How fast it moved

The campaign against PaperCut print servers, on a real clock. Press play.

0h 00m
elapsed since the attacker started
  1. 0h 00m — empty workspace
    A human builds a private lab and works out the way in.
  2. 3h 50m — exploit works
    Testing finishes against the lab copy.
  3. 3h 59m — first real victim
    Under four hours: code running on a live server.
  4. 4h 59m — eleven at once
    26 seconds, 11 organizations, in one burst.
  5. 5h 59m — full network control
    Two hours after the first break-in. At one US high school it took seven minutes.
  6. and onward — 440 machines
    395 organizations, 48 countries. Just under half were schools.