Scenario Card Collection
This appendix contains 52 ready-to-use scenario cards that provide specific organizational contexts and incident setups for each malmon. Each card includes stakeholders, timeline pressures, and discovery hooks tailored to different industries and organizational types.
How Scenario Cards Work
Scenario cards transform generic malmon encounters into specific, relatable incidents by providing:
- Organizational Context: Realistic workplace settings with industry-specific details
- Key Stakeholders: Named NPCs with clear motivations and concerns
- Timeline Pressure: Realistic deadlines that drive decision-making urgency
- Discovery Hooks: Multiple starting points for player investigation
- Success Metrics: Clear objectives for incident resolution
Scenario Cards by Malmon
Gaboon Grabber (Phishing Specialist)
GaboonGrabber Scenario: Healthcare Implementation Crisis
Scenario Details for IMs
Opening Presentation
“It’s Friday afternoon at MedTech Solutions, and the mood should be celebratory - your biggest implementation ever goes live Monday morning at St. Mary’s Hospital. But instead of champagne, there’s growing concern. Multiple staff members are reporting computer slowdowns, and the help desk has received several calls about unexpected pop-ups. Yesterday during the final push, several IT staff received what appeared to be critical security updates. With everything riding on Monday’s go-live, investigate what’s happening.”
Initial Symptoms to Present:
- “Computers running 30% slower since yesterday afternoon”
- “Help desk reports 5 calls about unexpected pop-ups appearing”
- “IT staff mention receiving ‘urgent security update’ emails Thursday evening”
- “Some applications taking longer to start than usual”
Key Discovery Paths:
Detective Investigation Leads:
- Email logs show suspicious ‘SecurityUpdate.exe’ attachments from fake IT security vendor
- Process monitoring reveals unfamiliar executables running from temp directories
- Registry analysis shows new startup entries for legitimate-sounding but suspicious processes
Protector System Analysis:
- Memory scans reveal process injection into legitimate Windows processes
- Network monitoring shows unusual outbound connections to suspicious domains
- System performance metrics indicate hidden processes consuming CPU and memory
Tracker Network Investigation:
- DNS logs show queries to recently registered domains mimicking security vendors
- Network traffic analysis reveals encrypted communication to command and control servers
- Email flow analysis shows phishing campaign specifically targeted during implementation stress
Communicator Stakeholder Interviews:
- IT staff admit clicking on urgent security updates due to project pressure
- Hospital staff expressing concerns about system stability before go-live
- Management inquiry reveals pressure to approve software quickly for client satisfaction
Mid-Scenario Pressure Points:
- Hour 2: Hospital calls asking for system status update and go-live confirmation
- Hour 3: COO demands explanation for why “IT problems” might delay major implementation
- Hour 4: CEO receives call from hospital threatening to find alternative vendor
Evolution Triggers:
- If containment takes longer than 4 hours, GaboonGrabber begins deploying secondary payloads
- If network isolation is incomplete, malware spreads to additional systems
- If hospital connectivity isn’t secured, threat extends to client environment
Resolution Pathways:
Technical Success Indicators:
- Team identifies GaboonGrabber through behavioral analysis rather than signature detection
- Comprehensive network isolation prevents spread while maintaining business continuity
- Memory forensics and process injection analysis confirms complete threat removal
Business Success Indicators:
- Stakeholder communication maintains hospital relationship despite security incident
- Implementation timeline adjusted with minimal impact on patient safety preparations
- Security improvements integrated into go-live process without compromising deadline
Learning Success Indicators:
- Team understands how organizational pressure creates social engineering vulnerabilities
- Participants recognize importance of maintaining security controls during high-stress periods
- Group demonstrates effective communication between technical and business stakeholders
Common IM Facilitation Challenges:
If Team Focuses Too Heavily on Technical Details:
“That’s excellent analysis of the process injection techniques. How does this information help you communicate the urgency to hospital leadership who are calling for updates?”
If Business Stakeholders Are Ignored:
“While you’re conducting this thorough investigation, Sarah just got another call from the hospital CIO asking for go-live confirmation. How do you handle that conversation?”
Success Metrics for Session:
GaboonGrabber Scenario: RegionalBank Compliance Crisis
Scenario Details for IMs
Opening Presentation
“It’s Tuesday morning at RegionalBank, and the quarterly board meeting just ended with one clear message: the upcoming federal examination must go perfectly. With just four weeks to prepare, every department is scrambling to demonstrate compliance improvements. But yesterday, several staff members reported computer slowdowns, and the IT help desk has been fielding calls about new ‘audit software’ that appeared after staff responded to what seemed like legitimate regulatory security requirements.”
Initial Symptoms to Present:
- “Computers experiencing 25% performance degradation across multiple departments”
- “Help desk reports 6 calls about unfamiliar ‘compliance monitoring’ software”
- “Staff mention receiving ‘federal banking security audit’ emails Monday evening”
- “Customer service terminals occasionally freezing during peak hours”
Key Discovery Paths:
Detective Investigation Leads:
- Email analysis reveals sophisticated spoofing of federal banking regulator communications
- File system examination shows “ComplianceMonitor.exe” and “AuditTool.exe” in system directories
- Registry forensics reveals persistence mechanisms disguised as regulatory compliance tools
Protector System Analysis:
- Network monitoring detects encrypted communication to command servers registered recently
- Process analysis shows memory injection into banking software and customer service applications
- Security log review reveals unauthorized access attempts to customer database systems
Tracker Network Investigation:
- DNS query analysis shows lookups to domains mimicking federal banking regulator websites
- Traffic analysis reveals data exfiltration patterns targeting customer account information
- Email flow investigation shows targeted phishing campaign during examination preparation
Communicator Stakeholder Interviews:
- Compliance staff admit clicking on “urgent audit requirements” to demonstrate cooperation
- Branch managers reveal pressure to respond immediately to any regulatory communications
- IT staff explain expedited approval of “compliance tools” to meet examination deadlines
Mid-Scenario Pressure Points:
- Hour 1: Compliance officer demands confirmation that all “audit tools” are properly installed
- Hour 2: Federal examiner calls to confirm examination schedule and document preparation
- Hour 3: Board chair inquires about compliance readiness and any potential issues
- Hour 4: Customer service reports intermittent access issues affecting transaction processing
Evolution Triggers:
- If containment exceeds 6 hours, GaboonGrabber deploys secondary payload targeting customer data
- If network isolation affects compliance systems, regulatory documentation becomes inaccessible
- If customer-facing systems show instability, transaction processing integrity becomes questionable
Resolution Pathways:
Technical Success Indicators:
- Team identifies social engineering exploitation of compliance pressure and culture
- Network segmentation protects customer data while maintaining transaction processing
- Behavioral analysis and memory forensics confirm complete malware removal
Business Success Indicators:
- Incident response demonstrates robust security controls to federal examiner
- Compliance documentation includes security incident as evidence of effective monitoring
- Customer transaction processing maintains integrity throughout response process
Learning Success Indicators:
- Team understands how compliance pressure creates exploitable organizational vulnerabilities
- Participants recognize balance needed between compliance responsiveness and security verification
- Group demonstrates effective coordination between compliance, security, and operational teams
Common IM Facilitation Challenges:
If Team Ignores Compliance Context:
“Your technical analysis is solid, but Amanda just received a call from the federal examiner asking about your bank’s security posture. How do you explain this incident as evidence of strong security controls?”
If Business Impact Is Underestimated:
“While you’re investigating, the customer service system just froze during peak banking hours. Customers are waiting in line and Maria needs to know if the systems are safe to use.”
If Regulatory Complexity Overwhelms:
“The regulatory details are complex, but the core question is simple: how do you maintain security when everyone feels pressure to demonstrate immediate compliance?”
Success Metrics for Session:
GaboonGrabber Scenario: StateU Financial Aid Crisis
Scenario Details for IMs
Opening Presentation
“It’s Wednesday afternoon at StateU, and the financial aid office is in crisis mode. Spring semester aid disbursements must be completed by Friday to ensure students can pay summer housing deposits and register for fall classes. But starting yesterday, multiple computers in the financial aid office have been running slowly, and both staff and students are reporting issues with ‘financial aid processing software’ that appeared after responding to what seemed like urgent FAFSA system updates.”
Initial Symptoms to Present:
- “Financial aid office computers running 40% slower during peak processing time”
- “Students calling about ‘new financial aid software’ requiring personal information updates”
- “Staff report receiving ‘emergency FAFSA processing’ emails Tuesday evening”
- “University ID card systems experiencing intermittent connectivity issues”
Key Discovery Paths:
Detective Investigation Leads:
- Email forensics reveal sophisticated spoofing of federal financial aid system communications
- File analysis discovers “FAFSAProcessor.exe” and “AidDisbursement.exe” in financial aid workstations
- Log analysis shows unauthorized access attempts to student information systems
Protector System Analysis:
- Memory analysis reveals process injection into financial aid processing applications
- Network monitoring detects unusual data flows from student records systems
- System integrity scans show modifications to financial aid database access controls
Tracker Network Investigation:
- DNS logs show queries to domains mimicking federal student aid websites
- Traffic analysis reveals attempted exfiltration of student financial records
- Email pattern analysis shows coordinated phishing targeting both staff and students
Communicator Stakeholder Interviews:
- Financial aid staff admit clicking on urgent processing tools to meet student deadlines
- Students report providing personal information to “verify financial aid eligibility”
- IT staff explain expedited software approval due to “critical student service needs”
Mid-Scenario Pressure Points:
- Hour 1: Students gathering outside financial aid office asking about disbursement delays
- Hour 2: Student Services VP demands explanation for any delays affecting student payments
- Hour 3: Local news contacts university about “financial aid processing problems”
- Hour 4: Parent calls complaining about student unable to secure summer housing due to aid delays
Evolution Triggers:
- If containment takes longer than 4 hours, GaboonGrabber begins targeting student personal data
- If financial aid systems are taken offline, thousands of students miss payment deadlines
- If student information system access is compromised, FERPA violations become inevitable
Resolution Pathways:
Technical Success Indicators:
- Team identifies social engineering exploitation of academic deadline pressure
- Student data protection maintains FERPA compliance throughout incident response
- Financial aid processing continues safely while threat is contained and removed
Business Success Indicators:
- Financial aid disbursements complete on schedule without compromising security
- Student trust in university data protection maintained through transparent communication
- Incident response demonstrates effective student data stewardship to regulatory authorities
Learning Success Indicators:
- Team understands how academic calendar pressures create institutional vulnerabilities
- Participants recognize importance of maintaining security controls during peak service periods
- Group demonstrates coordination between academic services, IT security, and student affairs
Common IM Facilitation Challenges:
If Student Impact Is Minimized:
“While you’re conducting technical analysis, 200 students are waiting in line outside the financial aid office, and Marcus needs his disbursement to pay his housing deposit by tomorrow morning. How do you balance security with student success?”
If FERPA Complexity Is Ignored:
“The technical response looks good, but Dr. Thompson just reminded everyone that any student data breach requires federal notification within 48 hours. How does that change your approach?”
If Timeline Pressure Is Underestimated:
“Your investigation is thorough, but the Student Services VP just announced that any delays to financial aid will affect summer enrollment numbers and university revenue. What’s your response strategy?”
Success Metrics for Session:
GaboonGrabber Scenario: SteelCorp Manufacturing Crisis
Scenario Details for IMs
Opening Presentation
“It’s Wednesday morning at SteelCorp Manufacturing, and the production floor is running at maximum capacity to meet Friday’s critical delivery deadline. The largest contract in company history depends on this schedule, with $200K daily penalties for delays. But since yesterday, several computers controlling production scheduling and vendor coordination have been running slowly, and supervisors are reporting issues with new ‘vendor efficiency software’ that appeared after responding to what seemed like legitimate supply chain optimization updates.”
Initial Symptoms to Present:
- “Production scheduling computers experiencing 30% performance degradation”
- “Supervisors report new ‘vendor coordination software’ requesting system access”
- “Plant staff received ‘supply chain optimization’ emails Tuesday evening”
- “Industrial control system displays showing intermittent connectivity warnings”
Key Discovery Paths:
Detective Investigation Leads:
- Email analysis reveals sophisticated spoofing of major manufacturing vendor communications
- File system investigation shows “VendorOptimizer.exe” and “SupplyChainTool.exe” on production systems
- Network forensics reveal unauthorized connections between office IT and operational technology networks
Protector System Analysis:
- Process monitoring detects unusual activity on systems connected to industrial controls
- Memory analysis shows injection attempts targeting production scheduling software
- Safety system integrity checks reveal potential access to critical control systems
Tracker Network Investigation:
- Network traffic analysis shows data flows from production planning systems to external servers
- DNS logs reveal queries to domains mimicking legitimate manufacturing vendor sites
- Communication pattern analysis shows coordinated targeting during peak production periods
Communicator Stakeholder Interviews:
- Plant supervisors admit installing vendor software quickly to optimize production efficiency
- Operations staff explain pressure to approve anything that might prevent production delays
- IT coordinator reveals expedited software approval due to “critical production requirements”
Mid-Scenario Pressure Points:
- Hour 1: Production line supervisor reports scheduling system glitches affecting shift coordination
- Hour 2: Major client calls demanding production status update and Friday delivery confirmation
- Hour 3: Operations director threatens to override any IT restrictions that slow production
- Hour 4: Safety system alerts indicate potential issues with environmental monitoring
Evolution Triggers:
- If containment affects production systems, daily output drops below contract requirements
- If OT network compromise occurs, worker safety systems become unreliable
- If response takes longer than 6 hours, production schedule cannot meet Friday deadline
Resolution Pathways:
Technical Success Indicators:
- Team identifies social engineering exploitation of production pressure and vendor trust
- Operational technology systems protected while maintaining production safety and efficiency
- Network segmentation prevents spread between IT and OT environments
Business Success Indicators:
- Production schedule maintained without compromising worker safety or system security
- Major client relationship preserved through effective crisis management and communication
- Contract delivery commitments met despite security incident challenges
Learning Success Indicators:
- Team understands how production pressure creates industrial cybersecurity vulnerabilities
- Participants recognize critical importance of OT/IT security integration
- Group demonstrates coordination between production operations, safety systems, and cybersecurity
Common IM Facilitation Challenges:
If Production Impact Is Ignored:
“Your security analysis is thorough, but the production floor just reported that scheduling delays might force overtime shifts, and Linda is demanding to know why ‘IT problems’ are affecting the contract delivery.”
