Poison Ivy Scenario: Historical Remote Access Crisis (2011)

Planning Resources

Tip📋 Comprehensive Facilitation Guide Available

For detailed session preparation support, including game configuration templates, investigation timelines, response options matrix, and round-by-round facilitation guidance, see:

PoisonIvy Remote Access Planning Document

Planning documents provide 30-minute structured preparation for first-time IMs, or quick-reference support for experienced facilitators.

Note🎬 Interactive Scenario Slides

Ready-to-present RevealJS slides with player-safe mode, session tracking, and IM facilitation notes:

PoisonIvy Historical Scenario Slides

Press ‘P’ to toggle player-safe mode • Built-in session state tracking • Dark/light theme support

Scenario Details for IMs

Hook

“It’s September 2011 at Advanced Materials Technology Corporation, and your firm creates campaigns for sensitive clients including government agencies and defense contractors. Employees have been receiving emails with technical specification documents and engineering specifications that contain sophisticated remote access trojans. Unknown to your team, the Poison Ivy RAT is giving attackers complete system control, allowing them to steal proprietary technical data, monitor business communications, and access confidential weapons system designs and technical specifications worth millions in competitive proposals.”

Initial Symptoms to Present:

Warning🚨 Initial User Reports
  • “Employees report receiving detailed technical specification document documents with unexpected attachment behavior”
  • “IT notices unusual outbound network connections during off-hours”
  • “Competitor seemingly knows details of confidential engineering specifications before client presentation”
  • “Account manager discovers unauthorized access attempts to government proprietary technical data”

Key Discovery Paths:

Detective Investigation Leads:

  • Email forensics reveal sophisticated marketing document trojans with Poison Ivy RAT payloads
  • File analysis shows complete remote access capabilities hidden in legitimate technical specification document formats
  • Timeline analysis indicates long-term persistent access across multiple employee systems

Protector System Analysis:

  • Network monitoring reveals persistent command and control connections to unknown servers
  • Endpoint analysis shows remote access including file exfiltration, keylogging, and screen capture
  • Security assessment reveals attackers targeted agency specifically to access multiple client sectors

Tracker Network Investigation:

  • Traffic analysis shows systematic theft of client campaign data and competitive proposals
  • Command and control patterns indicate professional operation with defense industry knowledge
  • Connection analysis reveals targeting of government, financial, and government proprietary technical data

Communicator Stakeholder Interviews:

  • Client communications regarding potential exposure of confidential campaign strategies
  • Regulatory assessment of ITAR, Defense Counterintelligence and Security Agency (DCSA) requirements, and government security clearance compliance requirements
  • Legal counsel evaluation of professional liability and client notification obligations

Mid-Scenario Pressure Points:

  • Hour 1: Healthcare client questions how competitor learned details of confidential medical campaign
  • Hour 2: IT discovers evidence of persistent RAT access across creative and account management teams
  • Hour 3: Legal warns that government proprietary technical data exposure may trigger ITAR breach notifications
  • Hour 4: Competitor submits proposal with suspiciously similar strategy to agency’s confidential approach

Evolution Triggers:

  • If response is delayed, attackers may exfiltrate complete proprietary technical database affecting multiple sectors
  • If containment fails, confidential proposals may appear in competitor presentations
  • If client notification is inadequate, professional relationships face irreparable damage across sectors

Resolution Pathways:

Technical Success Indicators:

  • Complete Poison Ivy RAT removal from all infected employee and server systems
  • Network security enhanced to detect sophisticated marketing document trojans
  • Client data access monitoring implemented preventing unauthorized exfiltration

Business Success Indicators:

  • Multi-client relationships maintained through transparent security incident communication
  • Classified technical proposals protected through enhanced confidentiality and secure collaboration
  • Professional reputation preserved preventing client defection to competitors

Learning Success Indicators:

  • Team understands third-party risk amplification through service provider compromise
  • Participants recognize regulatory complexity affecting multi-sector proprietary technical data
  • Group demonstrates incident response balancing multiple client interests simultaneously

Common IM Facilitation Challenges:

If Multi-Client Impact Is Underestimated:

“Your RAT removal is progressing, but forensics shows attackers accessed government, financial, and government proprietary technical data through your agency. How does multi-sector compromise change your notification strategy and regulatory obligations?”

