FakeBat Scenario: Small Business Software Trap
FakeBat Scenario: Small Business Software Trap
Planning Resources
Scenario Details for IMs
Hook
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
- Hour 2: Key client requests an immediate preview of presentation materials
- Hour 3: Leadership demands a firm timeline for restoring reliable project systems
- Hour 4: Client-facing staff report reputational risk from visible quality delays
Evolution Triggers:
- If containment exceeds 3 hours, secondary payload behavior escalates credential risk
- If browser persistence is not removed, reinfection continues after partial cleanup
- If update-source controls are not enforced, additional staff may repeat the same install path
Resolution Pathways:
Technical Success Indicators:
- Team identifies the masquerading update chain and removes persistence artifacts
- Endpoint controls block untrusted update sources and unauthorized extension installs
- Credential resets and session revocations stop ongoing account abuse
Business Success Indicators:
- Client deliverables proceed with controlled disruption and transparent risk messaging
- Service operations stabilize while remediation completes
- Security controls are added without disabling core consulting workflows
Learning Success Indicators:
- Team understands how software masquerading targets routine productivity behavior
- Participants recognize why verification controls matter in small organizations
- Group demonstrates practical balancing of delivery commitments and containment rigor
Common IM Facilitation Challenges:
If Team Focuses Too Heavily on Technical Details:
“How will your technical findings translate into a clear client-facing update before the presentation review call?”
If Business Stakeholders Are Ignored:
“Leadership is asking which systems can be trusted today and which workflows require manual fallback. What is your recommendation?”
If Software Masquerading Is Missed:
“Why were these update prompts convincing to experienced consultants under deadline pressure, and how will you prevent that pattern next week?”
Success Metrics for Session:
Template Compatibility
Quick Demo (35-40 min)
- Rounds: 1
- Actions per Player: 1
- Investigation: Guided
- Response: Pre-defined
- Focus: Use Hook and Initial Symptoms for rapid setup. Present guided clues at short intervals, then move to immediate containment and communication choices.
Lunch & Learn (75-90 min)
- Rounds: 2
- Actions per Player: 2
- Investigation: Guided
- Response: Pre-defined
- Focus: Expand decision pressure across technical containment, client confidence, and governance obligations.
Full Game (120-140 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Focus: Players design and justify their own response path balancing operational, legal, and reputational outcomes.
Advanced Challenge (150-170 min)
- Rounds: 3
- Actions per Player: 2
- Investigation: Open
- Response: Creative
- Complexity: Add conflicting signals from legitimate updates and partial telemetry to force evidence-based prioritization.
Quick Demo Materials (35-40 min)
Guided Investigation Clues
Clue 1 (Minute 5): “Multiple project workstations downloaded unsigned update executables from lookalike vendor domains registered in the last week.”
Clue 2 (Minute 10): “The binaries are not vendor-signed and install browser extensions with broad content-modification permissions.”
Clue 3 (Minute 15): “Traffic logs confirm redirect chains and ad injection into active client deliverable workflows.”
Pre-Defined Response Options
Option A: Full Endpoint Remediation and Verification
- Action: Remove unauthorized software and extensions, rebuild trust baselines, and enforce approved update sources.
- Pros: High confidence containment with durable prevention controls.
- Cons: Requires temporary productivity loss during cleanup.
- Type Effectiveness: Super effective against Trojan and Downloader behaviors.
Option B: Browser Containment First
- Action: Reset browser state, remove unauthorized extensions, block malicious redirect paths, and monitor for reinfection.
- Pros: Fast reduction in visible impact on client workstreams.
- Cons: Underlying endpoint compromise may persist.
- Type Effectiveness: Moderately effective against Browser Hijacker behavior.
Option C: Infrastructure Blocking and Monitoring
- Action: Block malicious domains and C2 destinations while collecting forensic evidence.
- Pros: Prevents additional downloads and outbound command traffic.
- Cons: Does not remediate already compromised hosts.
- Type Effectiveness: Partially effective against Downloader behavior.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Initial Detection and Delivery Risk (35-40 min)
Time-Stamped Investigation Clues:
- Minute 5: Unsigned installers are found on systems used for active client projects
- Minute 8: Browser injection and persistence artifacts are confirmed
- Minute 12: Network logs show repeated callbacks to newly registered infrastructure
- Minute 16: Staff report urgent update prompts appeared during deadline-critical tasks
- Minute 20: Extension permission scope indicates potential exposure of project credentials
Pressure Event (Minute 22): “A client stakeholder requests immediate assurance that deliverable systems are safe before final review materials are accepted.”