If Safety Systems Are Overlooked:
“While you’re investigating network issues, the environmental monitoring system just displayed a safety alert. How do you ensure worker safety while responding to the cybersecurity incident?”
If Business Pressure Is Underestimated:
“The major client just called threatening contract cancellation if delivery is delayed. Sarah needs to know: can production continue safely, or do we risk losing our biggest customer?”
Success Metrics for Session:
WannaCry (Network Ransomware)
WannaCry Scenario: Memorial Health System Emergency
Scenario Details for IMs
Opening Presentation
“It’s Tuesday evening at Memorial Health System, and the hospital is operating under surge conditions. The emergency department is packed with flu patients, the ICU is at capacity, and surgical teams are working overtime. Suddenly, computer screens across the hospital begin displaying ransom demands, and critical patient care systems start failing. Medical staff are reporting they cannot access patient records, lab results, or medication orders. In a hospital, every second counts, and systems are failing faster than they can be contained.”
Initial Symptoms to Present:
- “Patient record systems displaying ransom messages instead of medical data”
- “Laboratory computers cannot send test results to clinical staff”
- “Nursing stations losing access to medication administration records”
- “New systems failing every few minutes across different hospital departments”
Key Discovery Paths:
Detective Investigation Leads:
- Network forensics reveal rapid lateral movement using SMB vulnerability exploitation
- File system analysis shows systematic encryption of patient data and medical records
- Log analysis reveals attack origination from single unpatched workstation in administrative area
Protector System Analysis:
- Real-time monitoring shows worm spreading through hospital network faster than containment
- Critical system assessment reveals medical devices and patient monitors at risk
- Network topology analysis shows incomplete segmentation between clinical and administrative systems
Tracker Network Investigation:
- Traffic analysis reveals massive SMB scanning and exploitation across hospital subnets
- Network propagation patterns show attack moving toward life-critical medical device networks
- Communication flow analysis indicates potential spread to ambulance and emergency service networks
Communicator Stakeholder Interviews:
- Medical staff report immediate patient care impact from system failures
- IT staff explain delayed patching on medical systems due to FDA device regulations
- Hospital administration reveals network design compromises made for operational convenience
Mid-Scenario Pressure Points:
- Hour 1: Emergency department physician cannot access patient allergy information for critical treatment
- Hour 2: Surgical team loses access to patient imaging during ongoing surgery
- Hour 3: ICU monitoring systems showing connectivity issues affecting patient safety
- Hour 4: Ambulance services report inability to transmit patient data to receiving hospital
Evolution Triggers:
- If network segmentation fails, life-critical medical devices become compromised
- If containment takes longer than 2 hours, patient care operations face dangerous disruption
- If backup systems are accessed, hospital loses all redundancy for critical patient data
Resolution Pathways:
Technical Success Indicators:
- Team implements emergency network segmentation protecting life-critical systems
- Worm propagation contained through rapid patch deployment and network isolation
- Kill switch discovery and activation halts ransomware spread before complete compromise
Business Success Indicators:
- Patient care operations maintained with minimal disruption to life-safety systems
- Emergency department continues operations using manual backup procedures when necessary
- Hospital maintains regulatory compliance while managing cybersecurity crisis
Learning Success Indicators:
- Team understands rapid worm propagation mechanics and network-based attacks
- Participants recognize critical importance of patch management in healthcare environments
- Group demonstrates crisis coordination between cybersecurity, medical operations, and patient safety
Common IM Facilitation Challenges:
If Technical Focus Overwhelms Patient Safety:
“Your network analysis is excellent, but Dr. Williams just reported that the emergency department cannot access patient medication allergies for incoming trauma cases. How do you balance technical investigation with immediate patient safety?”
If Propagation Speed Is Underestimated:
“While you’re planning your response, Thomas is watching three more departments lose system access in real-time. This worm is spreading faster than traditional malware - what’s your immediate containment strategy?”
If Healthcare Complexity Is Avoided:
“Dr. Lee needs to know: can the emergency department safely treat patients without electronic medical records, or should they consider diverting ambulances to other hospitals?”
Success Metrics for Session:
WannaCry Scenario: Municipality Payroll Crisis
Scenario Details for IMs
Opening Presentation
“It’s Thursday morning at Springfield City Hall, and what started as routine payroll preparation has become a municipal crisis. Finance staff working late Wednesday night began seeing ransom messages on their screens, and by morning, the attack has spread to police dispatch, fire department communications, and utility management systems. With 1,200 city employees expecting paychecks tomorrow and public safety systems affected, this cybersecurity incident has become a city-wide emergency.”
Initial Symptoms to Present:
- “Finance department computers showing ransom demands instead of payroll data”
- “Police dispatch systems experiencing connectivity issues affecting emergency response”
- “Fire department reporting communication system failures”
- “Utility management networks showing signs of compromise and system encryption”
Key Discovery Paths:
Detective Investigation Leads:
- Network forensics reveal worm exploitation of shared municipal network infrastructure
- File system analysis shows encryption of payroll, personnel, and public safety databases
- Timeline analysis reveals attack origin in finance department during late-night payroll processing
Protector System Analysis:
- Network monitoring shows rapid lateral movement across city department boundaries
- Critical system assessment reveals public safety and emergency services at risk
- Infrastructure analysis shows minimal network segmentation between municipal departments
Tracker Network Investigation:
- Traffic analysis reveals worm scanning and exploitation across all city network segments
- Propagation mapping shows attack moving toward emergency services and utility control systems
- Communication pattern analysis indicates potential spread to county and state government networks
Communicator Stakeholder Interviews:
- Finance staff describe working late on payroll when systems began failing
- Police and fire departments report increasing operational impact on emergency services
- IT staff explain budget constraints and operational needs that prevented network segmentation
Mid-Scenario Pressure Points:
- Hour 1: Police dispatch center reports intermittent system failures affecting emergency response
- Hour 2: Mayor receives calls from employees asking about paycheck delays
- Hour 3: Fire department loses access to building inspection and safety records
- Hour 4: Local media reports “city computer systems held hostage” affecting public services
Evolution Triggers:
- If public safety systems are compromised, emergency response capabilities become unreliable
- If payroll processing cannot be completed, 1,200 employees miss critical paychecks
- If utility systems are affected, water and power services to citizens are threatened
Resolution Pathways:
Technical Success Indicators:
- Team implements emergency network segmentation protecting critical public safety systems
- Worm propagation contained through strategic network isolation and rapid patching
- Backup systems activated to maintain essential city services during recovery
Business Success Indicators:
- Payroll processing completed through alternative methods ensuring employee payments
- Public safety services maintained throughout cybersecurity incident response
- Municipal operations continue with minimal disruption to citizen services
Learning Success Indicators:
- Team understands worm mechanics and cross-network propagation in shared infrastructure
- Participants recognize public sector cybersecurity challenges and resource constraints
- Group demonstrates coordination between IT security, public safety, and municipal operations
Common IM Facilitation Challenges:
If Public Safety Impact Is Minimized:
“While you’re analyzing the technical details, Chief Park reports that police dispatch is experiencing delays in emergency calls. How do you ensure public safety while containing the cybersecurity threat?”
If Employee Impact Is Ignored:
“Your containment strategy is sound, but Maria just calculated that 1,200 city employees won’t receive paychecks tomorrow if payroll systems aren’t restored. What’s your plan for the human impact?”
If Municipal Complexity Is Overwhelming:
“The Mayor needs a simple answer: can the city continue to provide essential services to citizens, or should emergency protocols be activated?”
Success Metrics for Session:
WannaCry Scenario: Morrison & Associates Case Crisis
Scenario Details for IMs
Opening Presentation
“It’s Friday morning at Morrison & Associates, and the law firm is in the final sprint toward Monday’s critical court filing deadline. The $500M class-action case represents two years of work by 20 attorneys, and the case management systems contain irreplaceable depositions, expert witness reports, and legal research. But since Thursday evening, computers throughout the firm have been displaying ransom messages, and critical case files are being encrypted faster than they can be backed up. In the legal profession, missing a court deadline can mean losing a case entirely.”
Initial Symptoms to Present:
- “Case management systems displaying ransom demands instead of legal documents”
- “Attorney workstations losing access to client files and litigation materials”
- “Document servers encrypting depositions and expert witness reports”
- “New systems failing across different practice areas and client matters”
Key Discovery Paths:
Detective Investigation Leads:
- Network forensics reveal worm spreading through document management and case file systems
- File analysis shows systematic encryption of legal documents, depositions, and client communications
- Timeline analysis reveals attack began during late-night document preparation for Monday deadline
Protector System Analysis:
- Real-time monitoring shows ransomware spreading through attorney work files and client databases
- System integrity analysis reveals potential compromise of attorney-client privileged communications
- Network architecture assessment shows inadequate segmentation between client matters and practice areas
Tracker Network Investigation:
- Traffic analysis reveals worm exploiting shared network infrastructure across law firm offices
- Propagation patterns show movement toward email servers containing client communications
- Network scanning shows potential spread to cloud-based legal research and e-filing systems
Communicator Stakeholder Interviews:
- Attorneys report loss of access to critical case documents needed for Monday filing
- IT staff explain security update delays due to concerns about disrupting ongoing litigation
- Expert witnesses describe irreplaceable research data stored on compromised systems
Mid-Scenario Pressure Points:
- Hour 1: Senior associate reports inability to access key depositions needed for motion drafting
- Hour 2: Expert witness calls reporting economic analysis files are inaccessible
- Hour 3: Opposing counsel files motion requesting dismissal due to “plaintiff preparation failures”
- Hour 4: Court clerk confirms no extensions available - Monday 5 PM deadline is absolute
Evolution Triggers:
- If document recovery fails, two years of legal work becomes inaccessible before deadline
- If network isolation affects e-filing systems, court submissions cannot be completed
- If attorney-client communications are compromised, ethical violations and malpractice claims arise
Resolution Pathways:
Technical Success Indicators:
- Team implements emergency document recovery protecting critical case files
- Worm containment prevents spread to email servers and attorney-client communications
- Network segmentation preserves legal research and court filing capabilities
Business Success Indicators:
- Critical case documents recovered enabling Monday court filing deadline compliance
- Attorney-client privilege maintained throughout cybersecurity incident response
- Law firm operations continue without malpractice exposure or ethical violations
Learning Success Indicators:
- Team understands worm propagation through professional service networks and shared file systems
- Participants recognize unique cybersecurity challenges in legal profession and privileged communications
- Group demonstrates coordination between IT security, legal operations, and professional compliance
Common IM Facilitation Challenges:
If Legal Deadline Pressure Is Underestimated:
“Your technical analysis is thorough, but Patricia just confirmed that missing Monday’s deadline will result in automatic case dismissal, and 10,000 plaintiffs will lose their legal recourse. How does this change your response priority?”
If Attorney-Client Privilege Is Ignored:
“While you’re containing the worm, James just realized that encrypted systems may contain privileged attorney-client communications. How do you ensure professional ethical compliance during incident response?”
If Professional Service Context Is Missed:
“Dr. Kim’s expert economic analysis represents two years of specialized research that cannot be recreated by Monday. What’s your strategy for protecting irreplaceable professional work product?”
Success Metrics for Session:
WannaCry Scenario: Transportation Peak Season
Scenario Details for IMs
Opening Presentation
“It’s Wednesday morning at TransGlobal Logistics, and the regional hub is operating at peak holiday capacity with conveyor belts running 24/7 and trucks departing every hour for delivery routes. But since Tuesday evening, package sorting systems have been displaying ransom messages, customer tracking databases are becoming inaccessible, and delivery routing systems are failing across the facility. With thousands of businesses depending on holiday deliveries and millions of packages in the system, this cybersecurity incident threatens to disrupt the entire regional supply chain.”
Initial Symptoms to Present:
- “Package sorting systems showing ransom demands instead of routing information”
- “Customer tracking databases becoming inaccessible affecting service inquiries”
- “Delivery route optimization systems failing across different transportation zones”
- “Warehouse management systems losing connectivity to package scanning and inventory control”
Key Discovery Paths:
Detective Investigation Leads:
- Network forensics reveal worm spreading through logistics and package management systems
- File system analysis shows encryption of delivery routes, customer data, and operational databases
- Timeline analysis reveals attack began during overnight shift when network traffic is highest
Protector System Analysis:
- Real-time monitoring shows ransomware spreading through interconnected logistics infrastructure
- Critical system assessment reveals package sorting and delivery systems at risk of complete failure
- Network topology analysis shows minimal segmentation between operational and administrative systems
Tracker Network Investigation:
- Traffic analysis reveals worm exploiting shared network infrastructure across shipping operations
- Propagation patterns show movement toward vehicle tracking and customer communication systems
- Network scanning indicates potential spread to partner carrier and retail client networks
Communicator Stakeholder Interviews:
- Operations staff report immediate impact on package processing and delivery scheduling
- Customer service team describes inability to provide tracking updates to worried customers
- IT staff explain security update challenges during continuous 24/7 operations requirements
Mid-Scenario Pressure Points:
- Hour 1: Major retail client calls demanding explanation for delayed holiday shipment tracking
- Hour 2: Package sorting facility reports 50% reduction in processing capacity
- Hour 3: Delivery drivers unable to access route optimization, causing traffic delays and missed deliveries
- Hour 4: Regional VP warns that operational disruptions will affect annual performance and customer contracts
Evolution Triggers:
- If package sorting systems fail completely, thousands of packages cannot be processed or delivered
- If customer tracking remains down, service commitments to major retail clients are violated
- If delivery routing is compromised, operational efficiency drops below sustainable levels
Resolution Pathways:
Technical Success Indicators:
- Team implements emergency network segmentation protecting critical package processing systems
- Worm propagation contained through strategic isolation and backup system activation
- Alternative tracking and routing procedures maintain operational continuity during recovery
Business Success Indicators:
- Package delivery operations maintained at sufficient capacity to meet holiday commitments
- Customer service capabilities preserved through manual tracking and communication procedures
- Major retail client relationships protected through effective crisis communication and alternative solutions
Learning Success Indicators:
- Team understands worm propagation through logistics networks and interconnected operational systems
- Participants recognize cybersecurity challenges in 24/7 operations and supply chain management
- Group demonstrates coordination between IT security, logistics operations, and customer service
Common IM Facilitation Challenges:
If Operational Impact Is Underestimated:
“While you’re analyzing network traffic, Carlos reports that package sorting capacity has dropped by 60%, and thousands of holiday packages are backing up in the facility. How do you balance cybersecurity response with operational continuity?”
