Malmon System Mastery

Understanding the Complete Framework

As an Incident Master within our cybersecurity education framework, your mastery of the Malmon system enables you to create rich, educational experiences that teach genuine cybersecurity concepts through engaging gameplay and security awareness training. You don’t need to be a malware analysis expert, but you do need to understand how the system works and how to use it effectively for collaborative learning cybersecurity that supports security professional development.

Legacy and Contemporary Threat Education: Your toolkit includes both historical threats that shaped cybersecurity (Code Red 2001, Stuxnet 2010, Ghost RAT 2008, Poison Ivy 2005) and current attacks (GaboonGrabber, LockBit, FakeBat, WannaCry). This range helps teams understand threat evolution - how techniques developed over time, why certain defenses exist, and how past lessons apply to modern challenges.

The Type System in Practice

Core Type Relationships

Trojan Types:

  • Strengths: Deception, social engineering, appearing legitimate
  • Weaknesses: Behavioral analysis, user education, runtime monitoring
  • Learning Focus: Social engineering awareness, detection techniques
  • IM Application: Emphasize human factors and user training

Worm Types:

  • Strengths: Network propagation, automatic spreading, speed
  • Weaknesses: Network segmentation, patch management, traffic monitoring
  • Learning Focus: Network security, vulnerability management
  • IM Application: Emphasize infrastructure protection and rapid response

Ransomware Types:

  • Strengths: Business disruption, encryption, payment pressure
  • Weaknesses: Backup systems, business continuity, network isolation
  • Learning Focus: Business impact, recovery planning
  • IM Application: Emphasize organizational resilience and stakeholder management

Rootkit Types:

  • Strengths: Stealth, system-level access, persistence
  • Weaknesses: Forensic analysis, integrity checking, advanced detection
  • Learning Focus: Advanced threats, forensic techniques
  • IM Application: Emphasize sophisticated detection and investigation

APT Types:

  • Strengths: Patience, sophistication, strategic objectives
  • Weaknesses: Threat intelligence, behavioral analysis, long-term monitoring
  • Learning Focus: Strategic threats, attribution, intelligence
  • IM Application: Emphasize strategic thinking and advanced coordination

Infostealer Types:

  • Strengths: Data collection, credential harvesting, stealth
  • Weaknesses: Encryption, access controls, data loss prevention
  • Learning Focus: Data protection, access management
  • IM Application: Emphasize data security and privacy protection

Type Effectiveness Reference for IMs

Use this comprehensive chart to understand security control effectiveness and guide team discussions:

Trojan
Weak to: Detection
Resists: Training
Worm
Weak to: Isolation
Resists: Backup
Ransomware
Weak to: Backup
Resists: Encryption
Rootkit
Weak to: Forensics
Resists: Detection
APT
Weak to: Intelligence
Phishing
Weak to: Training
Botnet
Weak to: Coordination
Infostealer
Weak to: Encryption

Using Type Effectiveness for Learning

Super Effective Relationships (+3 Bonus): When teams use approaches that directly counter a Malmon’s primary strengths:

  • Behavioral analysis vs. Trojans: Teaches importance of runtime monitoring
  • Network isolation vs. Worms: Demonstrates network segmentation value
  • Backup systems vs. Ransomware: Shows business continuity importance

Not Effective Relationships (-2 Penalty): When teams use approaches that don’t address the Malmon’s characteristics:

  • Signature detection vs. Zero-day APTs: Teaches limitations of known-bad approaches
  • Network controls vs. USB Worms: Shows importance of physical security
  • Antivirus vs. Living-off-the-land techniques: Demonstrates behavioral analysis needs

IM Facilitation Strategy: Use type effectiveness to guide learning without lecturing:

  • “How well do you think that approach would work against this type of threat?”
  • “What might make this particular threat resistant to that strategy?”
  • “Based on what we know about this Malmon’s characteristics, what approaches might be most effective?”

Evolution Mechanics for Learning

Understanding Evolution Triggers

Time Pressure Evolution:

  • Trigger: Teams take too long to identify or respond
  • Learning Goal: Emphasizes importance of rapid incident response
  • IM Application: Use time pressure to create urgency and decision-making practice

Failed Containment Evolution:

  • Trigger: Teams use ineffective approaches against Malmon type
  • Learning Goal: Teaches importance of matching strategy to threat characteristics
  • IM Application: Let teams experience consequences of mismatched responses

Environmental Evolution:

  • Trigger: Organizational vulnerabilities enable threat advancement
  • Learning Goal: Shows how security posture affects incident outcomes
  • IM Application: Connect organizational preparedness to incident success

Managing Evolution During Sessions

Evolution as Learning Tool: When Malmons evolve, use it as a teaching moment:

  • “Your initial approach didn’t account for this threat’s [characteristic] - how does that change your strategy?”
  • “What would have prevented this evolution?”
  • “How do you adapt when threats become more sophisticated during response?”

