LockBit Scenario: Global Logistics Crisis
Scenario Details for IMs
Opening Presentation
“It’s Monday morning during peak holiday shipping season, and AtlasCorp Logistics is managing maximum container capacity across 45 international ports when every operational system displays ransom demands. Container tracking is down, port operations have halted, and 12,000 containers are stranded in transit. Executives receive direct contact from threat actors claiming to have stolen shipping manifests, customer data, and sensitive supply chain intelligence, threatening to disrupt global trade operations.”
Initial Symptoms to Present:
- “All port operational systems displaying ransom demands with supply chain specific threats”
- “Container tracking systems completely encrypted affecting 12,000 containers in transit”
- “Threat actors contacted executives claiming to have stolen shipping manifests and customer data”
- “International ports unable to process incoming or outgoing cargo”
Key Discovery Paths:
Detective Investigation Leads:
- Digital forensics reveal systematic targeting of supply chain data and operational intelligence
- Analysis shows initial compromise through supply chain partner email system
- Timeline indicates attackers maintained access across multiple international systems for weeks
Protector System Analysis:
- Complete encryption of port operations affecting global cargo processing
- Backup assessment reveals complex international recovery requirements
- Network analysis shows lateral movement across multiple countries and regulatory jurisdictions
Tracker Network Investigation:
- Data exfiltration analysis reveals theft of sensitive shipping manifests and customer trade data
- Communication analysis shows professional operation with supply chain industry knowledge
- Evidence of reconnaissance targeting specific high-value cargo and trade routes
Communicator Stakeholder Interviews:
- Customer communications regarding delayed cargo and potential data exposure
- International coordination with customs authorities and port management agencies
- Supply chain partner notifications about potential compromise and operational impact
Mid-Scenario Pressure Points:
- Hour 1: Major retailer threatens contract cancellation due to delayed holiday merchandise
- Hour 2: Threat actors publish sample shipping manifests revealing competitive supply chain intelligence
- Hour 3: International customs authorities report concerns about cargo security and tracking
- Hour 4: Port workers unable to safely operate without digital tracking and safety systems
Evolution Triggers:
- If ransom payment is made, attackers may target other supply chain companies with stolen intelligence
- If payment is refused, customer shipping data begins appearing on criminal marketplaces
- If recovery exceeds 72 hours, physical port operations face safety and regulatory compliance issues
Resolution Pathways:
Technical Success Indicators:
- Emergency manual operations procedures activated maintaining basic cargo processing
- International coordination established for recovery across multiple jurisdictions
- Supply chain partner security assessment and isolation to prevent reinfection
Business Success Indicators:
- Customer relationships maintained through transparent communication and alternative shipping solutions
- International operations restored with proper security controls and regulatory compliance
- Supply chain integrity protected through coordinated industry response
Learning Success Indicators:
- Team understands supply chain cybersecurity interdependencies and global impact
- Participants recognize international coordination requirements during crisis
- Group demonstrates crisis management balancing operational continuity with security response
Common IM Facilitation Challenges:
If International Coordination Is Overlooked:
“Your recovery plan is solid, but you’re operating across 45 ports in 23 countries with different regulations and law enforcement agencies. How do you coordinate international incident response?”
If Supply Chain Impact Is Underestimated:
“While you’re investigating, major retailers are reporting that holiday merchandise won’t reach stores in time, and automotive manufacturers are facing production shutdowns. How does supply chain responsibility affect your response?”
If Physical Safety Is Ignored:
“Your digital recovery is progressing, but port workers are asking whether it’s safe to operate heavy machinery and handle containers without digital tracking systems. How do you balance operational pressure with safety requirements?”