If Customer Impact Is Ignored:
“Robert just received calls from three major retail clients threatening to switch carriers if their holiday shipments aren’t tracked and delivered on schedule. What’s your customer communication strategy?”
If Supply Chain Complexity Is Overwhelming:
“Sarah needs to know: can TransGlobal meet its holiday delivery commitments, or should backup contingency plans with partner carriers be activated immediately?”
Success Metrics for Session:
Stuxnet (Industrial Sabotage)
Stuxnet Scenario: Power Plant Maintenance Window
Scenario Details for IMs
Opening Presentation
“It’s Wednesday morning at Columbia River Power Station, and the annual maintenance outage is in its final phase. Nuclear reactors are offline, safety systems are being tested, and the plant must restart within 72 hours to meet regional power demands. But during routine control system testing, engineers are discovering anomalous behavior in critical safety systems. Preliminary investigation suggests sophisticated malware has somehow penetrated the air-gapped industrial control networks, potentially compromising nuclear safety systems during the most vulnerable maintenance period.”
Initial Symptoms to Present:
- “Industrial control systems showing subtle anomalies during safety system testing”
- “Centrifuge and cooling system controls responding differently than expected to operator commands”
- “Network monitoring detecting unexpected traffic on supposedly air-gapped industrial networks”
- “Contractor USB drives triggering security alerts when scanned by updated antivirus systems”
Key Discovery Paths:
Detective Investigation Leads:
- Forensic analysis reveals sophisticated malware designed specifically for industrial control systems
- USB device examination shows infection vector through contractor maintenance equipment
- Timeline analysis reveals compromise occurred during maintenance window when air-gap security was reduced
Protector System Analysis:
- Industrial control system monitoring reveals subtle manipulation of centrifuge speeds and cooling controls
- Nuclear safety system integrity checks show potential compromise of critical safety functions
- Network architecture assessment reveals temporary bridging of air-gapped networks during maintenance
Tracker Network Investigation:
- Traffic analysis reveals covert communication channels established across supposedly isolated networks
- Command and control analysis shows sophisticated nation-state-level operational security
- Attribution investigation suggests advanced persistent threat group targeting critical infrastructure
Communicator Stakeholder Interviews:
- Nuclear engineers report subtle but concerning changes in control system behavior
- Maintenance contractors explain procedures that may have introduced USB-based infection vectors
- Regulatory affairs staff describe federal requirements for nuclear incident reporting and response
Mid-Scenario Pressure Points:
- Hour 1: Nuclear Regulatory Commission inspector arrives for scheduled post-maintenance safety verification
- Hour 2: Regional power grid operator inquires about plant restart schedule due to increasing electricity demand
- Hour 3: Control systems engineer reports that centrifuge systems are operating outside normal parameters
- Hour 4: Plant manager must decide whether to proceed with reactor restart or extend maintenance outage
Evolution Triggers:
- If malware remains undetected, plant restart could trigger physical damage to critical systems
- If maintenance deadline is missed, regional power grid faces potential shortages affecting millions
- If attack attribution involves nation-state adversary, federal counterintelligence and national security agencies become involved
Resolution Pathways:
Technical Success Indicators:
- Team identifies sophisticated malware and industrial control system compromise
- Air-gapped network security restored through comprehensive malware removal and system validation
- Advanced attribution analysis provides intelligence on nation-state threat actor capabilities and objectives
Business Success Indicators:
- Nuclear safety systems verified clean and functional before reactor restart authorization
- Plant maintenance schedule adjusted to accommodate cybersecurity response without compromising safety
- Federal regulatory compliance maintained throughout incident response and recovery process
Learning Success Indicators:
- Team understands advanced persistent threat capabilities and nation-state attack sophistication
- Participants recognize critical infrastructure cybersecurity challenges and air-gapped network vulnerabilities
- Group demonstrates coordination between cybersecurity, nuclear safety, and national security considerations
Common IM Facilitation Challenges:
If Nuclear Safety Context Is Overwhelming:
“The nuclear technical details are complex, but the core question is simple: can the team ensure that control systems are safe and trustworthy before the reactor restarts and begins generating power for millions of people?”
If Nation-State Attribution Is Avoided:
“Your technical analysis suggests this isn’t ordinary cybercrime - the sophistication and targeting suggest state-sponsored activity. How does this change your investigation and response approach?”
If Air-Gapped Network Compromise Is Misunderstood:
“Maria just confirmed that the affected systems were supposed to be completely isolated from any network connections. How did this malware cross the air gap, and what does that tell you about the sophistication of this threat?”
Success Metrics for Session:
Stuxnet Scenario: Water Treatment SCADA Deployment
Scenario Details for IMs
Opening Presentation
“It’s Monday morning at Metro Water Authority, and the new SCADA system that will modernize water treatment operations for 500,000 residents is nearly operational. The system must demonstrate EPA compliance within two weeks, but water operations staff are noticing subtle inconsistencies between chemical dosing commands and actual treatment levels. Initial investigation suggests that sophisticated malware may have compromised the industrial control systems during the installation process, potentially threatening both public water safety and federal regulatory compliance.”
Initial Symptoms to Present:
- “Water treatment chemical dosing showing slight discrepancies between commanded and actual levels”
- “SCADA monitoring displays showing normal operations while field measurements suggest different chemical concentrations”
- “Network monitoring detecting unexpected communication patterns on water treatment control networks”
- “System installation contractors reporting unusual behavior during recent SCADA deployment activities”
Key Discovery Paths:
Detective Investigation Leads:
- Forensic analysis reveals sophisticated malware specifically designed for water treatment industrial controls
- SCADA system examination shows manipulation of chemical dosing controls with concealed monitoring
- Installation timeline analysis reveals compromise during system modernization and network integration
Protector System Analysis:
- Water treatment monitoring reveals discrepancies between control commands and actual chemical processes
- Industrial control system integrity analysis shows potential manipulation of safety-critical treatment functions
- Network security assessment reveals compromise of air-gapped water treatment control networks
Tracker Network Investigation:
- Traffic analysis reveals covert command and control communication through water treatment networks
- Chemical process monitoring shows subtle manipulation patterns designed to avoid detection
- Attribution analysis suggests nation-state-level sophistication targeting critical water infrastructure
Communicator Stakeholder Interviews:
- Water treatment operators describe subtle inconsistencies in chemical dosing and system responses
- SCADA installation contractors explain procedures that may have introduced compromise vectors
- Regulatory compliance staff describe federal requirements for water safety monitoring and incident reporting
Mid-Scenario Pressure Points:
- Hour 1: Water quality lab reports trace chemical levels slightly outside normal treatment parameters
- Hour 2: EPA regional administrator calls to schedule compliance verification for new SCADA system
- Hour 3: Operations manager discovers that backup monitoring systems show different readings than primary SCADA displays
- Hour 4: Public health department inquires about water quality reports after receiving citizen complaints about taste changes
Evolution Triggers:
- If malware manipulation continues, water quality could degrade beyond safe drinking standards
- If EPA compliance deadline is missed, federal penalties and regulatory intervention become inevitable
- If attack involves nation-state adversary targeting water infrastructure, federal security agencies and critical infrastructure protection protocols activate
Resolution Pathways:
Technical Success Indicators:
- Team identifies sophisticated malware and industrial control system manipulation
- Water treatment process integrity restored through comprehensive system validation and malware removal
- SCADA system security enhanced to prevent future compromise while maintaining EPA compliance capabilities
Business Success Indicators:
- Public water safety maintained throughout cybersecurity incident response and system recovery
- EPA compliance demonstration completed on schedule with verified system integrity
- Federal regulatory requirements met while addressing sophisticated cybersecurity threat
Learning Success Indicators:
- Team understands nation-state threats to critical infrastructure and advanced persistent threat capabilities
- Participants recognize water treatment cybersecurity challenges and public safety implications
- Group demonstrates coordination between cybersecurity, public health, and regulatory compliance
Common IM Facilitation Challenges:
If Public Safety Impact Is Minimized:
“While you’re analyzing the technical details, Dr. Kim just confirmed that water treatment chemical levels are outside normal parameters, potentially affecting drinking water for 500,000 residents. How do you balance cybersecurity investigation with immediate public health protection?”
If Regulatory Complexity Is Overwhelming:
“The EPA compliance details are complex, but the fundamental question is simple: can the water authority demonstrate that their new monitoring systems are accurate and trustworthy for protecting public health?”
If Critical Infrastructure Context Is Missed:
“Alexandra just realized that this attack specifically targets water treatment controls - not random systems. What does this suggest about the threat actor’s objectives and the broader implications for critical infrastructure?”
Success Metrics for Session:
Stuxnet Scenario: TechCore Semiconductors Defense Contract
Scenario Details for IMs
Opening Presentation
“It’s Monday morning at TechCore Semiconductors, and the final production run for a critical defense contract is underway. The components must be delivered by Thursday to meet national security requirements, with no alternative suppliers available. But quality control is detecting microscopic anomalies in semiconductor components that could compromise defense system performance. Initial investigation suggests that sophisticated malware may have compromised precision manufacturing equipment, potentially representing a nation-state attack on U.S. defense supply chains.”
Initial Symptoms to Present:
- “Precision manufacturing equipment producing components with subtle dimensional variations outside specification”
- “Quality control systems showing normal readings while physical measurements detect manufacturing defects”
- “Network monitoring detecting unusual communication patterns on manufacturing control networks”
- “New equipment installation documentation showing potential compromise during system integration”
Key Discovery Paths:
Detective Investigation Leads:
- Forensic analysis reveals sophisticated malware designed specifically for precision manufacturing equipment
- Manufacturing control system examination shows subtle manipulation of production parameters
- Equipment installation timeline reveals compromise during integration of new manufacturing systems
Protector System Analysis:
- Manufacturing process monitoring reveals discrepancies between control commands and actual production output
- Quality control system integrity analysis shows potential manipulation of defect detection systems
- Industrial network security assessment reveals compromise of air-gapped manufacturing control systems
Tracker Network Investigation:
- Traffic analysis reveals covert command and control communication through manufacturing networks
- Production data analysis shows subtle sabotage patterns designed to introduce defects while avoiding detection
- Attribution investigation suggests nation-state-level sophistication targeting defense manufacturing supply chains
Communicator Stakeholder Interviews:
- Manufacturing engineers describe subtle inconsistencies in production equipment behavior and output quality
- Equipment installation contractors explain procedures that may have introduced compromise vectors
- Defense security staff describe federal requirements for supply chain integrity and incident reporting
Mid-Scenario Pressure Points:
- Hour 1: Quality control reports that 15% of produced components show microscopic defects that could affect performance
- Hour 2: Defense contract officer calls to confirm delivery schedule and component specifications
- Hour 3: Manufacturing director discovers that backup quality systems show different readings than primary control displays
- Hour 4: CEO informs team that contract cancellation would result in layoffs and potential company closure
Evolution Triggers:
- If malware manipulation continues, defense components will fail quality standards and compromise military systems
- If delivery deadline is missed, national security implications and $50M contract penalties threaten company survival
- If attack involves nation-state adversary targeting defense supply chains, federal counterintelligence and national security protocols activate
Resolution Pathways:
Technical Success Indicators:
- Team identifies sophisticated malware and manufacturing control system sabotage
- Production process integrity restored through comprehensive system validation and malware removal
- Manufacturing security enhanced to prevent future supply chain compromise while meeting defense contract requirements
Business Success Indicators:
- Defense component quality and delivery schedule maintained throughout cybersecurity incident response
- Contract obligations fulfilled with verified component integrity and performance specifications
- National security implications addressed while preserving critical defense manufacturing capability
Learning Success Indicators:
- Team understands nation-state threats to defense industrial base and supply chain security
- Participants recognize precision manufacturing cybersecurity challenges and national security implications
- Group demonstrates coordination between cybersecurity, manufacturing operations, and national security considerations
Common IM Facilitation Challenges:
If National Security Context Is Overwhelming:
“The defense contract details are complex, but the core issue is clear: sophisticated adversaries are trying to compromise U.S. defense capabilities by sabotaging the components that go into military systems. How do you protect national security while maintaining production?”
If Supply Chain Impact Is Underestimated:
“James just confirmed that defective components could cause defense system failures in the field, potentially putting military personnel at risk. How does this change your response priorities?”
If Manufacturing Precision Requirements Are Missed:
“Dr. Park explains that semiconductor manufacturing tolerances are measured in nanometers - tiny changes can have huge impacts. What does this tell you about the sophistication and objectives of this attack?”
