LockBit Scenario: Law Firm Case Preparation Crisis
LockBit Scenario: Law Firm Case Preparation Crisis
Planning Resources
Scenario Details for IMs
Hook
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
- Hour 1: Litigation teams cannot access filings due before Monday
- Hour 2: Threat actors send excerpted legal communications as proof of access
- Hour 3: Counterparties ask whether current proceedings are affected by data exposure
- Hour 4: Insurance and ethics advisers request immediate incident posture documentation
Evolution Triggers:
- If containment is delayed, additional practice groups lose access to case materials
- If recovery is rushed without validation, restored systems may reintroduce compromise
- If disclosure is delayed, professional-conduct exposure and client trust impact expand rapidly
Resolution Pathways:
Technical Success Indicators:
- Verified clean recovery path for critical legal-document platforms
- Evidence package preserved for law-enforcement and regulatory coordination
- Secure interim communication channels established for urgent legal operations
Business Success Indicators:
- Clients receive timely, accurate updates tied to concrete response actions
- Deadline management remains defensible through documented contingency decisions
- Firm leadership preserves confidence through transparent risk framing
Learning Success Indicators:
- Team recognizes legal-sector ransomware leverage patterns around privilege and deadlines
- Participants practice balancing technical confidence with professional obligations
- Group coordinates legal, operational, and security workstreams under pressure
Common IM Facilitation Challenges:
If Client Communication Is Too Slow:
“Technical progress is real, but what specific threshold will trigger client notifications about privilege exposure risk?”
If Deadline Pressure Dominates Security Decisions:
“How do you avoid compounding legal risk by publishing or filing from systems you have not yet validated as trustworthy?”
If Reporting Is Deferred:
Success Metrics for Session:
Template Compatibility
This scenario adapts to multiple session formats with appropriate scope and timing:
Quick Demo (35-40 minutes)
Structure: 2 investigation rounds, 1 decision round
Focus: Urgent legal operations under extortion and privilege risk
Key Actions: Identify exposure scope, protect critical matters, issue first client/regulator posture
Lunch & Learn (75-90 minutes)
Structure: 4 investigation rounds, 2 decision rounds
Focus: Parallel containment and legal-obligation management
Key Actions: Build evidence timeline, validate recovery path, decide disclosure sequence
Full Game (120-140 minutes)
Structure: 6 investigation rounds, 3 decision rounds
Focus: End-to-end legal-sector ransomware response under active deadlines
Key Actions: Coordinate legal and technical leadership, make publication/filing confidence calls, define durable remediation
Advanced Challenge (150-170 minutes)
Structure: 7-8 investigation rounds, 4 decision rounds
Expert Elements: Privilege-waiver argumentation, insurer constraints, conflicting client demands
Additional Challenges: Compressed court timelines, uncertain backup integrity, escalating extortion pressure
Quick Demo Materials (35-40 min)
Guided Investigation Clues
Pre-Defined Response Options
- Option A: Immediate Recovery with Early Disclosure
- Action: Isolate affected systems, begin recovery from validated backups, and notify impacted clients quickly.
- Pros: Strong ethics posture and better long-term trust outcomes.
- Cons: Higher short-term disruption and potential matter delays.
- Type Effectiveness: Super effective for legal-compliance posture and sustainable recovery.
- Option B: Payment-Centered Acceleration
- Action: Prioritize payment negotiation for rapid decryption while delaying broad disclosure decisions.
- Pros: Potentially faster operational restoration if decryption succeeds.
- Cons: No assurance on data deletion, high reputational and compliance risk.
- Type Effectiveness: Partially effective and strategically fragile.
- Option C: Evidence-First Limited Disclosure
- Action: Preserve forensic evidence, stage recovery, and sequence notifications after initial scoping.
- Pros: Better factual basis for legal and insurance decisions.
- Cons: Delay risk for professional-conduct and client-confidence obligations.
- Type Effectiveness: Moderately effective if timing and communication discipline are strong.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Detection and Immediate Legal Impact (30-35 min)
Investigation Clues:
- Clue 1 (Minute 5): Encryption and workflow interruption affect active filing and transaction preparation.
