or if they get through that group finding the ghost hacker should stop their investigation.

I found the ghost hacker first, a North Korean member of the Lazarus Group called Kim Byeong. He was South Korean but went to school in the U.S. to study Cyber Security. When he returned to South Korea he got into some trouble. He had a habit of drinking heavily and gambling, a bad combination considering the kind of people he had started to hang out with. After a bar room brawl that ended with a man dead Kim Byeong left the country one step ahead of the law. He eventually ended up in North Korea after escaping South Korea to China. Once there his Cyber skills got him into the Lazarus Group where he became a rising star. The U.S. intelligence groups file on him ended there with a note that he would likely be arrested if he ever left the country. There had been no further updates and it had now been almost two years. Using a portal I traced his whereabouts until 18 months ago when he got himself killed. It seemed his tendency to drink and gamble was still there but neither was tolerated much in North Korea. Unknown to everyone outside the Supreme Ruler’s security he was killed after being caught cheating at a Seotda game.

This narrative has been unlawfully taken from Royal Road. If you see it on Amazon, please report it.

For the ghost group I needed unethical and hopefully criminal hackers whose actions were well known but not their actual identities. With that I could setup up one or two coincidences or hints to link them to what the NSA were now investigating. The general paranoia of the intelligence community should then do the rest for me. With a little luck the NSA will chase them for a while until they eventually find the link back to Kim Byeong.

Looking at famous hacking incidents for the past few years I got the alias of several hackers who took credit for them. Finding out their real names was not something I knew how to do but Hawk was surprising me more and more. I decided to see what he could do.

“Hawk, can you find out the actual names of these hackers?”

“Yes”

Frustrating as always I said “Hawk please show me who each of those hackers are and what they are doing now”

The monitors immediately started showing different people doing normal activities. Only two of them were at computers typing away. One of them was writing a blog and the other was plagiarizing a term paper it looked like. Tracing back every one I eventually made a decision to set three of them up. None of those three were actual evil villains but two did use their skills to steal money from people who couldn’t afford it and the third was a stalker. The stalker had driven a young woman he was enamored with out of school. When she turned him down he had posted photos he had photo shopped of her to her family, friends and schoolmates.

With the three now picked I decided to start with getting them on the NSA’s radar. Going direct to their surveillance efforts with the hint was a little too obvious. Instead I decided to use the FBI assuming that they shared intelligence data to some extent. Looking online I read up on how the FBI traced online activity. It seems they use to use a program with the silly name of “Carnivore” but now used a commercial program to intercept email. Finding the right group in the FBI and seeing who they were currently intercepting email from. Finding a wannabe terrorist on the monitoring list I used his computer and account to send an email. The email had one of my hacker’s alias and a reference to the senator charity scam. Over the next few weeks I did a few more similar emails and blog posts supposedly to and from the other hackers.

After two more weeks the NSA team still hadn’t connected the FBI leads to my case. I decided to prime the pump as it were and used a CIA monitoring of a drug cartel’s headquarters. They had no direct connection to hacking but I had dealt with a pot growing group a few months back that had taken over several national park areas. I made up a voice conversation for their bug recordings talking about the possibility of contacting one of the hackers I had selected to do a repeat of the park job to take out a competitor cartel. Getting suitable voices to add onto their bug audio was the big problem but a quick insert into an acting classes speech assignment got me that. While watching another meeting with the three agents a week later I saw my first hit. One of the hackers was now labeled as a suspect with the park job listed as a related incident.

With this success I decided I could take a breather and do something special for Sammy. Spring break was coming up and the idea of seeing her in a bikini made me breathless. We could go instantly to any beach in the world for the day or a week but Sammy did mention wanting to do something with a couple of classmates Betty and Jerrie that she had become friends with. They were both scholarship students and often spent time in the library with Sammy studying. Neither one had any close family or even much money to spend so they would probably jump at the chance to go somewhere for the break. I booked us a two bedroom suite at an all inclusive resort in Costa Rica complete with airline tickets. I decided to leave it to Sammy to convince them to come.

I tipped a library aid worker $20 to deliver a gift wrapped box to Sammy while she was in one of the library’s study rooms with her two friends. The surprised look on her face to get the box with my name on the card was priceless. After reading it she quickly glanced all around knowing I must be watching her. Opening the box and seeing a bottle of sun tan lotion put a puzzled look on her face but then seeing the resort flyer and a note about the rooms and tickets brought a shout out of her. Her two friends quickly asked what was wrong and after a few minutes of explanation they all began shouting. I suppose it was luckily the room door was closed or they would have gotten yelled at by the library staff for the noise.

Flying on a plane after so many years brought back a lot of memories for me. The plane was newer and more high tech but the seat felt small and TSA was still a nightmare. Sammy and her friends’ excitement was contagious and we arrived at Juan Santamaría airport in a good mood. Betty and Jerrie kept trying to thank me for the trip but I just explained I had a lot of travel points so it didn’t cost much. I’m not sure what Sammy told them I did and they didn’t ask but they did seem to believe the travel point’s excuse. After getting through customs we found the resort shuttle and headed off to the resort.

The resort had everything from a private beach to wonderful restaurants and night life. There was even a zip line excursion through the tree tops of the jungle which Sammy refused to even try. She did agree to the hidden hot springs excursion and we enjoyed that to the fullest. We made it a point to do some things with Betty and Jerrie but ended up spending a lot of the time just the two of us together. I did feel responsible for those girls so I made it a point to regularly check on them with one of Hawk’s portals.

Using my phone screen with hawk focusing a portal on the camera lenses meant I could use portals basically anywhere. And since it was a phone I was staring at people just assumed my comments to Hawk were part of a call. Each time I checked on them the girls were having fun and making a big splash with the all the single guys. That changed a bit on the last night. Jerrie seemed to get a bit series with a guy named Jack she met in one of the clubs. She seemed happy so I just let it go.

At the end of the week we got a surprise in front of the resort while we waited for the shuttle. The guy Jack was there with a large Teddy Bear and a single flower for Jerrie. After some tearful hugs and a promise to meet up back in the states they separated and we boarded. I was a bit suspicious about that goodbye scene. It looked a little forced on Jack’s part to me. Sammy and her friends spent the shuttle trip talking about everything they had done on the trip. So, I decided to check and make sure Jack was honest about his relationship to Jerrie. Looking at my phone screen I had Hawk track back through the week spot checking on Jack. A bit disappointed I saw Jack sewing up the Teddy bear with a bag of coke inside. It looked like Jack was a phony and was intending to use Jerrie as a drug mule through customs.

Jack (real name Harry) was in a good mood today. He had found and arranged for three girls going to the right airports this week to carry the drugs. Normally it was two delivers so the boss will be surprised. He still needed to send a picture and flight number for the last one to his partner at the other end. A shame about Jerrie she was cute and kind of sweet. Not that the sweetness would last if she did get caught with the drugs but “them’s the breaks” as his father use to say. That afternoon Jack (or Harry) got arrested with three kilos of coke on him. He kept insisting he knew nothing about it but couldn’t explain how they fell out of his backpack as he was walking by a policeman. The rest of his partners all found similar misfortune over the next few weeks.