Response Options:
- Option A: Full remediation before any further client delivery actions
- Option B: Staged restoration with high-risk systems isolated first
- Option C: Evidence-first approach to preserve investigation quality before full cleanup
Round 1 Debrief: “Which action most reduced near-term business risk while preserving evidence quality for follow-up decisions?”
Round 2: Reporting, Governance, and Client Trust (35-45 min)
Evolution Based on Round 1 Choice: Containment status improves, but credential risk and stakeholder expectations now drive response quality.
Facilitation questions:
- “What minimum evidence threshold justifies external communication to clients and regulators?”
- “How do you sequence containment, client updates, and governance reporting under deadline pressure?”
- “Which decisions are reversible, and which would create long-term trust damage if wrong?”
Key Learning Objectives (Lunch & Learn)
Technical: Update-source verification, persistence identification, and practical endpoint containment.
Business: Deadline protection, client confidence preservation, and transparent decision-making.
Incident Response: Evidence-driven triage, proportional reporting, and governance alignment under pressure.
Full Game Materials (120-140 min, 3 rounds)
Round 1: Discovery and Immediate Containment (35-40 min)
Players investigate openly. Expected findings include spoofed update sources, browser manipulation, credential-exposure risk, and weak software governance across shared project endpoints.
If team stalls: “Client delivery decisions are due now. Which systems can remain in use today, and which must be isolated immediately?”
Facilitation questions:
- “What is your fastest high-confidence containment action?”
- “How do you keep client trust while uncertainty remains?”
- “Who signs off on production-system reactivation?”
Round 1→2 Transition
Initial containment reduces immediate disruption, but evidence quality and communication strategy now determine whether the incident stays manageable.
Round 2: Trust, Reporting, and Control Validation (35-40 min)
Technical remediation continues while leadership demands defensible updates for clients and governance stakeholders.
Facilitation questions:
- “Do you communicate early with partial certainty or wait for stronger validation?”
- “What evidence package supports your reporting decisions?”
- “How do you preserve productivity without reintroducing compromise risk?”
Round 2→3 Transition
Operational risk is reduced, but longer-term business resilience now depends on practical control design and sustained behavior change.
Round 3: Recovery and Sustainable Security Model (40-55 min)
Victory conditions for full 3-round arc:
- Compromised update chain removed and persistence eliminated
- Client communication delivered with accurate, defensible evidence
- Governance obligations met in-region with no unresolved compliance actions
- Sustainable, budget-aligned controls adopted for ongoing consulting operations
Debrief Focus
- Why software update trust is a high-risk dependency in small professional-service firms
- How to align technical containment with client-facing communication under deadline stress
- Which controls deliver the highest protection value per dollar in low-margin environments
- How to prevent recurrence without crippling delivery speed
Advanced Challenge Materials (150-170 min)
Red Herrings and Misdirection
- A legitimate software update release creates overlapping performance symptoms.
- Shared account usage blurs attribution across multiple endpoints.
- Hosting-side latency issues mimic malware-related client portal instability.
- Benign browser plugins create noise during extension triage.
Removed Resources and Constraints
- No external malware reference material during play
- No dedicated in-house security staff
- Partial endpoint logging with data gaps
- Emergency spending requires leadership approval
Enhanced Pressure
- Client review is moved up by 24 hours
- Competitors circulate security-focused messaging in the same market window
- Internal rumor sharing increases reputational risk
- New lookalike update domains appear during remediation
Ethical Dilemmas
- Disclosure timing: “Is early disclosure with partial certainty better than delayed disclosure with stronger evidence?”
- Team accountability: “How do you address risky install behavior without creating a blame culture that hides future incidents?”
- Budget realism: “If full remediation is unaffordable this quarter, which controls are non-negotiable and why?”
- Client trust tradeoff: “How transparent can you be about risk without triggering avoidable contract loss?”
Advanced Debrief Topics
- Decision quality under constrained telemetry and compressed business deadlines
- Control prioritization in small-service organizations with limited financial slack
- Communication frameworks that preserve trust when facts are still emerging
- Long-term governance patterns that reduce repeat exposure to masquerading campaigns