Preventing Unwanted Evolution: When teams are learning well but struggling with complexity:

  • Adjust dice modifiers to reflect good collaboration
  • Allow type effectiveness bonuses for creative approaches
  • Focus on learning objectives over strict mechanical adherence

Evolution Recovery: When evolution creates too much complexity:

  • “Let’s focus on the most critical aspect of this evolved threat”
  • “What’s your priority now that the situation has become more complex?”
  • “How do you manage when incidents escalate beyond initial expectations?”

Malmon Selection for Different Learning Goals

For Fundamental Concepts (New Teams)

GaboonGrabber (Trojan/Stealth ⭐⭐):

  • Learning Goals: Basic incident response, social engineering awareness, team coordination
  • Why It Works: Clear type characteristics, straightforward investigation path, multiple role contributions
  • IM Focus: Emphasize collaboration, basic cybersecurity concepts, role specialization

Code Red (Worm ⭐):

  • Learning Goals: Network security basics, vulnerability management, rapid response
  • Why It Works: Simple propagation mechanism, clear containment strategies, historical context
  • IM Focus: Network concepts, patch management, infrastructure protection

For Intermediate Concepts (Experienced Teams)

WannaCry (Worm/Ransomware ⭐⭐⭐):

  • Learning Goals: Complex threats, business impact, global coordination
  • Why It Works: Multiple threat vectors, significant real-world impact, policy implications
  • IM Focus: Multi-vector response, business continuity, international cooperation

Raspberry Robin (Worm/APT ⭐⭐):

  • Learning Goals: Physical/digital convergence, living-off-the-land techniques, policy effectiveness
  • Why It Works: USB propagation teaches physical security, legitimate tool abuse shows detection challenges
  • IM Focus: Physical security integration, behavioral analysis, user education

For Advanced Concepts (Expert Teams)

Stuxnet (APT/Rootkit ⭐⭐⭐ Legendary):

  • Learning Goals: Nation-state threats, attribution, strategic implications
  • Why It Works: Sophisticated technical and political elements, attribution challenges, policy implications
  • IM Focus: Strategic thinking, attribution analysis, policy coordination

LockBit (Ransomware/Criminal ⭐⭐⭐):

  • Learning Goals: Criminal organizations, ransomware-as-a-service, law enforcement coordination
  • Why It Works: Modern threat landscape, business model analysis, international cooperation
  • IM Focus: Criminal threat analysis, business impact, law enforcement integration

Regional Variants and Customization

Industry-Specific Adaptations

Healthcare Variants:

  • Focus: Patient safety, HIPAA compliance, clinical system integration
  • Modifications: Add patient care continuity pressures, regulatory notification requirements
  • Learning Goals: Healthcare-specific risk assessment, compliance coordination

Financial Variants:

  • Focus: Transaction processing, PCI-DSS compliance, market stability
  • Modifications: Include trading system impacts, regulatory reporting, customer notification
  • Learning Goals: Financial sector risk management, regulatory coordination

Critical Infrastructure Variants:

  • Focus: Physical world impact, safety systems, national security
  • Modifications: Add SCADA/ICS elements, safety considerations, government coordination
  • Learning Goals: Infrastructure protection, public safety, strategic threats

Geographic Adaptations

Regulatory Environment Customization:

  • GDPR Regions: Add data protection authority notification, individual rights considerations
  • Different Legal Systems: Modify law enforcement coordination, legal evidence requirements
  • Cultural Considerations: Adapt communication styles, authority relationships, social factors

Advanced Malmon Mechanics

Hybrid Types and Complex Interactions

Multi-Type Malmons: Some Malmons combine characteristics from multiple types:

  • WannaCry (Worm/Ransomware): Network propagation + data encryption
  • Stuxnet (APT/Rootkit): Strategic patience + deep system access
  • Raspberry Robin (Worm/APT): Physical propagation + sophisticated persistence

IM Application:

  • Teach teams to recognize multiple threat characteristics
  • Guide development of multi-faceted response strategies
  • Emphasize complexity of real-world threats