Success Metrics for Session:
Stuxnet Scenario: Research Facility Milestone
Scenario Details for IMs
Opening Presentation
“It’s Monday morning at the Advanced Energy Research Institute, and final preparations are underway for Wednesday’s presentation to Congress on breakthrough renewable energy technology. The research represents a decade of work by 50 scientists and could revolutionize U.S. energy independence. But during final data validation, researchers are discovering inconsistencies in experimental results that could invalidate the entire project. Initial investigation suggests sophisticated malware may have compromised research systems, potentially representing a nation-state attack targeting U.S. scientific advantages.”
Initial Symptoms to Present:
- “Experimental data showing subtle inconsistencies that could invalidate breakthrough research findings”
- “Research computing systems displaying normal operations while data integrity checks reveal manipulation”
- “Network monitoring detecting unexpected communication patterns on classified research networks”
- “International collaboration system logs showing unusual access patterns and data transfer activities”
Key Discovery Paths:
Detective Investigation Leads:
- Forensic analysis reveals sophisticated malware designed specifically for research data manipulation and theft
- Research system examination shows covert data exfiltration targeting classified renewable energy breakthrough technology
- Collaboration timeline analysis reveals compromise during establishment of international research partnership systems
Protector System Analysis:
- Research data integrity monitoring reveals systematic manipulation of experimental results and scientific calculations
- Classified information systems analysis shows potential compromise of national laboratory intellectual property
- Network security assessment reveals breach of air-gapped classified research computing environments
Tracker Network Investigation:
- Traffic analysis reveals covert data exfiltration channels targeting classified research and breakthrough technologies
- Research collaboration monitoring shows unauthorized access to scientific data and intellectual property
- Attribution investigation suggests nation-state-level espionage targeting U.S. scientific and technological advantages
Communicator Stakeholder Interviews:
- Research scientists describe subtle anomalies in experimental data that could compromise research validity
- International collaboration partners explain data sharing procedures that may have introduced compromise vectors
- Classification security staff describe federal requirements for protecting national laboratory research and intellectual property
Mid-Scenario Pressure Points:
- Hour 1: Lead scientist reports that 30% of critical experimental data shows manipulation that could invalidate research conclusions
- Hour 2: Congressional staff calls to confirm research presentation schedule and breakthrough technology demonstration
- Hour 3: Laboratory director discovers that backup research systems show different results than primary computing displays
- Hour 4: Research security officer finds evidence that classified breakthrough technology data may have been exfiltrated to foreign adversaries
Evolution Triggers:
- If data manipulation continues, breakthrough research presentation will be based on compromised and invalid scientific results
- If Congressional presentation is cancelled, years of research investment and national energy policy development are delayed
- If classified research has been exfiltrated to foreign adversaries, U.S. scientific and economic competitive advantages are compromised
Resolution Pathways:
Technical Success Indicators:
- Team identifies sophisticated malware and research data manipulation and theft
- Research data integrity restored through comprehensive validation and malware removal
- Classified information protection enhanced while maintaining legitimate international scientific collaboration
Business Success Indicators:
- Research integrity and Congressional presentation timeline maintained throughout cybersecurity incident response
- Breakthrough technology development protected from foreign espionage and competitive compromise
- National laboratory mission fulfilled while addressing sophisticated nation-state cybersecurity threats
Learning Success Indicators:
- Team understands nation-state espionage threats to research institutions and intellectual property
- Participants recognize scientific research cybersecurity challenges and classified information protection requirements
- Group demonstrates coordination between cybersecurity, research operations, and national security considerations
Common IM Facilitation Challenges:
If Research Integrity Impact Is Minimized:
“While you’re conducting technical analysis, Dr. Martinez just confirmed that experimental data manipulation could invalidate the entire breakthrough research project, potentially wasting a decade of scientific work and billions in federal investment. How do you protect research integrity?”
If Espionage Implications Are Avoided:
“Linda just found evidence that classified renewable energy technology data may have been stolen and transferred to foreign competitors. What does this mean for U.S. energy independence and scientific advantages?”
If Congressional Pressure Is Underestimated:
“Senator Kim’s office just called to confirm that Wednesday’s presentation will demonstrate revolutionary technology that could change national energy policy. Can you guarantee the research data is valid and hasn’t been compromised?”
Success Metrics for Session:
Stuxnet Scenario: Smart Grid Infrastructure Sabotage
Scenario Details for IMs
Opening Presentation
“You’re at PowerGrid Dynamics, a major regional utility serving 2.3 million customers across three states. Your smart grid modernization has been a flagship project, integrating renewable energy sources with automated distribution systems. This morning, grid operators noticed unusual behavior in the renewable energy integration systems - solar and wind farms are receiving unexpected commands that could destabilize power distribution. Initial analysis suggests sophisticated malware specifically designed to manipulate your proprietary control systems. The FBI cybersecurity unit is en route.”
Initial Symptoms to Present:
- “Smart grid automation systems issuing unexpected commands to renewable energy facilities”
- “Grid control software showing normal operation while actual system behavior becomes anomalous”
- “Vendor security updates appear legitimate but contain sophisticated hidden payloads”
- “Attack patterns suggest nation-state level sophistication and detailed infrastructure knowledge”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated malware designed specifically for electrical grid manipulation
- Supply chain analysis discovers compromise of trusted vendor software update process
- Attack attribution suggests nation-state capabilities and extensive reconnaissance of grid systems
Protector System Analysis:
- Critical infrastructure assessment reveals malware targeting renewable energy integration systems
- Control system security analysis shows sophisticated evasion of industrial cybersecurity measures
- Grid stability analysis reveals potential for coordinated attacks causing cascading power failures
Tracker Intelligence Analysis:
- Threat intelligence coordination reveals similar attacks on electrical infrastructure globally
- Network monitoring discovers command and control infrastructure using legitimate cloud services
- International intelligence sharing reveals broader campaign targeting critical infrastructure
Communicator Federal Coordination:
- CISA and FBI coordination for critical infrastructure protection and national security response
- NERC CIP compliance management and potential regulatory enforcement during active attack
- Multi-state coordination for regional grid stability and emergency response planning
Crisis Manager Strategic Response:
- National security incident coordination between private utility and federal agencies
- Regional grid stability management during active nation-state cyber attack
- Strategic decision-making about disclosure and public communication during ongoing threat
Evolution Triggers:
- Intermediate → Advanced: Additional utilities report similar attacks, indicating coordinated campaign
- Advanced → Critical: Malware begins actively destabilizing grid during peak demand period
Success Metrics:
- Effective coordination with federal agencies and national security apparatus
- Technical containment preventing grid destabilization
- Successful attribution and threat intelligence development
- Coordinated response protecting regional electrical infrastructure
Learning Objectives:
- Nation-state cyber attacks on critical infrastructure
- Public-private coordination during national security incidents
- Advanced persistent threat techniques and attribution
- Critical infrastructure protection and incident response
Historical Context for IMs:
This scenario modernizes the 2010 Stuxnet attack, which targeted Iranian nuclear facilities through sophisticated malware designed to manipulate industrial control systems. The contemporary version adapts this to modern smart grid infrastructure, where nation-state attackers target renewable energy integration systems to destabilize electrical grids, maintaining the same level of sophisticated targeting and physical world impact that made Stuxnet historically significant.
Stuxnet Scenario: Nuclear Engineering Corporation Crisis (2010)
Historical Context & Modernization Prompts
Understanding 2010 Technology Context
This scenario represents the actual Stuxnet attack discovered in 2010. Key historical elements to understand:
- Industrial Control Systems: SCADA networks considered secure through “air-gapping” and obscurity
- Cybersecurity Paradigm: IT and OT (operational technology) security completely separate disciplines
- Nation-State Capabilities: First widely-recognized cyber weapon targeting physical infrastructure
- Digital Certificates: Trusted signing mechanism with limited validation and revocation processes
- Zero-Day Exploits: Extremely rare and valuable, typically reserved for highest-priority operations
Collaborative Modernization Questions for Players
Present these questions after initial investigation to guide modernization:
- “How has IoT and Industry 4.0 changed industrial control system security?”
- Guide toward: Connected factories, cloud-based monitoring, remote access capabilities
- “What critical infrastructure would be most vulnerable to similar attacks today?”
- Guide toward: Smart grids, water treatment, transportation systems, healthcare networks
- “How have nation-state cyber capabilities evolved since 2010?”
- Guide toward: Supply chain attacks, living-off-the-land techniques, cloud infrastructure targeting
- “What would ‘air-gapped’ networks look like in today’s connected world?”
- Guide toward: Vendor remote access, cloud integrations, mobile device connections
- “How would modern threat detection identify this type of sophisticated attack?”
- Guide toward: Behavioral analysis, machine learning, threat hunting, international intelligence sharing
Modernization Discovery Process
After historical investigation, facilitate modernization discussion:
- Infrastructure Evolution: Explore how critical infrastructure has become more connected
- Attack Sophistication: Discuss how nation-state techniques have become more accessible
- Detection Capabilities: Compare 2010 reactive detection to modern proactive threat hunting
- Response Coordination: Examine how public-private coordination has evolved
- Physical Impact: Consider how cyber attacks on different infrastructure create different consequences
Learning Objectives
- Nation-State Threats: Understanding sophisticated adversary capabilities and motivations
- Critical Infrastructure Protection: Recognizing vulnerabilities in essential services
- OT/IT Convergence: Appreciating security challenges as operational technology becomes connected
- International Coordination: Learning how cyber attacks require diplomatic and technical response
IM Facilitation Notes
- Emphasize Sophistication: Help players understand the unprecedented nature of the 2010 attack
- Physical Consequences: Highlight how cyber attacks can cause real-world damage
- Attribution Complexity: Discuss challenges of identifying nation-state attackers
- Evolution Discussion: Guide conversation toward how similar attacks might work today
- Ethical Considerations: Address dual-use nature of cybersecurity knowledge
This historical foundation provides insight into the first major cyber weapon while helping teams understand how nation-state threats continue to evolve and target critical infrastructure.
Code Red (Web Server Worm)
Code Red Scenario: Web Hosting Company Crisis
Scenario Details for IMs
Opening Presentation
“It’s Tuesday afternoon at NetHost Solutions during peak summer e-commerce season, and the company is managing record traffic for their 15,000 client websites. Suddenly, the operations center receives alerts that hundreds of client websites are displaying the message ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ instead of their normal content. Network monitoring shows their IIS servers are generating massive amounts of scanning traffic targeting other web servers across the internet.”
Initial Symptoms to Present:
- “Client websites displaying identical defacement messages instead of normal content”
- “IIS web servers generating massive amounts of outbound scanning traffic”
- “Network bandwidth consumption spiking due to automated scanning activity”
- “Multiple client websites affected simultaneously across different server clusters”
Key Discovery Paths:
Detective Investigation Leads:
- Web server log analysis reveals buffer overflow exploitation targeting IIS vulnerability
- File system examination shows memory-only infection with no persistent files created
- Timeline analysis indicates rapid automated propagation across vulnerable server infrastructure
Protector System Analysis:
- Real-time monitoring shows infected servers participating in coordinated internet scanning
- Web server security assessment reveals unpatched IIS systems vulnerable to buffer overflow
- Network traffic analysis indicates participation in distributed coordinated attack infrastructure
Tracker Network Investigation:
- Internet traffic analysis reveals coordinated scanning patterns targeting global web server infrastructure
- DNS and network flow data shows communication with other infected systems worldwide
- Attack source analysis indicates automated worm propagation rather than targeted attacks
Communicator Stakeholder Interviews:
- Client communications regarding website defacements and business impact during peak season
- ISP coordination about malicious traffic originating from company infrastructure
- Security community information sharing about internet-wide worm propagation
Mid-Scenario Pressure Points:
- Hour 1: Major e-commerce client threatens contract termination due to website defacement during peak sales period
- Hour 2: ISP contacts company about malicious scanning traffic violating terms of service
- Hour 3: Security community reports company’s servers participating in coordinated DDoS attack preparation
- Hour 4: News media reports widespread internet worm affecting web hosting providers
Evolution Triggers:
- If response takes longer than 6 hours, infected servers participate in massive coordinated DDoS attack
- If patch deployment is delayed, worm continues spreading to additional client websites
- If network isolation fails, company infrastructure continues contributing to internet-wide attacks
Resolution Pathways:
Technical Success Indicators:
- Emergency patch deployment stops worm propagation across server infrastructure
- Network isolation prevents further participation in coordinated internet attacks
- Server restart and patching removes memory-only infection while maintaining client services
Business Success Indicators:
- Client relationships maintained through rapid response and transparent communication
- Business operations restored with minimal impact on hosting service availability
- Company reputation protected through professional incident management and coordinated response
Learning Success Indicators:
- Team understands internet-scale worm propagation and infrastructure targeting
- Participants recognize shared responsibility for internet security and coordinated defense
- Group demonstrates crisis management balancing business continuity with infrastructure security
Common IM Facilitation Challenges:
If Internet-Scale Impact Is Underestimated:
“Your server response is good, but Sandra just discovered that your infected systems are scanning the entire internet and participating in attacks against other organizations. How does this change your response priorities?”
If Client Impact Is Ignored:
“While you’re investigating the technical details, Jennifer has 50 angry clients on hold whose e-commerce websites are defaced during their peak sales season. How do you balance technical response with client relations?”
If Coordinated Nature Is Missed:
“David just realized this isn’t a targeted attack on NetHost - it’s an internet-wide worm that’s turning web hosting infrastructure into a coordinated attack platform. What does this mean for your response strategy?”
Success Metrics for Session:
Code Red Scenario: State University System Crisis
Scenario Details for IMs
Opening Presentation
“It’s Monday morning during State University’s peak fall registration period, and 50,000 students are trying to access course registration, student services, and departmental websites. Instead of academic content, hundreds of university web pages are displaying ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ Network administrators discover that the university’s IIS servers are generating massive scanning traffic, effectively turning the institution’s infrastructure into part of a global attack network.”
