Let's imagine a very good blackhat hacker, his protege, and a team of about 20-50 other non-technical people who employ this hacker need to figure out a way to gain undetectable access to multiple servers inside an national ISP company's local branch office.
They have physical access to the facility, as in, they can get to the outside perimeter on foot or by car.
The ISP building has a wireless network that is WPA2-PSK protected, which is on the same subnet as some of the office PCs in the branch, but none of the servers.
The ISP in this story of mine is known to employ armed security guards, passcode+key physical entry authentication, Enterprise-grade firewall+load balancers, hot and cold networked backups, enterprise-grade intrusion detection, and enterprise-grade antivirus.
Preferably, we do this without a zero-day attack.