FakeBat Scenario: Nonprofit Organization Deception
FakeBat Scenario: Nonprofit Organization Deception
Planning Resources
Scenario Details for IMs
Hook
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
- Hour 2: A major donor calls to confirm gala attendance and asks whether donor data is safe
- Hour 3: Leadership demands an immediate operational plan for volunteer systems and donor communications
- Hour 4: A prospective donor questions the organization’s cybersecurity posture after observing browser issues
Evolution Triggers:
- If containment takes longer than 3 hours, the attacker begins targeting donor CRM authentication flows
- If browser security is not addressed, malware creates persistent reinfection vectors across volunteer systems
- If fake software sources are not identified, additional volunteers may install the same malicious tooling
Resolution Pathways:
Technical Success Indicators:
- Team identifies the software masquerading chain through installer and browser telemetry analysis
- Browser hardening and software allowlisting prevent future unauthorized installs on volunteer endpoints
- Credential reset and session revocation block continued donor platform abuse
Business Success Indicators:
- Fundraising gala proceeds with minimal disruption despite the incident
- Donor confidence is maintained through clear, accurate communication
- Volunteer operations continue while malware is removed and systems are stabilized
Learning Success Indicators:
- Team understands how software masquerading exploits nonprofit resource constraints and trust dynamics
- Participants recognize why software verification is critical in volunteer-managed environments
- Group demonstrates balance between operational continuity and cybersecurity controls
Common IM Facilitation Challenges:
If Team Focuses Too Heavily on Technical Details:
“Your technical analysis is strong, but how will you explain current risk to a major donor asking whether gala communications are still safe?”
If Business Stakeholders Are Ignored:
“Leadership needs an answer now: what can be restored before the gala, and what needs a temporary manual workaround?”
If Software Masquerading Is Missed:
“The indicators are clear, but why did volunteers trust these specific security tools at this exact moment before a major fundraising event?”
Success Metrics for Session:
Template Compatibility
Quick Demo (35-40 min)
- Rounds: 1
- Actions per Player: 1
- Investigation: Guided
- Response: Pre-defined
- Focus: Use the Hook and Initial Symptoms to quickly establish the nonprofit crisis. Present guided clues at 5-minute intervals, then move to predefined responses and a short debrief on trust, phishing-resistant workflows, and software verification.
Lunch & Learn (75-90 min)
- Rounds: 2
- Actions per Player: 2
- Investigation: Guided
- Response: Pre-defined
- Focus: Add realistic governance pressure and donor communication complexity. Two rounds let the team experience both technical containment and regulatory or oversight decision-making.
Full Game (120-140 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Focus: Players run open investigation and build their own response strategy balancing endpoint security, donor trust, volunteer coordination, and nonprofit governance obligations.
Advanced Challenge (150-170 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Complexity: Add red herrings from legitimate updates and shared workstation noise. Force decision-making with incomplete information and competing mission priorities.
Quick Demo Materials (35-40 min)
Guided Investigation Clues
Clue 1 (Minute 5): “You discover that volunteer workstations visited nonprofit-security-tools.org and charity-data-protection.com yesterday, then downloaded NonprofitSecure_Suite.exe and DonorProtect_Tool.exe. Both domains were registered last week.”
Clue 2 (Minute 10): “File analysis shows the installers lack valid publisher signatures. Legitimate nonprofit security tools from trusted vendors should be signed and verifiable.”
Clue 3 (Minute 15): “New browser extensions named Nonprofit Data Guard and Charity Security Helper now have permissions to access donor form data and inject redirected links.”
Pre-Defined Response Options
Option A: Remove Malware and Verify Software Sources
- Action: Uninstall unauthorized software and extensions, remove active malware components, verify approved software sources, and implement install controls for volunteer endpoints.
- Pros: Removes the active threat and reduces repeat compromise risk.
- Cons: Takes time and may temporarily disrupt gala preparation workflows.
- Type Effectiveness: Super effective against Trojan and Downloader behavior.
Option B: Browser Security Hardening for Volunteers
- Action: Reset affected browsers, remove unauthorized extensions, enforce browser security policies, and lock down extension install permissions.
- Pros: Quickly reduces visible hijacking and protects donor communication sessions.
- Cons: Does not fully address deeper endpoint compromise on its own.
- Type Effectiveness: Moderately effective against Browser Hijacker behavior.
Option C: Block Malicious Infrastructure and Monitor
- Action: Block known malicious domains and C2 destinations, add DNS and firewall detections, and monitor for new lookalike domains.
- Pros: Limits reinfection and outbound communications.
- Cons: Existing compromised hosts still require remediation.
- Type Effectiveness: Partially effective against Downloader behavior.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Initial Detection and Gala Readiness Crisis (35-40 min)
Time-Stamped Investigation Clues:
- Minute 5: Multiple volunteer workstations visited suspicious domains and downloaded unsigned installers
- Minute 8: Memory analysis shows browser injection behavior and unauthorized persistence
- Minute 12: DNS logs reveal recurring callbacks from volunteer endpoints to ad-tech and malware delivery infrastructure
- Minute 16: Staff report fake compliance warnings that appeared while processing donor records
- Minute 20: Browser extensions with donor form permissions are found on shared machines
Pressure Event (Minute 22): “A major donor asks whether the gala communications channel is trustworthy right now and expects an answer before confirming attendance.”
