Gh0st RAT Scenario: Corporate Technology Espionage Campaign
Gh0st RAT Scenario: Corporate Technology Espionage Campaign
Planning Resources
Scenario Details for IMs
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
Evolution Triggers:
- If response is delayed, attackers may complete systematic theft of all classified defense technology research and specifications
- If containment fails, contractor network compromises may result in broader national security implications and contract cancellations
- If federal coordination is inadequate, defense procurement status could be suspended affecting company operations
Resolution Pathways:
Technical Success Indicators:
- Complete elimination of persistent adversary access using advanced threat hunting techniques
- Contractor network security assessment confirming no lateral movement to defense and technology partners
- Enhanced security monitoring preventing future living-off-the-land attack techniques
Business Success Indicators:
Learning Success Indicators:
- Team understands advanced persistent threat techniques and living-off-the-land detection
- Participants recognize corporate espionage targeting and technology intellectual property protection requirements
Common IM Facilitation Challenges:
Success Metrics for Session:
Template Compatibility
Quick Demo (35-40 min)
Structure: 2 investigation rounds, 1 decision round
Focus: Core technology theft discovery
Key Actions: Identify living-off-the-land techniques, implement network segmentation
Use the “Hook” and “Initial Symptoms” to quickly establish technology espionage crisis. Present the guided investigation clues at 5-minute intervals. Offer pre-defined response options for the team to choose from. Quick debrief should focus on recognizing APT techniques and defense security implications.
Lunch & Learn (75-90 min)
Structure: 2 investigation rounds, multiple response options
Focus: Persistent threat discovery and containment strategy
Key Actions: Investigate living-off-the-land techniques, coordinate defense agency response
This template allows for deeper exploration of corporate espionage and defense technology security challenges. Use the full set of NPCs to create realistic defense agency investigation and contract review pressures. The two rounds allow discovery of contractor lateral movement and technology theft, raising stakes. Debrief can explore balance between incident response and defense security coordination.
Full Game (120-140 min)
Structure: 3 investigation and response rounds
Focus: Complete technology espionage campaign discovery and recovery
Key Actions: Open investigation, creative response, strategic recovery planning
Players have freedom to investigate using the “Key Discovery Paths” as IM guidance. They must develop response strategies balancing threat hunting, contractor relationship protection, and defense coordination. The three rounds allow for full narrative arc including APT discovery, contractor compromise assessment, and defense contract implications.
Advanced Challenge (150-170 min)
Structure: 3 rounds with red herrings and constraints
Focus: Advanced APT techniques and conflicting federal requirements
Key Actions: Detection under adversarial conditions, navigate conflicting agency guidance
Add red herrings (e.g., legitimate cloud administration causing false positives). Make containment ambiguous, requiring players to justify agency notification decisions with incomplete forensic evidence. Remove access to reference materials to test knowledge recall of APT behavior and defense technology security principles.
Quick Demo Materials (35-40 min)
Pre-Defined Response Options
Option A: Complete Threat Hunting & Federal Coordination
- Action: Conduct comprehensive threat hunting eliminating all persistent adversary access, coordinate with federal investigators about classified technology exposure, immediately notify all defense contractors and partners, implement enhanced security monitoring preventing living-off-the-land techniques.
- Type Effectiveness: Super effective against APT malmon type; complete adversary removal prevents continued corporate espionage and technology theft.
Option B: Targeted Remediation & Partner Security Assessment
- Action: Remediate confirmed compromised systems, conduct targeted partner network security assessments, selectively notify contractors with confirmed technology exposure, coordinate selective federal reporting while maintaining business operations.
- Pros: Allows evidence gathering before notifications; protects key contractor relationships through informed communication; enables focused federal coordination.
- Cons: Risks continued adversary presence in undetected locations; selective federal coordination may violate defense procurement obligations; contractor trust damaged if lateral movement discovered later.
- Type Effectiveness: Moderately effective against APT threats; reduces but doesn’t eliminate persistent access; delays complete corporate espionage remediation.
Option C: Business Continuity & Phased Security Response
- Action: Implement emergency secure research environment for critical defense projects, phase threat hunting by research priority, establish enhanced monitoring while investigating full compromise scope, coordinate gradual federal notification.
- Pros: Maintains critical technology research revenue during incident response; protects highest-priority classified projects first; enables controlled communication timing.
- Cons: Phased approach extends adversary presence timeline; emergency operations may not prevent continued espionage; gradual notification delays may violate federal coordination requirements.
- Type Effectiveness: Partially effective against APT malmon type; prioritizes business continuity over complete federal coordination; doesn’t guarantee corporate espionage cessation.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Advanced Persistent Threat Discovery (40-45 min)
Investigation Clues (Time-Stamped)
T+0 (Round Start):
T+15 (Mid-Round Pressure):
T+25 (Round Transition Setup):
- Detective Discovery: “Timeline analysis confirms attackers used vendor portal compromise to establish initial access, then deployed sophisticated remote access tool disguised as cloud administration utilities. They’ve been systematically exfiltrating technology specifications from classified defense projects.”
- Critical Decision Point: Team must decide whether to immediately notify all defense contractor/keiretsu partners about potential compromise, risking contract cancellations, or conduct targeted assessment first.
Response Options for Round 1
Option A: Immediate Federal Coordination & Partner Notification
- Action: Contact federal investigators immediately, notify all defense contractors and partners about potential compromise, begin comprehensive threat hunting across research firm and partner environments.