If Regulatory Complexity Is Ignored:

“While investigating, Marcus Williams reports that government proprietary technical data was accessed, potentially triggering ITAR breach notification requirements. How do you balance technical response with complex regulatory compliance across multiple sectors?”

If Competitive Intelligence Theft Is Missed:

“Your technical cleanup is solid, but Elena Rodriguez discovered a competitor submitted a proposal with your exact strategy. How do you address intellectual property theft while managing client trust?”

Success Metrics for Session:

Template Compatibility

Quick Demo (35-40 min)

  • Rounds: 1
  • Actions per Player: 1
  • Investigation: Guided
  • Response: Pre-defined
  • Focus: Use the “Hook” and “Initial Symptoms” to quickly establish 2011 marketing agency crisis. Present the “Guided Investigation Clues” at 5-minute intervals. Offer the “Pre-Defined Response Options” for the team to choose from. Quick debrief should focus on recognizing third-party risk and multi-client impact.

Lunch & Learn (75-90 min)

  • Rounds: 2
  • Actions per Player: 2
  • Investigation: Guided
  • Response: Pre-defined
  • Focus: This template allows for deeper exploration of service provider security challenges. Use the full set of NPCs to create realistic multi-client pressure and regulatory complexity. The two rounds allow discovery of cross-proprietary technical data exposure, raising stakes. Debrief can explore balance between competing client interests, plus modernization discussion.

Full Game (120-140 min)

  • Rounds: 3
  • Actions per Player: 2
  • Investigation: Open
  • Response: Creative
  • Focus: Players have freedom to investigate using the “Key Discovery Paths” as IM guidance. They must develop response strategies balancing government, financial, and government proprietary technical data protection, competitive intelligence theft, and professional reputation. The three rounds allow for full narrative arc including multi-sector impact assessment. Include modernization discussion exploring contemporary supply chain risks.

Advanced Challenge (150-170 min)

  • Rounds: 3
  • Actions per Player: 2
  • Investigation: Open
  • Response: Creative
  • Complexity: Add red herrings (e.g., legitimate marketing collaboration causing false positives). Make containment ambiguous, requiring players to justify conflicting client notification decisions. Remove access to reference materials to test knowledge recall of RAT behavior and third-party risk principles. Include deep modernization discussion comparing 2011 service provider risks to contemporary supply chain threats.

Quick Demo Materials (35-40 min)

Guided Investigation Clues

Clue 1 (Minute 5): “Email forensics reveal Poison Ivy RAT hidden in marketing technical specification document attachments sent to Advanced Materials Technology Corporation employees. The sophisticated trojan uses authentic engineering specifications formats that perfectly match legitimate business documents. Network analysis shows complete remote access capabilities including file exfiltration, keylogging, and screen capture affecting employee systems handling government, financial, and government proprietary technical data.”

Clue 2 (Minute 10): “Endpoint analysis reveals persistent command and control connections indicating long-term access across creative and account management teams. Timeline shows attackers have monitored client campaigns, competitive proposals, and business strategies for months. Security assessment reveals agency was specifically targeted to access multiple sensitive client sectors through single service provider compromise.”

Clue 3 (Minute 15): “Traffic analysis shows systematic exfiltration of government campaign data (ITAR implications), financial client proposals, and government contractor strategies. Competitor submitted proposal with suspiciously similar approach to agency’s confidential strategy. Legal counsel warns government proprietary technical data exposure may trigger regulatory breach notifications and professional liability across multiple sectors.”