- Clue 2 (Minute 10): Forensics show targeted access to privilege-sensitive repositories.
- Clue 4 (Minute 20): Extortion messages reference specific matters to increase pressure.
Round 2: Reporting, Liability, and Deadline Confidence (30-35 min)
Investigation Clues:
- Clue 5 (Minute 30): Leadership receives escalating client demands for certainty on confidentiality exposure.
- Clue 7 (Minute 50): Insurance counsel requires defensible timeline and control narrative.
- Clue 8 (Minute 55): Litigation and transaction teams request go/no-go guidance for Monday obligations.
Round Transition Narrative
After Round 1 -> Round 2:
Facilitation questions:
- “What is your minimum evidence threshold before asserting matter integrity to clients and courts?”
- “Which decision must be made now versus deferred until additional forensic certainty exists?”
- “How do you communicate uncertainty without undermining legal credibility?”
Debrief Focus:
- Integrating privilege and professional obligations into incident command
- Balancing recovery speed with defensible legal and client communication
- Maintaining trust when evidence quality evolves over time
Full Game Materials (120-140 min, 3 rounds)
Round 1: Executive Briefing and Scope Discovery (35-40 min)
Players investigate openly using role capabilities. Early findings include targeted exfiltration, workflow encryption, and active deadline impact.
If team stalls: “You can protect speed or confidence first. Which path is defensible to clients and regulators by end of day?”
Round 2: Regulator Coordination and Deadline Decisions (35-40 min)
- Technical teams complete artifact collection and present recovery paths with explicit uncertainty bounds.
- Leadership requests a clear recommendation for Monday obligations and client communication sequencing.
Facilitation questions:
- “What controls must be in place before proceeding with high-risk legal actions?”
- “How will you document rationale so decisions remain defensible in later review?”
Round 3: Institutional Recovery and Control Redesign (40-45 min)
Opening: Two weeks later, immediate containment is complete and firm leadership requests a 90-day remediation roadmap with legal and technical accountability.
Pressure events:
- Key clients request evidence of meaningful control improvements
- Internal governance demands owner-assigned milestones and measurable risk reduction
- Practice groups request controls that preserve billing-critical workflow speed
Victory conditions for full 3-round arc:
- Verified clean baseline for legal-document and communication systems
- Defensible regulatory and client reporting package
- Durable legal-sector security controls that preserve privilege and operational continuity
Debrief Questions
- “Which early indicator most clearly signaled targeted legal leverage versus generic ransomware behavior?”
- “How did deadline pressure alter risk tolerance across legal and technical teams?”
- “What evidence was essential for credibility with clients and authorities?”
- “How can law firms improve sector-wide readiness without exposing sensitive matter practices?”
Debrief Focus
- Legal-sector extortion incidents are driven by privilege and deadline leverage
- Defensible response requires synchronized legal, operational, and technical decision-making
- Long-term resilience depends on tested recovery, controlled access, and transparent governance
Advanced Challenge Materials (150-170 min)
Red Herrings and Misdirection
- Routine document-workflow maintenance overlaps with suspicious timeline artifacts.
- A recent lateral-hire access review appears related but is operationally separate.
- An unrelated email-routing outage mimics attacker-induced communication disruption.
Removed Resources and Constraints
- No prebuilt playbook for privilege-sensitive ransomware response
- Limited immutable-backup coverage on selected matter systems
- Delayed external advisory support during the first decision window
Enhanced Pressure
- Leadership demands same-day confidence statement for Monday obligations
- Clients request immediate detailed disclosures before forensic scope is complete
- Practice teams request recovery exceptions to preserve filing timelines
Ethical Dilemmas
- Preserve deeper evidence and accept short-term case disruption, or recover faster and reduce attribution depth.
- Delay filings for stronger confidence, or proceed with explicit residual risk under client pressure.
- Share broad indicators for sector defense, or limit detail to protect sensitive legal workflows.
Advanced Debrief Topics
- Building legal-sector doctrine for surveillance-plus-extortion incidents
- Structuring governance when legal and technical confidence diverge
- Improving cross-firm readiness while preserving confidentiality obligations