Legendary Malmons

Special Characteristics:

  • Unprecedented capabilities: Multiple zero-days, novel techniques
  • Historical significance: Changed cybersecurity practices and policies
  • Strategic implications: Nation-state operations, infrastructure impacts
  • Attribution complexity: Advanced investigation and intelligence requirements

Facilitation Approach:

  • Reserve for expert teams ready for strategic-level thinking
  • Emphasize historical context and lessons learned
  • Include policy and strategic response discussions
  • Connect to current threat landscape and future implications

Building Scenario Complexity

Layered Threat Introduction

Basic Scenario Structure:

  1. Single Malmon: Focus on core concepts and team coordination
  2. Evolution Challenge: Add complexity through threat advancement
  3. Multi-Vector: Introduce related threats or coordinated campaigns
  4. Strategic Context: Include attribution, policy, and long-term implications

Progressive Complexity Management:

  • Start simple and add complexity based on team capability
  • Use evolution mechanics to introduce new challenges gradually
  • Allow teams to master basic concepts before adding advanced elements
  • Maintain focus on learning objectives over mechanical complexity

Environmental Factors

Organizational Maturity Levels:

  • Basic: Limited security tools, minimal incident response capability
  • Intermediate: Standard security controls, established IR processes
  • Advanced: Sophisticated security operations, threat hunting capabilities
  • Expert: Strategic threat intelligence, advanced coordination capabilities

Resource Constraints:

  • Limited Budget: Emphasize cost-effective approaches and prioritization
  • Small Team: Focus on coordination and external resource utilization
  • Time Pressure: Practice rapid decision-making and communication
  • Limited Expertise: Emphasize collaboration and knowledge sharing

Malmon Creation and Customization

Adapting Existing Malmons

Difficulty Adjustment:

  • Simplify for New Teams: Reduce evolution complexity, provide more guidance
  • Enhance for Experts: Add attribution elements, policy implications, strategic context
  • Industry Customization: Modify technical details and business impact for specific sectors
  • Regional Adaptation: Adjust regulatory and cultural elements for different contexts

Learning Objective Alignment:

  • Communication Focus: Choose Malmons that require significant stakeholder coordination
  • Technical Focus: Select threats that emphasize specific technical skills
  • Strategic Focus: Use Malmons with policy, attribution, or long-term implications
  • Crisis Management: Pick scenarios that test coordination and resource allocation

Community Contribution

Documenting New Variants:

  • Technical Accuracy: Base on real malware analysis and threat intelligence
  • Educational Value: Ensure clear learning objectives and type relationships
  • Facilitation Guidance: Include IM notes, question prompts, and common challenges
  • Community Review: Validate with other IMs and subject matter experts

Sharing Innovations:

  • Novel Techniques: Document new facilitation approaches and question strategies
  • Successful Adaptations: Share industry or regional customizations that work well
  • Challenge Solutions: Contribute solutions to common facilitation difficulties
  • Assessment Methods: Share evaluation techniques and learning measurement approaches

Assessment and Continuous Improvement

Evaluating Malmon Effectiveness

Learning Outcome Measures:

  • Concept Understanding: Do participants grasp key cybersecurity concepts?
  • Collaboration Quality: How well do teams coordinate and share knowledge?
  • Real-World Application: Can participants connect learning to their work context?
  • Engagement Level: Are participants actively involved and motivated?

Adaptation Indicators:

  • Too Simple: Teams solve quickly without significant discussion or learning
  • Too Complex: Teams become overwhelmed and disengage from learning
  • Misaligned: Scenario doesn’t match group’s learning needs or experience level
  • Technical Mismatch: Malmon characteristics don’t fit organizational context

Iterative Improvement Process

Session Reflection:

  • What worked well: Which Malmon characteristics created good learning opportunities?
  • What was challenging: Where did complexity interfere with learning objectives?
  • Participant Feedback: What aspects were most and least valuable for learning?
  • Facilitation Insights: What questions and techniques were most effective?

Community Learning:

  • Share Experiences: Contribute insights to community knowledge base
  • Learn from Others: Adopt successful techniques and adaptations from other IMs
  • Collaborative Development: Work with other IMs to improve Malmon designs
  • Research Integration: Incorporate findings from educational research and assessment

The Malmon system provides a flexible, scalable framework for cybersecurity education. Your mastery of this system enables you to create powerful learning experiences that adapt to your participants’ needs while maintaining educational rigor and real-world relevance.