Initial Symptoms to Present:
- “Student registration portal displaying defacement message instead of course enrollment system”
- “Departmental websites across campus showing identical ‘Hacked By Chinese!’ messages”
- “University IIS servers generating massive internet scanning traffic overwhelming network bandwidth”
- “Academic research portals and faculty websites simultaneously compromised”
Key Discovery Paths:
Detective Investigation Leads:
- Web server forensics reveal buffer overflow exploitation targeting university’s IIS infrastructure
- Academic network analysis shows memory-only infection spreading across departmental web servers
- Registration system logs indicate compromise occurred during peak student access period
Protector System Analysis:
- Campus network monitoring reveals infected servers participating in coordinated internet attacks
- Web server vulnerability assessment shows delayed patch management affecting critical student services
- Academic data integrity analysis indicates potential research data exposure through compromised web services
Tracker Network Investigation:
- Internet traffic analysis reveals university infrastructure participating in global worm propagation
- Academic network communication patterns show coordination with other infected educational institutions
- Research collaboration network analysis indicates potential spread to partner universities and government labs
Communicator Stakeholder Interviews:
- Student communications regarding registration disruption and academic service availability
- Faculty concerns about research data exposure and academic website compromise
- Academic community coordination with other universities experiencing similar attacks
Mid-Scenario Pressure Points:
- Hour 1: 10,000 students unable to complete course registration due to defaced enrollment portal
- Hour 2: Faculty research data becomes inaccessible through compromised departmental websites
- Hour 3: Other universities report that State University servers are attacking their infrastructure
- Hour 4: University administration faces media questions about academic data security and internet responsibility
Evolution Triggers:
- If response exceeds 8 hours, university misses registration deadline affecting student academic progress
- If worm containment fails, infection spreads to other universities through academic collaboration networks
- If patch deployment is delayed, university continues participating in coordinated attacks against educational infrastructure
Resolution Pathways:
Technical Success Indicators:
- Emergency patch deployment stops worm propagation across university web infrastructure
- Student services restored through secure backup systems while maintaining registration deadline
- University servers removed from coordinated attack network through network isolation and system restart
Business Success Indicators:
- Academic operations maintained with minimal impact on student registration and faculty research
- University reputation protected through transparent communication and responsible incident response
- Academic community relationships maintained through coordinated response and information sharing
Learning Success Indicators:
- Team understands university’s dual role as service provider and internet infrastructure participant
- Participants recognize academic institution cybersecurity responsibilities during critical operational periods
- Group demonstrates coordination between academic mission priorities and internet security obligations
Common IM Facilitation Challenges:
If Academic Mission Is Ignored:
“Your technical analysis is excellent, but Lisa reports that 10,000 students can’t register for classes and the registration deadline is tomorrow. How do you balance worm response with critical academic deadlines?”
If Internet Responsibility Is Missed:
“While you’re restoring student services, Professor Davis just received calls from three other universities saying that State University servers are attacking their infrastructure. How does this change your response approach?”
If Research Data Impact Is Overlooked:
“Robert discovered that some of the compromised servers host faculty research data and collaboration portals. How do you assess whether sensitive academic research has been exposed?”
Success Metrics for Session:
Code Red Scenario: Department of Public Services Crisis
Scenario Details for IMs
Opening Presentation
“It’s Tuesday morning at the Department of Public Services during the final 48 hours of tax season, with millions of citizens trying to file taxes and access government services online. Instead of tax portals and license renewal systems, government websites are displaying ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ Federal cybersecurity agencies are calling because the state’s government servers are now attacking other government infrastructure across the internet.”
Initial Symptoms to Present:
- “Tax filing portal displaying defacement message instead of citizen tax services”
- “License renewal and benefit application websites showing identical compromise messages”
- “Government IIS servers generating massive scanning traffic targeting other government agencies”
- “Federal agencies reporting attacks originating from state government infrastructure”
Key Discovery Paths:
Detective Investigation Leads:
- Government network forensics reveal buffer overflow exploitation targeting citizen service infrastructure
- Public service system analysis shows memory-only worm infection across government web servers
- Tax season timeline analysis indicates compromise during peak citizen service demand
Protector System Analysis:
- Government network monitoring reveals infected servers attacking federal infrastructure and other agencies
- Citizen service system assessment shows delayed patch management affecting critical government operations
- National security analysis indicates potential classified system exposure through government network compromise
Tracker Network Investigation:
- Internet traffic analysis reveals government infrastructure participating in coordinated attacks against critical infrastructure
- Government network communication patterns show coordination with other infected government and military systems
- Federal coordination reveals multi-agency impact and national security implications
Communicator Stakeholder Interviews:
- Citizen communications regarding tax filing disruption and government service unavailability
- Federal agency coordination about government infrastructure attacks and national security implications
- Public trust management through transparent communication about government cybersecurity incident
Mid-Scenario Pressure Points:
- Hour 1: 500,000 citizens unable to file taxes due to defaced government portals with 48-hour deadline approaching
- Hour 2: Federal agencies report state government servers attacking Department of Defense and critical infrastructure
- Hour 3: Governor’s office demands immediate restoration of citizen services and explanation of security failure
- Hour 4: News media reports government cybersecurity incident affecting citizen services and national security
Evolution Triggers:
- If response exceeds 24 hours, citizens miss tax filing deadline creating massive public service crisis
- If government network isolation fails, infection spreads to other agencies and classified systems
- If federal coordination is inadequate, government infrastructure continues participating in attacks against national security targets
Resolution Pathways:
Technical Success Indicators:
- Emergency patch deployment stops worm propagation across government web infrastructure
- Citizen services restored through secure backup systems maintaining tax filing deadline
- Government servers removed from coordinated attack network through federal cybersecurity coordination
Business Success Indicators:
- Government operations maintained with minimal impact on citizen services and tax season completion
- Public trust protected through transparent communication and professional incident management
- Federal relationships maintained through coordinated response and national security cooperation
Learning Success Indicators:
- Team understands government infrastructure’s critical role in national cybersecurity
- Participants recognize government cybersecurity responsibilities during critical service periods
- Group demonstrates coordination between citizen service delivery and national security obligations
Common IM Facilitation Challenges:
If National Security Implications Are Minimized:
“Your citizen service restoration is important, but Agent Park just reported that your government servers are attacking Department of Defense infrastructure. How does this change your response priorities and coordination requirements?”
If Citizen Impact Is Ignored:
“While you’re coordinating with federal agencies, Sarah has 500,000 citizens calling about tax filing with the deadline in 36 hours. How do you balance national security response with critical citizen service delivery?”
If Government Responsibility Is Overlooked:
“Captain Mitchell discovered that your compromised servers are attacking other state agencies and federal systems. How do you address your government’s role in attacking other government infrastructure?”
Success Metrics for Session:
Code Red Scenario: E-commerce Platform Crisis
Scenario Details for IMs
Opening Presentation
“It’s Black Friday morning at ShopCore Technologies, and the platform is handling record traffic for 5,000 online retailers during the most critical shopping weekend of the year. Instead of product catalogs and shopping carts, retailer websites are displaying ‘HELLO! Welcome to http://www.worm.com! Hacked By Chinese!’ while the platform’s servers are generating massive internet scanning traffic, effectively turning the e-commerce infrastructure into part of a coordinated attack network.”
Initial Symptoms to Present:
- “Retailer e-commerce websites displaying defacement messages instead of product catalogs”
- “Shopping cart and payment systems showing ‘Hacked By Chinese!’ messages during peak sales”
- “Platform IIS servers generating massive scanning traffic affecting internet bandwidth”
- “5,000 retailers unable to process holiday sales through compromised platform infrastructure”
Key Discovery Paths:
Detective Investigation Leads:
- E-commerce platform forensics reveal buffer overflow exploitation targeting holiday shopping infrastructure
- Shopping transaction system analysis shows memory-only worm infection across platform web servers
- Holiday shopping timeline analysis indicates compromise during peak Black Friday traffic
Protector System Analysis:
- E-commerce network monitoring reveals infected servers participating in coordinated attacks against financial infrastructure
- Platform security assessment shows delayed patch management affecting critical holiday shopping operations
- Customer shopping data integrity analysis indicates potential exposure through compromised e-commerce systems
Tracker Network Investigation:
- Internet traffic analysis reveals e-commerce platform participating in attacks against other shopping and financial services
- Retail network communication patterns show coordination with other infected e-commerce and payment systems
- Holiday shopping traffic analysis indicates massive revenue impact across thousands of dependent retailers
Communicator Stakeholder Interviews:
- Retailer communications regarding holiday revenue loss and customer shopping disruption
- Customer service management dealing with shoppers unable to complete purchases during Black Friday
- E-commerce industry coordination about platform security and holiday shopping protection
Mid-Scenario Pressure Points:
- Hour 1: Major retailer reports $2 million in lost Black Friday sales due to defaced e-commerce platform
- Hour 2: Payment processing companies report attacks originating from ShopCore’s infrastructure
- Hour 3: 5,000 retailers demanding immediate platform restoration as holiday shopping weekend continues
- Hour 4: News media reports widespread e-commerce disruption affecting Black Friday shopping nationwide
Evolution Triggers:
- If response exceeds 12 hours, retailers lose entire Black Friday weekend revenue affecting annual business results
- If worm containment fails, infection spreads to payment processing and financial services infrastructure
- If platform restoration is delayed, customer shopping data exposure threatens long-term business relationships
Resolution Pathways:
Technical Success Indicators:
- Emergency patch deployment stops worm propagation across e-commerce platform infrastructure
- Retailer websites restored through secure backup systems maintaining holiday shopping capabilities
- Platform servers removed from coordinated attack network while preserving shopping transaction processing
Business Success Indicators:
- E-commerce operations restored with minimal impact on retailer holiday revenue and customer shopping
- Platform reputation protected through rapid response and transparent communication with retail partners
- Customer shopping data secured preventing long-term damage to e-commerce trust and relationships
Learning Success Indicators:
- Team understands e-commerce platform’s critical role in holiday retail economy and internet infrastructure
- Participants recognize platform cybersecurity responsibilities during peak commercial periods
- Group demonstrates coordination between business continuity and internet security obligations
Common IM Facilitation Challenges:
If Retailer Impact Is Underestimated:
“Your technical response is solid, but Amanda just reported that 5,000 retailers are losing Black Friday revenue and threatening to switch platforms. How do you balance worm investigation with critical business relationships?”
If Internet Attack Participation Is Ignored:
“While you’re restoring shopping platforms, Mark discovered that your servers are attacking payment processing companies and other e-commerce infrastructure. How does this change your response strategy?”
If Holiday Timeline Is Overlooked:
“Victoria needs to know: can the platform be restored in time to capture Cyber Monday traffic, or will retailers lose the entire holiday shopping weekend?”
Success Metrics for Session:
Code Red Scenario: Cloud Infrastructure Mass Exploitation
Scenario Details for IMs
Opening Presentation
“It’s 2:30 PM on a Wednesday at CloudCore Solutions, and your cloud platform serves over 50,000 customer organizations. Customer support is being flooded with reports of defaced websites and missing business data. Your monitoring dashboard shows hundreds of API security alerts across different customer environments. What started as isolated incidents is accelerating - dozens of new customer compromises are appearing every hour, and the pattern suggests an automated attack spreading through your infrastructure.”
Initial Symptoms to Present:
- “Customer websites showing hacker messages instead of business content”
- “API security alerts increasing exponentially across customer environments”
- “Customer business data being exfiltrated from multiple tenant environments”
- “New customer compromises appearing every few minutes across the platform”
Key Discovery Paths:
Detective Investigation Leads:
- API logs reveal mass exploitation of recently deployed authentication bypass vulnerability
- Container forensics show worm spreading through shared infrastructure between customer environments
- Attack pattern analysis reveals automated tool systematically targeting all platform customers
Protector System Analysis:
- Real-time monitoring shows worm spreading through microservices architecture faster than isolation
- Container security assessment reveals shared infrastructure allowing cross-customer contamination
- Platform architecture analysis shows vulnerability in API gateway affecting all customer environments
Tracker Network Analysis:
- API traffic analysis reveals coordinated attack pattern from multiple source IPs
- Customer environment monitoring shows systematic data exfiltration across platform
- Infrastructure monitoring reveals worm leveraging container orchestration for rapid spread
Communicator Stakeholder Assessment:
- Customer communication reveals widespread panic and demands for immediate explanations
- Legal analysis confirms data breach notification requirements across multiple jurisdictions
- Reputation management assessment shows social media and news coverage beginning
Crisis Manager Strategic Coordination:
- Platform-wide impact assessment reveals potential for complete customer data compromise
- Business continuity planning for mass customer defection and legal liability
- Incident response coordination between customer protection and technical containment
Evolution Triggers:
- Intermediate → Advanced: Customers begin switching to competitors, platform reputation damaged
- Advanced → Critical: Worm achieves platform-wide persistence, customer data destruction begins
Success Metrics:
- Rapid isolation of vulnerable API endpoints
- Effective customer communication maintaining trust
- Technical containment preventing complete platform compromise
- Coordinated response between technical and business teams
Learning Objectives:
- Mass exploitation and automated attack propagation
- Cloud infrastructure security and multi-tenant isolation
- Customer communication during security incidents
- Business impact of platform-wide vulnerabilities
Historical Context for IMs:
This scenario modernizes the 2001 Code Red worm, which exploited IIS buffer overflows to deface websites and spread automatically across the internet. The contemporary version translates this to modern cloud SaaS infrastructure, where API vulnerabilities can affect thousands of customers simultaneously, creating the same rapid propagation and mass impact that made Code Red significant.
