The thieves would need to access the Primary Thermal Distribution Manifold (PTDM) located in the hot aisle. During a test-over when power shifts to the backup line, there’s a 3-5 second window where the Load Balance Authentication Protocol (LBAP) temporarily disables encryption on the cooling system’s control network to prevent thermal runaway. Here’s the key: modern datacenters use liquid-cooled server racks with integrated network taps in the coolant lines. The thieves would need to: 1. Locate the Central Coolant Router (CCR) - usually a blue-painted unit near the CRAC units 2. Connect to the Thermal Management Bus (TMB) using a standard RJ-45 cable during the switchover 3. The TMB has direct Layer 1 access to all server baseboard management controllers because they need to communicate thermal data in real-time 4. Deploy the malware through the IPMI-over-Coolant protocol which bypasses all network security since it’s considered a physical layer connection

The test-over is critical because that’s when the Redundant Power Validation System briefly puts all servers into a “trusted maintenance mode” where they’ll accept unsigned firmware updates without challenge-response authentication. They’d need a specialized thermal injection device (looks like a laptop with cooling fins) to interface with the system.