- Type Effectiveness: Super effective against APT - establishes proper federal oversight and partner protection.
- Consequences: Leads to Round 2 with federal investigators actively involved, some partners demanding immediate remediation, defense status under review.
Option B: Targeted Assessment Before Broad Notification
- Action: Conduct rapid targeted assessment of partner compromise scope, coordinate with federal investigators before broad notification, prioritize defense contractors with classified project exposure.
- Pros: Allows evidence gathering before notifications; protects key partner relationships through informed communication; enables focused federal coordination.
- Cons: Delays may violate defense/procurement obligations; risks additional technology theft during assessment; partners may discover compromise independently.
- Type Effectiveness: Moderately effective against APT - balances investigation with notification requirements.
- Consequences: Leads to Round 2 with partial partner notifications, increased federal pressure for complete disclosure, risk of independent discovery by partners.
Option C: Emergency Secure Operations & Phased Response
- Action: Implement emergency secure research environment for critical defense projects, phase threat hunting by project classification level, establish enhanced monitoring while coordinating gradual federal notification.
- Pros: Maintains critical research revenue during investigation; protects highest-risk classified projects first; enables controlled communication timing.
- Cons: Phased approach extends remediation timeline; emergency operations may not prevent continued espionage; selective notification may violate federal requirements.
- Type Effectiveness: Partially effective against APT - prioritizes business continuity over complete federal coordination.
- Consequences: Leads to Round 2 with business operations continuing but federal investigators questioning notification delays, increased risk of procurement violations.
Facilitation Questions for Round 1
- “How do living-off-the-land techniques using legitimate cloud services challenge traditional malware detection?”
- “What are the national security implications of corporate espionage targeting defense contractor partnerships?”
- “How should incident response balance federal coordination requirements with business relationship protection?”
- “What makes vendor portal compromises particularly dangerous for trusted technology partnerships?”
Round 1 Transition Narrative
Based on team’s chosen response option:
Round 2: Technology Theft & Defense Status Crisis (35-45 min)
Investigation Clues (Time-Stamped)
T+0 (Round Start – Building on Round 1 outcome):
T+15 (Mid-Round Pressure):
T+25 (Round Transition Setup):
- Critical Business Decision: Defense/procurement status suspension would eliminate 70% of company revenue. Team must balance complete threat remediation with business survival while maintaining federal coordination.
- Technical Challenge: Removing persistent access from partner environments requires coordinating with six different defense/technology partners, each with different security requirements and operational constraints.
Response Options for Round 2
Option A: Complete Partner Remediation & Defense Status Demonstration
Option B: Prioritized Partner Security & Federal Evidence Coordination
Option C: Business Survival & Minimum Viable Remediation
Facilitation Questions for Round 2
- “How does trusted technology partnership access create unique lateral movement risks in defense contractor environments?”
- “What are the defense security implications when a technology company’s compromise leads to classified research theft?”
- “What makes coordinated multi-organization threat hunting particularly challenging in defense technology sectors?”
Victory Conditions for Lunch & Learn
Debrief Topics
Full Game Materials (120-140 min, 3 rounds)
Round 1: Initial APT Discovery & Vendor Portal Compromise (35-40 min)
Round 1→2 Transition
Round 2: Partner Lateral Movement & Technology Theft (40-45 min)
If containment succeeded in Round 1: Partner environments still require coordinated threat hunting – each has different security requirements, classification levels, and remediation expectations. The limited threat hunting team can only address two partner environments simultaneously.
If containment is still in progress: Attackers have detected the investigation and established additional backup persistence mechanisms. VP Research reports: “Federal investigators just accelerated the clearance review timeline – we need evidence of complete remediation within 48 hours instead of 30 days.”
Facilitation questions:
- “You have one threat hunting team and six partner environments need simultaneous remediation. How do you prioritize, and how do you justify that prioritization to the partners who have to wait?”
- “Federal investigators want investigation preservation while defense clearance authorities demand immediate disclosure to all affected partners. How do you navigate contradictory federal guidance?”
- “Classified research data has been found on foreign intelligence infrastructure. How does confirmed nation-state attribution change your response strategy?”
Round 2→3 Transition
Round 3: Defense Status Review & Business Recovery (40-55 min)
Debrief Focus
Advanced Challenge Materials (150-170 min)
Red Herrings & Misdirection
- Legitimate cloud administration: Employees performing authorized Azure AD management and AWS monitoring create activity patterns indistinguishable from attacker behavior – teams must develop behavioral baselines to differentiate legitimate from malicious administrative actions.
- Vendor portal false lead: The compromised portal access traces to a recently terminated employee’s credentials, tempting teams to pursue an insider threat investigation that wastes critical time.
- Partner penetration testing: One defense contractor partner conducted authorized penetration testing last month – some forensic indicators match this legitimate activity rather than actual lateral movement.
- Network monitoring confusion: False positive alerts from security tools triggered by normal research operations and cloud service integration create noise obscuring actual threat indicators.
Removed Resources & Constraints
- No MITRE ATT&CK framework lookup during gameplay – players must recall living-off-the-land techniques from memory
- No federal regulation quick-reference guides for defense clearance notification requirements
- Limited threat hunting team can only support two partner environments simultaneously – must prioritize with incomplete damage assessment
- Some defense contractor partners refuse on-site access until federal investigation completes, creating forensic blind spots