Code Red Scenario: University Technology Services Crisis (2001)
Historical Context & Modernization Prompts
Understanding 2001 Technology Context
This scenario represents the actual Code Red worm attack from July 2001. Key historical elements to understand:
- Internet Infrastructure: Much smaller, primarily academic and corporate networks
- Security Awareness: Buffer overflow vulnerabilities were poorly understood outside expert circles
- Patch Management: No automated update systems - all patches applied manually
- Network Architecture: Flat networks with minimal segmentation or access controls
- Response Capabilities: No dedicated incident response teams at most organizations
Collaborative Modernization Questions for Players
Present these questions after initial investigation to guide modernization:
- “How would this attack work in today’s cloud infrastructure?”
- Guide toward: API vulnerabilities, container security, multi-tenant isolation
- “What would be the equivalent of ‘website defacement’ for modern applications?”
- Guide toward: Data manipulation, service disruption, customer-facing impact
- “How has automated scanning and exploitation evolved since 2001?”
- Guide toward: Modern vulnerability scanners, exploit kits, automated toolchains
- “What would university IT infrastructure look like today?”
- Guide toward: SaaS services, cloud providers, mobile applications, remote learning
- “How would incident response be different with modern tools and practices?”
- Guide toward: Automated detection, centralized logging, threat intelligence, coordination
Modernization Discovery Process
After historical investigation, facilitate modernization discussion:
- Technology Translation: Help players identify modern equivalents to 2001 technology
- Attack Vector Evolution: Explore how automated exploitation has advanced
- Impact Amplification: Discuss how interconnected systems change incident scope
- Response Evolution: Compare 2001 manual response to modern automated capabilities
- Scenario Adaptation: Collaboratively develop contemporary version
Learning Objectives
- Historical Perspective: Understanding how cybersecurity threats have evolved
- Technology Evolution: Recognizing parallels between historical and modern vulnerabilities
- Incident Response Development: Appreciating advances in security practices and tools
- Collaborative Learning: Working together to modernize historical threats for current relevance
IM Facilitation Notes
- Start Historical: Present the 2001 scenario authentically without modern context
- Guide Discovery: Use questions to help players discover modern parallels
- Encourage Creativity: Support player ideas for modernization even if unconventional
- Maintain Learning Focus: Emphasize what the historical context teaches about current threats
- Document Evolution: Capture player modernization ideas for future scenario development
This historical foundation approach allows teams to learn from cybersecurity history while developing skills to analyze how threats evolve and adapt to changing technology landscapes.
Ghost Rat (Long-term Espionage)
Ghost Rat Scenario: Meridian Capital Management Espionage
Scenario Details for IMs
Opening Presentation
“It’s Thursday morning at Meridian Capital Management, and the firm is 72 hours from announcing a $2 billion merger that will reshape the financial services industry. But during final preparation meetings, executives notice disturbing signs: mouse cursors moving on their own during confidential discussions, documents opening unexpectedly, and computer screens occasionally flickering. The IT team discovers evidence of sophisticated remote access tools that have been providing attackers complete control over executive workstations for weeks.”
Initial Symptoms to Present:
- “Executive computers showing signs of remote control - mouse cursors moving independently”
- “Confidential merger documents being accessed during off-hours when offices are empty”
- “Screen capture activity detected on workstations containing sensitive trading algorithms”
- “Network traffic indicating data exfiltration from executive systems containing client portfolio information”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated remote access trojan with complete system control capabilities
- Email analysis shows targeted spear-phishing campaign using convincing merger-related documents
- Timeline analysis indicates weeks of undetected access to confidential financial data and trading strategies
Protector System Analysis:
- Executive workstation monitoring reveals real-time screen capture and keystroke logging activity
- Financial data system assessment shows unauthorized access to client portfolios and proprietary trading algorithms
- Network security analysis indicates coordinated multi-target campaign affecting other financial institutions
Tracker Network Investigation:
- Command and control traffic analysis reveals sophisticated APT infrastructure with centralized management capabilities
- Financial intelligence coordination patterns suggest nation-state or organized criminal targeting of merger intelligence
- Market activity analysis indicates potential use of stolen information for illegal trading and market manipulation
Communicator Stakeholder Interviews:
- Executive interviews reveal suspicious computer behavior during confidential merger negotiations
- Client communication assessment regarding potential exposure of investment data and trading strategies
- Regulatory coordination with SEC regarding potential insider trading and market manipulation using stolen intelligence
Mid-Scenario Pressure Points:
- Hour 1: Merger partner discovers potential data breach threatening $2 billion transaction completion
- Hour 2: SEC investigators arrive to assess potential insider trading using stolen merger intelligence
- Hour 3: Proprietary trading algorithms found on underground markets affecting competitive advantage
- Hour 4: Client portfolio data exposure threatens regulatory compliance and customer trust
Evolution Triggers:
- If investigation reveals market manipulation, SEC enforcement action affects merger completion
- If remote access continues, attackers maintain persistent control for long-term financial espionage
- If client data exposure is confirmed, regulatory penalties threaten firm survival and industry reputation
Resolution Pathways:
Technical Success Indicators:
- Complete remote access trojan removal from executive systems with forensic preservation of evidence
- Trading algorithm and client data security verified preventing further unauthorized access
- APT infrastructure analysis provides intelligence on coordinated financial services targeting
Business Success Indicators:
- Merger completion protected through secure evidence handling and regulatory coordination
- Client relationships maintained through transparent communication and data protection verification
- Regulatory compliance demonstrated preventing SEC enforcement action and industry penalties
Learning Success Indicators:
- Team understands sophisticated APT capabilities and long-term corporate espionage operations
- Participants recognize financial services targeting and regulatory implications of data theft
- Group demonstrates coordination between cybersecurity response and financial regulatory compliance
Common IM Facilitation Challenges:
If Remote Control Sophistication Is Underestimated:
“Your malware analysis is good, but Dr. Rodriguez just discovered that attackers have been watching executive screens in real-time during confidential merger meetings. How does complete remote control change your investigation approach?”
If Regulatory Implications Are Ignored:
“While you’re removing the malware, Agent Kim needs to know: has stolen merger intelligence been used for illegal trading? How do you coordinate cybersecurity response with SEC investigation requirements?”
If Market Impact Is Overlooked:
“Charles just learned that trading strategies may have appeared on underground markets. How do you assess whether stolen financial intelligence has been used for market manipulation?”
Success Metrics for Session:
Ghost Rat Scenario: Titan Defense Systems Surveillance
Scenario Details for IMs
Opening Presentation
“It’s Monday morning at Titan Defense Systems, and the company is completing final classified designs for next-generation military equipment that will be delivered to the Pentagon on Thursday. But during secure engineering meetings, staff notice disturbing anomalies: CAD workstations performing actions without user input, classified design files opening automatically, and computer screens flickering during confidential discussions. Security investigation reveals sophisticated remote access tools providing foreign adversaries complete surveillance capabilities over classified defense development.”
Initial Symptoms to Present:
- “Engineering workstations showing signs of remote control during classified design work”
- “Classified weapon designs being accessed automatically during secure engineering meetings”
- “Screen capture and keystroke logging detected on systems containing military specifications”
- “Network traffic indicating exfiltration of classified defense technology to foreign command infrastructure”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated nation-state remote access trojan with comprehensive surveillance capabilities
- Classified network analysis shows targeted spear-phishing campaign using convincing military technical documents
- Counterintelligence timeline indicates months of undetected foreign surveillance of classified weapons development
Protector System Analysis:
- Engineering workstation monitoring reveals real-time screen surveillance and data theft of classified designs
- Defense security assessment shows unauthorized foreign access to classified weapons specifications and military technology
- Classified network security analysis indicates coordinated multi-target campaign affecting other defense contractors
Tracker Network Investigation:
- Command and control traffic analysis reveals sophisticated foreign intelligence infrastructure targeting defense industrial base
- Military technology intelligence patterns suggest nation-state coordination of classified weapons technology theft
- Defense contractor communication analysis indicates systematic foreign targeting of classified military development programs
Communicator Stakeholder Interviews:
- Defense engineer interviews reveal suspicious computer behavior during classified weapons development meetings
- Military program coordination regarding potential compromise of classified weapons technology and operational security
- Counterintelligence coordination with FBI and Defense Security Service regarding foreign espionage investigation
Mid-Scenario Pressure Points:
- Hour 1: Pentagon security officials discover potential compromise of classified weapons delivery affecting national defense readiness
- Hour 2: FBI counterintelligence investigation reveals evidence of foreign military intelligence targeting
- Hour 3: Classified weapons designs found on foreign intelligence networks affecting military operational advantage
- Hour 4: Defense Security Service assessment indicates potential compromise of multiple classified military programs
Evolution Triggers:
- If investigation reveals foreign technology transfer, national security enforcement action affects defense industry
- If remote surveillance continues, adversaries maintain persistent access for long-term classified intelligence collection
- If classified design theft is confirmed, military operational security and national defense capabilities are compromised
Resolution Pathways:
Technical Success Indicators:
- Complete foreign surveillance removal from classified engineering systems with preservation of counterintelligence evidence
- Classified weapons technology security verified preventing further unauthorized foreign access
- Nation-state infrastructure analysis provides intelligence on coordinated defense industrial targeting
Business Success Indicators:
- Classified weapons delivery protected through secure forensic handling and counterintelligence coordination
- Defense contract relationships maintained through professional incident response and security demonstration
- National security compliance demonstrated preventing defense security penalties and clearance revocation
Learning Success Indicators:
- Team understands sophisticated foreign intelligence capabilities and long-term defense industrial espionage
- Participants recognize defense contractor targeting and national security implications of classified technology theft
- Group demonstrates coordination between cybersecurity response and counterintelligence investigation requirements
Common IM Facilitation Challenges:
If Foreign Surveillance Sophistication Is Underestimated:
“Your malware removal is progressing, but Dr. Chang discovered that foreign adversaries have been watching classified engineering meetings in real-time for months. How does comprehensive foreign surveillance change your counterintelligence approach?”
If National Security Implications Are Ignored:
“While you’re cleaning infected systems, Agent Kim needs to know: have classified weapons designs been transferred to foreign military programs? How do you coordinate cybersecurity response with counterintelligence investigation?”
If Classified Information Impact Is Overlooked:
“General Wells just learned that next-generation weapons technology may be in foreign hands. How do you assess the national security impact of stolen classified military technology?”
Success Metrics for Session:
Ghost Rat Scenario: Blackstone & Associates Surveillance
Scenario Details for IMs
Opening Presentation
“It’s Thursday morning at Blackstone & Associates, and the firm is completing final preparations for a $500 million corporate lawsuit that begins Monday. But during confidential client strategy sessions, attorneys notice concerning anomalies: legal workstations performing unauthorized actions, case files opening during private meetings, and opposing counsel demonstrating uncanny knowledge of the firm’s legal strategies. Investigation reveals sophisticated surveillance tools providing adversaries complete access to privileged attorney-client communications.”
Initial Symptoms to Present:
- “Attorney workstations showing signs of remote control during confidential client meetings”
- “Privileged legal documents being accessed automatically during confidential case strategy sessions”
- “Screen surveillance and keystroke logging detected on systems containing confidential client communications”
- “Network traffic indicating exfiltration of privileged legal strategies to unauthorized external networks”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated corporate espionage remote access trojan targeting legal communications
- Legal network analysis shows targeted spear-phishing campaign using convincing legal industry documents
- Attorney-client privilege timeline indicates weeks of undetected surveillance of confidential legal communications
Protector System Analysis:
- Legal workstation monitoring reveals real-time surveillance and theft of privileged attorney-client communications
- Case strategy system assessment shows unauthorized access to confidential legal documents and client information
- Legal network security analysis indicates coordinated campaign targeting multiple law firms and privileged communications
Tracker Network Investigation:
- Command and control traffic analysis reveals corporate espionage infrastructure targeting legal industry communications
- Legal intelligence coordination patterns suggest organized adversary targeting of privileged attorney-client information
- Case strategy communication analysis indicates systematic targeting of high-value corporate litigation intelligence
Communicator Stakeholder Interviews:
- Attorney interviews reveal suspicious computer behavior during confidential client meetings and case strategy sessions
- Client communication assessment regarding potential exposure of privileged information and legal strategies
- Professional ethics coordination regarding attorney-client privilege violations and professional responsibility requirements
Mid-Scenario Pressure Points:
- Hour 1: Major corporate client discovers potential compromise of privileged communications threatening lawsuit strategy
- Hour 2: Opposing counsel demonstrates detailed knowledge of confidential legal strategy indicating information leak
- Hour 3: Privileged client documents found in unauthorized networks affecting attorney-client confidentiality
- Hour 4: State bar investigation initiated regarding potential attorney-client privilege violations and professional ethics
Evolution Triggers:
- If investigation reveals legal strategy compromise, case outcome and professional reputation are threatened
- If surveillance continues, adversaries maintain persistent access to privileged attorney-client communications
- If client information exposure is confirmed, attorney-client privilege violations threaten professional practice
Resolution Pathways:
Technical Success Indicators:
- Complete legal surveillance removal from attorney systems with forensic preservation of professional ethics evidence
- Attorney-client communication security verified preventing further unauthorized access to privileged information
- Corporate espionage infrastructure analysis provides intelligence on coordinated legal industry targeting
Business Success Indicators:
- Legal case integrity protected through secure evidence handling and professional ethics coordination
- Client relationships maintained through transparent communication and privileged information protection verification
- Professional ethics compliance demonstrated preventing state bar discipline and professional practice penalties
Learning Success Indicators:
- Team understands sophisticated corporate espionage capabilities and long-term legal surveillance operations
- Participants recognize legal profession targeting and attorney-client privilege implications of privileged communication theft
- Group demonstrates coordination between cybersecurity response and professional ethics investigation requirements
Common IM Facilitation Challenges:
If Legal Surveillance Sophistication Is Underestimated:
“Your incident response is thorough, but Daniel discovered that adversaries have been watching confidential client meetings in real-time for weeks. How does comprehensive legal surveillance change your professional ethics approach?”