Pre-Defined Response Options

Option A: Complete RAT Removal & Multi-Client Notification

  • Action: Remove all Poison Ivy infections, implement enhanced email security and proprietary technical data protection, immediately notify all affected clients across government, financial, and government sectors, coordinate with regulatory authorities about compliance requirements.
  • Pros: Completely eliminates persistent access; demonstrates transparent professional practices; maintains multi-client trust through early notification.
  • Cons: Multi-sector notifications may damage professional reputation and competitive position; regulatory compliance requires significant legal resources.
  • Type Effectiveness: Super effective against APT malmon type; complete removal prevents further multi-proprietary technical data exfiltration.

Option B: Selective Remediation & Sector-Specific Response

  • Action: Remediate confirmed infected systems, implement sector-specific security controls, notify only clients with confirmed data exposure, conduct forensic investigation before broader multi-client communication.
  • Pros: Allows targeted response matching each sector’s regulatory requirements; minimizes immediate professional relationship damage; enables focused client protection.
  • Cons: Risks continued data exfiltration during investigation; delayed notifications may violate sector-specific regulations (ITAR, etc.).
  • Type Effectiveness: Moderately effective against APT threats; reduces but doesn’t eliminate persistent access across client sectors.

Option C: Phased Client Communication & Business Continuity

  • Action: Implement emergency secure client collaboration channels, phase remediation by client sensitivity, notify clients after establishing alternative secure procedures minimizing operational disruption.
  • Pros: Maintains critical client relationships through continued service; protects professional reputation through controlled communication timing; enables sector-specific response approaches.
  • Cons: Phased approach extends remediation timeline; attackers may maintain partial access during transition; delayed notification may violate regulatory requirements.
  • Type Effectiveness: Partially effective against APT malmon type; prioritizes business continuity over complete security remediation.

Historical Context & Modernization Prompts

Understanding 2011 Technology Context

This scenario represents actual Poison Ivy RAT attacks from 2011. Key historical elements to understand:

  • Email Attachments: Primary malware delivery vector with limited scanning and sandboxing capabilities
  • RAT Technology: Remote administration tools were sophisticated but detection was signature-based
  • Regulatory Environment: ITAR and financial regulations existed but cybersecurity requirements were minimal
  • Business Networks: Simple network architectures with limited segmentation or access controls
  • Incident Response: Most small businesses had no formal cybersecurity or incident response capabilities

Collaborative Modernization Questions for Players

Present these questions after initial investigation to guide modernization:

  1. “How would attackers target defense contractors in today’s digital landscape?”
    • Guide toward: Cloud collaboration platforms, social media intelligence, supply chain attacks
  2. “What modern techniques provide similar remote access capabilities to 2011 RATs?”
    • Guide toward: Cloud-based remote tools, legitimate software abuse, fileless attacks
  3. “How has regulatory compliance changed since 2011 for businesses handling sensitive data?”
    • Guide toward: NIST Cybersecurity Framework, state privacy laws, breach notification requirements, cybersecurity frameworks
  4. “What would proprietary technical data storage and sharing look like in modern defense contractors?”
    • Guide toward: Cloud storage, collaboration platforms, mobile access, API integrations
  5. “How would modern threat detection identify persistent remote access?”
    • Guide toward: Endpoint detection, behavioral analysis, cloud security monitoring, threat hunting

Modernization Discovery Process

After historical investigation, facilitate modernization discussion:

  1. Industry Evolution: Explore how marketing has moved to digital platforms and cloud services
  2. Regulatory Changes: Discuss how privacy laws have created new compliance requirements
  3. Attack Sophistication: Compare basic RAT techniques to modern supply chain and cloud attacks
  4. Client Risk Amplification: Consider how interconnected business relationships create cascading risk
  5. Detection Advancement: Examine how behavioral analysis improves on signature-based detection