Response Options:
- Option A: Full volunteer workstation remediation and software verification before gala messaging resumes
- Option B: Immediate browser containment and staged endpoint cleanup to protect donor communications first
- Option C: Forensic-first approach for evidence preservation and governance reporting, then remediation
Round 1 Debrief: “How did you balance leadership pressure for event continuity against the time needed for safe technical containment?”
Round 2: Donor Data Exposure and Oversight Decisions (35-45 min)
Evolution Based on Round 1 Choice: Containment progress varies, but deeper telemetry shows credential theft attempts against donor systems and increased scrutiny from governance stakeholders.
Advanced Investigation Clues:
- Minute 44: Loader behavior indicates credential collection from volunteer endpoints used for donor operations
- Minute 49: Session and token artifacts suggest attempted reuse against donor management systems
- Minute 54: Attribution points to malvertising campaigns themed around nonprofit compliance and data protection tools
- Minute 59: Donor outreach quality drops as trust concerns spread through board and supporter channels
NPC Interaction Priorities:
- Executive leadership: Preserve donor confidence and protect mission-critical fundraising
- IT management: Coordinate remediation, containment validation, and evidence capture
- Programs leadership: Maintain service continuity while donor operations are constrained
Round 2 Debrief: “Which decision most improved trust outcomes: faster communication, stronger containment evidence, or clearer governance alignment?”
Key Learning Objectives (Lunch & Learn)
Technical: Software masquerading, browser injection, credential theft workflows, and practical endpoint containment in low-resource environments.
Business: Donor confidence protection, nonprofit governance pressure, and operational tradeoffs before mission-critical events.
Incident Response: Triage under uncertainty, communication timing, and defensible documentation for oversight bodies.
Full Game Materials (120-140 min, 3 rounds)
Round 1: Discovery and Immediate Containment (35-40 min)
Players investigate openly using role capabilities. Key discoveries include malvertising distribution paths, unsigned installers, extension abuse, credential theft indicators, and weak software governance on shared volunteer endpoints.
If team stalls: “Programs leadership needs a decision now: do we pause donor outreach channels for containment, or continue with manual safeguards while cleanup is still in progress?”
Facilitation questions:
- “What containment action gives the fastest risk reduction without destroying gala readiness?”
- “How do you justify your evidence threshold before informing donors that systems are safe again?”
- “Which role owns final approval for re-enabling volunteer endpoints tied to donor operations?”
Round 1→2 Transition
The team’s initial approach shapes investigation depth, communication credibility, and governance confidence. Regardless of path, the scenario shifts from technical cleanup to oversight-driven decision-making.
Round 2: Oversight, Reporting, and Trust Management (35-40 min)
Cross-functional pressure increases as board members demand defensible evidence of containment and a clear accountability path for donor communications.
Facilitation questions:
- “Do you prioritize fast donor updates with partial certainty, or delay until validation is complete?”
- “What is your minimum evidence package for leadership sign-off and external reporting?”
- “How do you prevent scope creep while maintaining credible forensic rigor?”
Round 2→3 Transition
Immediate technical risk stabilizes, but long-term trust and operating resilience now dominate. The final round focuses on building a sustainable nonprofit security model that can survive staff turnover and budget constraints.
Round 3: Trust Recovery and Security Architecture (40-55 min)
Victory conditions for full 3-round arc:
- Compromised tooling removed and donor-facing channels restored with verified controls
- Donor communication handled with consistent, evidence-based messaging
- Governance obligations documented and met without mission failure
- Sustainable security practices established for volunteer-driven operations
Debrief Focus
- How nonprofit mission pressure changes incident prioritization compared to commercial organizations
- Why software verification and endpoint governance matter most when volunteer endpoints are shared
- How to align leadership, technical teams, and donor communications under uncertainty
- How to build resilient security operations with limited budget and rotating staff
Advanced Challenge Materials (150-170 min)
Red Herrings and Misdirection
- Legitimate software updates: A real CRM update occurred in the same window, creating overlapping performance symptoms.
- Shared endpoint noise: Multiple volunteers used the same laptops, making infection timelines unreliable.
- Hosting migration artifacts: Donor portal latency from a hosting change resembles malware-related disruption.
- Training overlap: Legitimate data-protection extensions were installed recently and look suspicious during triage.
Removed Resources and Constraints
- No malware reference guide during gameplay
- No immediate external incident response retainer
- Limited logging from volunteer-managed endpoints
- Board approval required for emergency unplanned spending
Enhanced Pressure
- Gala logistics timeline compresses by 24 hours
- A board member pushes enterprise controls that exceed nonprofit operating realities
- A donor posts publicly about suspicious messages that may be linked to the incident
- A volunteer coordinator reports unusual sign-ins across shared accounts
Ethical Dilemmas
- Mission services vs. security investment: “How do you justify urgent security spending when those funds could support direct community programs this quarter?”
- Volunteer accountability: “How do you improve controls without alienating volunteers who acted in good faith?”
- Disclosure timing: “What level of uncertainty is acceptable when notifying donors about potential data exposure?”
- Public narrative control: “Is it better to confirm the incident early with partial facts, or wait for complete validation and risk appearing opaque?”
Advanced Debrief Topics
- Practical security governance for nonprofit operations with volunteer-heavy staffing
- Donor trust dynamics when technical details are uncertain but reputational stakes are immediate
- How to translate containment evidence into board-level decisions
- Building repeatable response playbooks that remain usable under resource constraints