If Attorney-Client Privilege Implications Are Ignored:
“While you’re removing malware, Ethics Counsel Santos needs to know: have privileged client communications been compromised? How do you coordinate cybersecurity response with professional responsibility investigation?”
If Case Strategy Impact Is Overlooked:
“Managing Partner Harper just learned that opposing counsel seems to know confidential legal strategy details. How do you assess whether stolen legal intelligence has compromised case outcomes?”
Success Metrics for Session:
Ghost Rat Scenario: Metropolitan Research University Theft
Scenario Details for IMs
Opening Presentation
“It’s Tuesday morning at Metropolitan Research University, and faculty are completing final preparations for publishing breakthrough medical research that could revolutionize cancer treatment and secure millions in follow-up funding. But during confidential research meetings, scientists notice troubling signs: workstations performing unauthorized actions, research data files opening automatically, and laboratory equipment responding to commands no one issued. Investigation reveals sophisticated surveillance tools providing foreign competitors complete access to cutting-edge academic research and intellectual property.”
Initial Symptoms to Present:
- “Research workstations showing signs of remote control during confidential scientific meetings”
- “Confidential research data being accessed automatically during private faculty collaboration sessions”
- “Screen surveillance and data theft detected on systems containing breakthrough scientific discoveries”
- “Network traffic indicating exfiltration of research intellectual property to foreign academic and commercial networks”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated foreign academic espionage remote access trojan targeting scientific research
- University network analysis shows targeted spear-phishing campaign using convincing academic collaboration documents
- Research intellectual property timeline indicates months of undetected foreign surveillance of breakthrough scientific development
Protector System Analysis:
- Research workstation monitoring reveals real-time surveillance and theft of confidential scientific data and methodologies
- Laboratory system assessment shows unauthorized foreign access to research discoveries and patent applications
- Academic network security analysis indicates coordinated campaign targeting multiple research universities and scientific institutions
Tracker Network Investigation:
- Command and control traffic analysis reveals foreign academic espionage infrastructure targeting American research institutions
- Scientific intelligence coordination patterns suggest nation-state and commercial competitor targeting of research intellectual property
- Research collaboration communication analysis indicates systematic foreign targeting of high-value scientific discoveries
Communicator Stakeholder Interviews:
- Faculty interviews reveal suspicious computer behavior during confidential research meetings and scientific collaboration
- Research funding coordination regarding potential compromise of intellectual property and grant applications
- Academic community coordination with other universities experiencing similar research targeting and intellectual property theft
Mid-Scenario Pressure Points:
- Hour 1: Major research funding agency discovers potential compromise of breakthrough discoveries affecting future grant awards
- Hour 2: FBI economic espionage investigation reveals evidence of foreign targeting of American scientific competitive advantage
- Hour 3: Research intellectual property found on foreign academic networks affecting scientific publication and patent applications
- Hour 4: Technology transfer assessment indicates potential compromise of multiple valuable scientific discoveries and commercialization opportunities
Evolution Triggers:
- If investigation reveals research theft, scientific competitive advantage and funding relationships are compromised
- If surveillance continues, foreign competitors maintain persistent access to breakthrough scientific research
- If intellectual property theft is confirmed, university research mission and academic collaboration are threatened
Resolution Pathways:
Technical Success Indicators:
- Complete foreign surveillance removal from research systems with preservation of intellectual property protection evidence
- Scientific research security verified preventing further unauthorized foreign access to confidential discoveries
- Foreign espionage infrastructure analysis provides intelligence on coordinated academic targeting and intellectual property theft
Business Success Indicators:
- Research publication and funding protected through secure forensic handling and intellectual property coordination
- Academic relationships maintained through professional incident response and research security demonstration
- Scientific competitive advantage preserved preventing loss of research leadership and commercialization opportunities
Learning Success Indicators:
- Team understands sophisticated foreign academic espionage capabilities and long-term research targeting operations
- Participants recognize university research targeting and intellectual property implications of scientific discovery theft
- Group demonstrates coordination between cybersecurity response and academic research protection requirements
Common IM Facilitation Challenges:
If Foreign Academic Espionage Sophistication Is Underestimated:
“Your malware removal is progressing, but Professor Martinez discovered that foreign competitors have been watching confidential research meetings in real-time for months. How does comprehensive academic surveillance change your intellectual property protection approach?”
If Research Competitive Advantage Implications Are Ignored:
“While you’re cleaning infected systems, Agent Park needs to know: have breakthrough scientific discoveries been transferred to foreign research institutions? How do you coordinate cybersecurity response with economic espionage investigation?”
If Scientific Collaboration Impact Is Overlooked:
“Dr. Foster just learned that research methodologies and patent applications may be in foreign hands. How do you assess the impact on scientific competitive advantage and academic collaboration security?”
Success Metrics for Session:
Gh0st RAT Scenario: Advanced Corporate Espionage Campaign
Scenario Details for IMs
Opening Presentation
“You’re at InnovaTech Dynamics, a cybersecurity consulting firm that works with defense contractors and government agencies. Your security operations team has detected unusual network activity that suggests long-term unauthorized access to your systems. Initial analysis reveals sophisticated remote access tools that appear to be legitimate administrative software but are actually advanced espionage tools. The attackers have potentially accessed sensitive client data, intellectual property, and classified project information over several months.”
Initial Symptoms to Present:
- “Network monitoring reveals suspicious remote access patterns using legitimate cloud services”
- “Administrative tools and system utilities showing signs of modification or misuse”
- “Unusual data access patterns suggesting systematic theft of client project information”
- “Remote access sessions occurring during non-business hours using legitimate credentials”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal sophisticated remote access tools disguised as legitimate system administration utilities
- Network analysis discovers persistent adversary presence using living-off-the-land techniques
- Data access analysis shows systematic targeting of high-value intellectual property and client information
Protector System Analysis:
- Endpoint security assessment reveals advanced evasion techniques using legitimate administrative tools
- Network segmentation analysis shows lateral movement through trusted consulting relationships
- Client environment security assessment reveals potential compromise of customer networks
Tracker Threat Intelligence:
- Adversary behavior analysis reveals advanced persistent threat techniques and professional tradecraft
- Command and control analysis discovers use of legitimate cloud services for covert communication
- Attribution analysis suggests nation-state or corporate espionage capabilities
Communicator Stakeholder Management:
- Client notification and damage assessment for potential compromise of sensitive project data
- Federal agency coordination for security clearance implications and national security concerns
- Legal analysis for breach notification requirements and potential litigation exposure
Crisis Manager Strategic Response:
- Government contract security implications and potential loss of security clearances
- Client relationship management during active espionage investigation
- Business continuity planning for potential loss of defense and government contracts
Evolution Triggers:
- Intermediate → Advanced: Discovery of client network compromise through trusted relationships
- Advanced → Critical: Evidence of classified information theft requiring federal investigation
Success Metrics:
- Successful threat hunting and persistent access elimination
- Effective client communication and relationship preservation
- Coordinated federal investigation support
- Business continuity maintenance during active espionage response
Learning Objectives:
- Advanced persistent threat techniques and remote access tools
- Corporate espionage and intellectual property theft
- Government contract security implications
- Threat hunting and living-off-the-land detection
Historical Context for IMs:
This scenario modernizes the 2008 Gh0st RAT, which was a basic remote access trojan commonly used in early APT campaigns. The contemporary version adapts this to modern advanced persistent threat techniques, where attackers use legitimate cloud services and administrative tools to maintain long-term access for corporate espionage, reflecting the evolution of remote access threats from basic tools to sophisticated nation-state tradecraft.
Ghost RAT Scenario: Corporate Espionage Network Discovery (2008)
Historical Context & Modernization Prompts
Understanding 2008 Technology Context
This scenario represents actual Gh0st RAT attacks from 2008. Key historical elements to understand:
- Email Security: Basic antivirus scanning with limited attachment sandboxing or behavioral analysis
- Remote Access Tools: RATs were relatively new concept for non-technical organizations
- Social Engineering: Business email compromise techniques were emerging but not widely understood
- Network Monitoring: Limited visibility into endpoint behavior and network communications
- Incident Response: Most organizations lacked dedicated cybersecurity teams or formal response procedures
Collaborative Modernization Questions for Players
Present these questions after initial investigation to guide modernization:
- “How would similar social engineering attacks work with today’s communication tools?”
- Guide toward: Cloud collaboration platforms, instant messaging, mobile applications
- “What modern remote access techniques provide similar capabilities to 2008 RATs?”
- Guide toward: Living-off-the-land tools, cloud-based C2, legitimate remote access software abuse
- “How has business email compromise evolved since 2008?”
- Guide toward: CEO fraud, vendor impersonation, cloud email security challenges
- “What would international trade data look like in today’s digital environment?”
- Guide toward: Cloud platforms, API integrations, mobile access, digital supply chain systems
- “How would modern detection identify this type of persistent access?”
- Guide toward: Behavioral analysis, endpoint detection, threat hunting, user behavior analytics
Modernization Discovery Process
After historical investigation, facilitate modernization discussion:
- Communication Evolution: Explore how business communication has moved to cloud platforms
- Attack Technique Advancement: Discuss how RAT capabilities are now built into legitimate tools
- Detection Improvement: Compare 2008 signature-based detection to modern behavioral analysis
- Business Impact Amplification: Consider how modern interconnected systems change compromise scope
- Response Coordination: Examine how organizations can better coordinate international incident response
Learning Objectives
- Advanced Persistent Threats: Understanding long-term, targeted attack campaigns
- Social Engineering Evolution: Recognizing how targeted attacks exploit business processes
- Remote Access Security: Appreciating challenges of legitimate vs. malicious remote access
- International Business Risk: Learning how global operations create complex security challenges
IM Facilitation Notes
- Business Context Focus: Emphasize how attacks target business processes rather than just technology
- Persistence Explanation: Help players understand how attackers maintain long-term access
- Detection Challenges: Discuss why persistent access can remain hidden for months
- Modernization Guidance: Support player exploration of how contemporary threats are more sophisticated
- Cultural Sensitivity: Address international aspects respectfully and professionally
This historical foundation helps teams understand how targeted attacks evolved from basic remote access tools to sophisticated APT campaigns, while exploring how modern business environments create new opportunities and challenges for attackers.
Raspberry Robin (USB Loader)
Raspberry Robin Scenario: Precision Manufacturing Corp Outbreak
Scenario Details for IMs
Opening Presentation
“It’s Tuesday morning at Precision Manufacturing Corp, and the factory is operating at maximum capacity to fulfill a critical aerospace contract due Friday. Maintenance technicians are performing routine equipment updates using USB drives to transfer data between air-gapped production systems when they notice something disturbing: the USB drives are automatically creating files that look like normal folders, but clicking on them causes strange system behavior. The malware is spreading through legitimate maintenance procedures, jumping between isolated manufacturing networks.”
Initial Symptoms to Present:
- “USB drives used for equipment maintenance automatically creating suspicious LNK files”
- “Production control systems showing signs of infection after routine USB data transfers”
- “Air-gapped manufacturing networks experiencing unauthorized file creation and system modifications”
- “Worker safety monitoring systems displaying anomalous behavior after USB maintenance procedures”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal USB-based worm creating malicious LNK files disguised as legitimate folders
- Manufacturing system analysis shows infection spreading through routine maintenance USB procedures
- Timeline analysis indicates initial compromise through external contractor USB device
Protector System Analysis:
- Production control system monitoring reveals USB-based malware bypassing air-gapped network security
- Industrial safety system assessment shows potential compromise of worker protection monitoring
- Manufacturing network security analysis indicates systematic USB-based propagation across isolated systems
Tracker Network Investigation:
- USB device analysis reveals sophisticated worm designed specifically for air-gapped environment spreading
- Manufacturing system communication patterns show malware adapting to industrial control protocols
- Production data integrity analysis indicates potential compromise of quality control and safety systems
Communicator Stakeholder Interviews:
- Maintenance technician interviews reveal routine USB usage patterns and infection spread mechanisms
- Production management coordination regarding manufacturing deadline impact and system safety
- Aerospace customer communication about potential production delays and quality assurance
Mid-Scenario Pressure Points:
- Hour 1: Critical production line shuts down due to infected USB drives affecting manufacturing control systems
- Hour 2: Worker safety monitoring systems show signs of compromise affecting factory floor operations
- Hour 3: Aerospace customer demands assurance that production quality hasn’t been compromised by malware
- Hour 4: Manufacturing deadline approaches with production systems still showing signs of USB-based infection
Evolution Triggers:
- If USB disinfection fails, malware continues spreading through all manufacturing maintenance procedures
- If production systems remain infected, aerospace contract delivery is threatened
- If safety systems are compromised, worker protection and regulatory compliance are at risk
Resolution Pathways:
Technical Success Indicators:
- Complete USB-based malware removal from manufacturing systems with verified clean maintenance procedures
- Air-gapped network security restored preventing further USB-based propagation
- Production control and safety system integrity verified ensuring worker protection and manufacturing quality
Business Success Indicators:
- Manufacturing operations restored maintaining aerospace contract delivery schedule
- Production quality assurance verified preventing customer concerns and contract penalties
- Worker safety systems secured maintaining regulatory compliance and factory floor protection
Learning Success Indicators:
- Team understands USB-based propagation in air-gapped manufacturing environments
- Participants recognize removable media security challenges in industrial control systems
- Group demonstrates coordination between cybersecurity response and manufacturing operations continuity
Common IM Facilitation Challenges:
If Air-Gapped Environment Is Misunderstood:
“Your network security approach is solid, but Carlos explains that manufacturing systems are air-gapped - the malware is spreading through USB drives during routine maintenance. How does this change your containment strategy?”
