He downloaded the latest log. It was a text file, raw and unformatted. Scrolling through it, he saw IP addresses from all over the world—but one stood out. It appeared every night at 3:14 AM, exactly. The internal IP of the company’s main financial server.

The directory listing was a single folder: /discovery . He navigated inside. No file names, just timestamps. Dozens of them. The most recent was from two days ago.

Leo reached for the network cable. Tonight, the discovery wasn't a file. It was a warning. And the demo was over.

This wasn't an asset transfer. This was a backdoor.