She didn't have nine hours.

She reconstructed the 64-byte trigger packet from the crash dump’s memory. It wasn't a payload. It was a key —a cryptographic handshake that, when sent to the satellite, would cause it to download a larger payload from an untraceable broadcast source. The payload was api64.dll —the Chimera runtime. And the Chimera runtime, once active, could execute any Windows binary in space.

"Someone knew," Anya whispered. "Someone put a backdoor in every single satellite. Not to steal data. To run something."

"Marcus," she said slowly, "who wrote the handshake protocol?"

"They air-gapped the satellite network," Marcus said. "How did it get there?"

The client was Aurora SatCom, a constellation of six hundred low-orbit broadband satellites. The symptom was bizarre: every 47 hours, precisely at the moment a specific telemetry handshake occurred between Satellite 441 and the Colorado ground station, the satellite’s main flight computer would blue-screen. Not reboot—blue-screen. In space.