For three years, the force had used a bespoke, ultra-secure email server. It was a fortress. But six months ago, under pressure for modernization, they had migrated to a Microsoft 365 environment. The migration was meant to streamline operations, allow for cloud-based evidence sharing, and, as the Minister of the Interior put it, “drag the police into the 21st century.”
Correo 365 Policía To: Coronel (Ret.) Javier Fuentes Subject: Monthly Pension Verification
“Microsoft stuff doesn’t send emails at 3:17 AM to a retired colonel in Seville,” Lara replied, turning her screen.
In the heart of Madrid’s financial district, inside the cavernous, glass-walled headquarters of the Cuerpo Nacional de Policía’s Cyber Division, Inspector Lara Mendes stared at her screen. On it was a single, unassuming line of text:
The trail led them to a cramped, windowless server room in the basement of the very building they worked in. It was the “legacy access point” – the last physical node connecting the old server to the new cloud. Inside, they found a small, raspberry-pi-sized device wired into the main switch, no bigger than a pack of cards. On it, carved with a laser engraver, were the words: Correo 365 – Puerta Trasera.
“This isn’t a hacker,” Lara whispered, pulling up the packet capture data. “Look at the email headers. The language. ‘Discrepancia en su expediente.’ It uses the exact phrasing from the Ley de Procedimiento Administrativo . The grammar is perfect. This is someone who has read our manuals.”
Over the next 72 hours, Lara and Tomás traced the ghost. The Correo 365 Policía account had been created the same day as the migration, six months prior, by a user with full administrative privileges. The user’s name was listed as . No real name. A placeholder.
For three years, the force had used a bespoke, ultra-secure email server. It was a fortress. But six months ago, under pressure for modernization, they had migrated to a Microsoft 365 environment. The migration was meant to streamline operations, allow for cloud-based evidence sharing, and, as the Minister of the Interior put it, “drag the police into the 21st century.”
Correo 365 Policía To: Coronel (Ret.) Javier Fuentes Subject: Monthly Pension Verification correo 365 policia
“Microsoft stuff doesn’t send emails at 3:17 AM to a retired colonel in Seville,” Lara replied, turning her screen. For three years, the force had used a
In the heart of Madrid’s financial district, inside the cavernous, glass-walled headquarters of the Cuerpo Nacional de Policía’s Cyber Division, Inspector Lara Mendes stared at her screen. On it was a single, unassuming line of text: The migration was meant to streamline operations, allow
The trail led them to a cramped, windowless server room in the basement of the very building they worked in. It was the “legacy access point” – the last physical node connecting the old server to the new cloud. Inside, they found a small, raspberry-pi-sized device wired into the main switch, no bigger than a pack of cards. On it, carved with a laser engraver, were the words: Correo 365 – Puerta Trasera.
“This isn’t a hacker,” Lara whispered, pulling up the packet capture data. “Look at the email headers. The language. ‘Discrepancia en su expediente.’ It uses the exact phrasing from the Ley de Procedimiento Administrativo . The grammar is perfect. This is someone who has read our manuals.”
Over the next 72 hours, Lara and Tomás traced the ghost. The Correo 365 Policía account had been created the same day as the migration, six months prior, by a user with full administrative privileges. The user’s name was listed as . No real name. A placeholder.