If Production Impact Is Ignored:
“While you’re analyzing the USB malware, Janet reports that production line 3 is down and the aerospace contract delivery is at risk. How do you balance thorough investigation with critical manufacturing deadlines?”
If Safety System Compromise Is Overlooked:
“Diana just discovered that worker safety monitoring systems may be infected through the same USB maintenance procedures. How do you assess and protect worker safety while managing production continuity?”
Success Metrics for Session:
Raspberry Robin Scenario: State Department of Revenue Breach
Scenario Details for IMs
Opening Presentation
“It’s Wednesday morning at the State Department of Revenue during peak tax season, and government employees are processing thousands of tax returns while field auditors collect taxpayer documents using USB drives for secure transfer. But auditors begin reporting disturbing behavior: USB drives are automatically creating files that appear to be normal folders, but accessing them causes system anomalies. The USB-based malware is spreading through legitimate government workflows, affecting both taxpayer data systems and citizen service networks.”
Initial Symptoms to Present:
- “USB drives used by field auditors automatically creating suspicious LNK files disguised as folders”
- “Government tax processing systems showing signs of infection after routine USB data transfers”
- “Citizen service networks experiencing unauthorized file creation and system modifications”
- “Taxpayer data security systems displaying anomalous behavior after USB-based document transfers”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal USB-based worm creating malicious LNK files designed to spread through government workflows
- Government system analysis shows infection propagating through routine taxpayer data collection procedures
- Security timeline indicates potential initial compromise through citizen interaction or contractor device
Protector System Analysis:
- Government network monitoring reveals USB-based malware bypassing security controls and air-gapped protections
- Taxpayer data system assessment shows potential compromise of sensitive citizen information processing
- Government security analysis indicates systematic USB-based propagation across classified and citizen service networks
Tracker Network Investigation:
- USB device forensics reveal sophisticated worm adapted for government workflow exploitation
- Government system communication patterns show malware leveraging legitimate administrative processes
- Taxpayer data integrity analysis indicates potential exposure of sensitive citizen information
Communicator Stakeholder Interviews:
- Government employee interviews reveal routine USB usage patterns in taxpayer data collection and processing
- Citizen service coordination regarding potential exposure of personal tax and financial information
- Regulatory compliance assessment with state and federal government cybersecurity requirements
Mid-Scenario Pressure Points:
- Hour 1: Taxpayer data processing systems shut down due to USB malware affecting peak tax season operations
- Hour 2: Field audit operations suspended as infected USB drives threaten taxpayer information security
- Hour 3: Government security assessment reveals potential exposure of sensitive citizen data to USB-based malware
- Hour 4: State cybersecurity authorities demand immediate containment and taxpayer notification assessment
Evolution Triggers:
- If USB disinfection fails, malware continues spreading through all government data collection procedures
- If taxpayer data exposure is confirmed, regulatory notification and public trust crisis ensue
- If government service disruption continues, citizen services and tax season operations are compromised
Resolution Pathways:
Technical Success Indicators:
- Complete USB-based malware removal from government systems with verified clean data collection procedures
- Government network security restored preventing further USB-based propagation across citizen service systems
- Taxpayer data integrity verified ensuring citizen information protection and regulatory compliance
Business Success Indicators:
- Government operations restored maintaining tax season processing and citizen service delivery
- Public trust protected through transparent communication and professional incident management
- Regulatory compliance maintained preventing government cybersecurity penalties and citizen notification requirements
Learning Success Indicators:
- Team understands USB-based propagation in government environments with citizen data protection requirements
- Participants recognize removable media security challenges in government workflows and regulatory compliance
- Group demonstrates coordination between cybersecurity response and government service continuity obligations
Common IM Facilitation Challenges:
If Government Workflow Complexity Is Ignored:
“Your network security strategy is sound, but Linda explains that field auditors must use USB drives to collect taxpayer documents from citizen locations. How does legitimate government workflow requirement change your USB security approach?”
If Taxpayer Data Impact Is Minimized:
“While you’re removing USB malware, Kevin discovered that infected systems process millions of taxpayer tax returns and personal financial information. How do you assess potential citizen data exposure and notification requirements?”
If Public Trust Implications Are Overlooked:
“Director Chen just learned that news media is asking about government cybersecurity breach during tax season. How do you balance technical response with public trust and transparent government communication obligations?”
Success Metrics for Session:
Raspberry Robin Scenario: Healthcare Network USB Outbreak
Scenario Details for IMs
Opening Presentation
“It’s Thursday morning at Regional Health System during peak flu season, with hospitals operating at surge capacity and medical staff using USB drives for routine medical device updates and patient data transfers. Medical technicians report that USB drives are automatically creating files that appear to be normal folders, but accessing them causes medical equipment anomalies. The USB malware is spreading through legitimate healthcare workflows, affecting patient monitoring systems and electronic health records.”
Initial Symptoms to Present:
- “USB drives used for medical device updates creating suspicious LNK files disguised as medical folders”
- “Patient monitoring systems showing anomalies after routine USB maintenance procedures”
- “Electronic health record systems experiencing unauthorized file creation after USB data transfers”
- “Medical equipment networks displaying signs of infection through USB-based maintenance workflows”
Common IM Facilitation Challenges:
If Patient Safety Is Overlooked:
“Your USB security response is thorough, but Dr. Williams reports that infected medical devices are affecting patient monitoring during flu surge. How do you balance malware removal with immediate patient safety requirements?”
If Healthcare Workflow Complexity Is Ignored:
“While analyzing USB propagation, Lisa explains that medical technicians must use USB drives to update life-critical equipment that can’t be networked for safety reasons. How does this change your containment approach?”
If HIPAA Implications Are Minimized:
“David discovered that infected USB drives have accessed electronic health record systems containing patient data. How do you assess potential HIPAA breach notification requirements while managing patient care continuity?”
Success Metrics for Session:
Raspberry Robin Scenario: Community First Bank Network
Scenario Details for IMs
Success Metrics for Session:
Poison Ivy (Persistent Backdoor)
Poison Ivy Scenario: Corporate Espionage Campaign
Poison Ivy Scenario: Law Enforcement Surveillance
Poison Ivy Scenario: Medical Practice Patient Data
Poison Ivy Scenario: Wealth Management Partners Surveillance
Poison Ivy Scenario: Supply Chain Software Infiltration
Scenario Details for IMs
Opening Presentation
“You’re at SecureFlow Systems, a software company that provides supply chain management solutions to hundreds of Fortune 500 companies. Your development team has discovered unusual activity in the software build environment - code repositories show unauthorized changes, and your automated deployment systems have been modified. Security analysis reveals sophisticated remote access tools that have compromised your development pipeline. Worse, malicious code may have already been deployed to customer organizations through recent software updates.”
Initial Symptoms to Present:
- “Software build systems showing unauthorized modifications and suspicious automated processes”
- “Remote access tools using legitimate cloud services and system administration utilities”
- “Code repositories containing unauthorized changes that bypass normal development approval processes”
- “Customer reports of unusual behavior in recently deployed software updates”
Key Discovery Paths:
Detective Investigation Leads:
- Software forensics reveal malicious code injection into legitimate development processes
- Build pipeline analysis shows compromise of automated deployment and code signing systems
- Attack vector analysis discovers initial compromise through targeted social engineering of development staff
Protector System Analysis:
- Development environment security assessment reveals persistent adversary access using legitimate tools
- Code integrity analysis shows sophisticated supply chain poisoning techniques
- Customer deployment security assessment reveals scope of potentially compromised software updates
Tracker Command and Control Analysis:
- Network monitoring reveals use of legitimate cloud services for covert command and control
- Software supply chain analysis discovers coordinated attack targeting multiple software vendors
- Threat intelligence reveals broader campaign against software development companies
Communicator Customer Relations:
- Fortune 500 customer notification about potential supply chain compromise in their production systems
- Software integrity verification and emergency patch deployment coordination
- Legal analysis for liability and regulatory compliance during supply chain security incident
Crisis Manager Business Continuity:
- Software development process security review and emergency response procedures
- Customer relationship management during active supply chain security investigation
- Business impact assessment for potential loss of customer trust and market position
Evolution Triggers:
- Intermediate → Advanced: Customer organizations report active malware infections from compromised software updates
- Advanced → Critical: Multiple software vendors report similar supply chain compromises indicating coordinated campaign
Success Metrics:
- Rapid identification and containment of development environment compromise
- Effective customer communication and software integrity verification
- Successful supply chain security incident response
- Business continuity maintenance during supply chain investigation
Learning Objectives:
- Software supply chain security and development environment protection
- Advanced remote access techniques using legitimate cloud services
- Supply chain incident response and customer communication
- DevSecOps security integration and threat detection
Historical Context for IMs:
This scenario modernizes the 2005 Poison Ivy RAT, which was a basic remote access trojan used in targeted attacks. The contemporary version adapts this to modern software supply chain attacks, where sophisticated adversaries compromise development environments to inject malicious code into software updates, reflecting the evolution from simple remote access to complex supply chain infiltration techniques.
Poison Ivy Scenario: Remote Access Discovery Timeline (2005)
Historical Context & Modernization Prompts
Understanding 2005 Technology Context
This scenario represents actual Poison Ivy RAT attacks from 2005. Key historical elements to understand:
- Email Attachments: Primary malware delivery vector with limited scanning and sandboxing capabilities
- RAT Technology: Remote administration tools were sophisticated but detection was signature-based
- Regulatory Environment: HIPAA and financial regulations existed but cybersecurity requirements were minimal
- Business Networks: Simple network architectures with limited segmentation or access controls
- Incident Response: Most small businesses had no formal cybersecurity or incident response capabilities
Collaborative Modernization Questions for Players
Present these questions after initial investigation to guide modernization:
- “How would attackers target marketing agencies in today’s digital landscape?”
- Guide toward: Cloud collaboration platforms, social media intelligence, supply chain attacks
- “What modern techniques provide similar remote access capabilities to 2005 RATs?”
- Guide toward: Cloud-based remote tools, legitimate software abuse, fileless attacks
- “How has regulatory compliance changed since 2005 for businesses handling sensitive data?”
- Guide toward: GDPR, state privacy laws, breach notification requirements, cybersecurity frameworks
- “What would client data storage and sharing look like in modern marketing agencies?”
- Guide toward: Cloud storage, collaboration platforms, mobile access, API integrations
- “How would modern threat detection identify persistent remote access?”
- Guide toward: Endpoint detection, behavioral analysis, cloud security monitoring, threat hunting
Modernization Discovery Process
After historical investigation, facilitate modernization discussion:
- Industry Evolution: Explore how marketing has moved to digital platforms and cloud services
- Regulatory Changes: Discuss how privacy laws have created new compliance requirements
- Attack Sophistication: Compare basic RAT techniques to modern supply chain and cloud attacks
- Client Risk Amplification: Consider how interconnected business relationships create cascading risk
- Detection Advancement: Examine how behavioral analysis improves on signature-based detection
Learning Objectives
- Third-Party Risk: Understanding how service providers create attack vectors to multiple targets
- Regulatory Implications: Learning how data breaches trigger complex compliance requirements
- Persistent Access: Recognizing techniques for maintaining long-term system access
- Business Process Targeting: Appreciating how attackers exploit industry-specific workflows
IM Facilitation Notes
- Multi-Client Impact: Emphasize how single compromise affects multiple organizations
- Regulatory Complexity: Help players understand compliance implications without legal expertise
- Business Relationship Focus: Highlight how attacks target trust relationships between organizations
- Evolution Discussion: Guide conversation toward modern supply chain and third-party risks
- Detection Challenges: Discuss why legitimate-looking remote access can evade detection
This historical foundation demonstrates how targeted attacks on service providers can amplify impact across multiple client organizations, while helping teams understand the evolution from basic remote access to complex supply chain threats.
Wire Lurker (Cross-Platform Mobile)
WireLurker Scenario: Design Agency Cross-Platform Outbreak
WireLurker Scenario: Tech Startup Development Environment
WireLurker Scenario: Media Company Cross-Device Infection
WireLurker Scenario: Educational Technology Cross-Platform Breach
Noodle Rat (Corporate Intelligence)
Noodle Rat Scenario: Biotech Research Surveillance
Noodle Rat Scenario: Aerospace Engineering Espionage
Noodle Rat Scenario: Investment Bank Trading Floor
Noodle Rat Scenario: Tech Unicorn Algorithm Theft
Litter Drifter (Government Targeting)
Litter Drifter Scenario: Ministry of Digital Infrastructure
Litter Drifter Scenario: Aegis Defense Systems Espionage
Litter Drifter Scenario: International Aid Organization
Litter Drifter Scenario: News Media Network
FakeBat (Payload Delivery)
FakeBat Scenario: Small Business Software Trap
FakeBat Scenario: Gaming Cafe Network Infection
FakeBat Scenario: Nonprofit Organization Deception
FakeBat Scenario: Freelancer Coworking Space
Selection Guidelines
By Experience Level:
- Beginner Groups: Gaboon Grabber, Raspberry Robin, FakeBat scenarios
- Intermediate Groups: WannaCry, Poison Ivy, Wire Lurker scenarios
- Advanced Groups: Stuxnet, Ghost Rat, Noodle Rat, Litter Drifter scenarios
By Session Length:
- 2-hour sessions: Single-organization scenarios with clear timelines
- 4-hour sessions: Multi-stakeholder scenarios with complex interdependencies
- Campaign play: Mix scenarios to show malmon evolution and organizational learning
By Learning Objectives:
- Technical Skills: Stuxnet, Code Red scenarios emphasize technical analysis
- Social Engineering: Gaboon Grabber, FakeBat scenarios focus on human factors
- Incident Coordination: WannaCry, Ghost Rat scenarios teach team leadership
- Long-term Investigations: Poison Ivy, Noodle Rat scenarios develop patience and methodology