Learning Objectives

  • Third-Party Risk: Understanding how service providers create attack vectors to multiple targets
  • Regulatory Implications: Learning how data breaches trigger complex compliance requirements
  • Persistent Access: Recognizing techniques for maintaining long-term system access
  • Business Process Targeting: Appreciating how attackers exploit industry-specific workflows

IM Facilitation Notes

  • Multi-Client Impact: Emphasize how single compromise affects multiple organizations
  • Regulatory Complexity: Help players understand compliance implications without legal expertise
  • Business Relationship Focus: Highlight how attacks target trust relationships between organizations
  • Evolution Discussion: Guide conversation toward modern supply chain and third-party risks
  • Detection Challenges: Discuss why legitimate-looking remote access can evade detection

This historical foundation demonstrates how targeted attacks on service providers can amplify impact across multiple client organizations, while helping teams understand the evolution from basic remote access to complex supply chain threats. ## Full Game Materials (120-140 min, 3 rounds)

NoteHow Full Game Differs from Lunch & Learn

The Full Game expands the scenario from 2 guided rounds to 3 open-ended rounds. Players drive their own investigation using the Key Discovery Paths above rather than receiving timed clues. Round 3 shifts from immediate crisis response to long-term strategic recovery, and includes a modernization exercise connecting 2011 RAT lessons to contemporary threats. Rounds run 30-35 minutes each. Use the Resolution Pathways section to guide your assessment of team progress.

Round 1: Initial RAT Discovery – September 2011 (30 min)

September 2011 at Advanced Materials Technology Corporation. IT Coordinator Sarah Chen discovers a computer performing actions without user input – mouse movements, files opening, and programs launching while the workstation is supposedly idle. Creative Director Robert Harrison reports that confidential campaign strategies seem to be leaking to a competitor agency. The 75-employee firm handles sensitive clients in defense, aerospace, and advanced materials sectors. This isn’t a virus – it’s something that gives an attacker complete remote control of agency computers.

Open investigation guidance: All four Key Discovery Paths are available. Teams typically uncover the Poison Ivy RAT hidden inside legitimate-looking marketing documents (technical specification documents, engineering specifications), the trojan’s complete remote access capabilities (screen capture, keylogging, file access, webcam/microphone), and the scope of multi-proprietary technical data exposure across government, financial, and government sector campaigns.

If the team stalls: “Sarah Chen examines the infected workstation and finds something alarming: ‘This isn’t a normal virus – someone is actually controlling this computer remotely. They can see everything on screen, capture keystrokes, download any file. And the software that does it was hidden inside a marketing brief we received three weeks ago.’”

Facilitation questions:

  • “This is 2011 – RATs are relatively new as a widespread threat. How do you explain remote access surveillance to non-technical marketing staff?”
  • “The agency handles clients in government (ITAR), finance (Defense Counterintelligence and Security Agency (DCSA) requirements), and government (security clearance) – how does multi-sector exposure complicate your response?”
  • “The RAT was hidden in a legitimate-looking marketing document – how do you determine which other documents in the agency might also be trojaned?”

Round 1→2 Transition

The investigation reveals that the Poison Ivy RAT has been active for three weeks across multiple workstations. Account Manager Marcus Williams discovers that government client campaign data – potentially including protected health information – was accessible during the surveillance period. Business Development Director Elena Rodriguez confirms that recent competitive proposal losses align with when the attacker gained access to bidding strategies.

Round 2: Multi-Client Data Exposure & Regulatory Cascade (35 min)

If teams chose immediate client notification: Healthcare clients invoking ITAR incident procedures. Financial clients requiring Defense Counterintelligence and Security Agency (DCSA) requirements compliance documentation. Government clients demanding security clearance review. Each sector has different notification requirements creating coordination complexity.

If teams delayed notification for investigation: Forensic analysis reveals systematic targeting: government campaign data (patient demographics, treatment marketing), financial client strategies (market positioning, competitive intelligence), and government contractor information (project details, personnel data). Each category triggers different regulatory obligations now compounding due to delayed discovery.

New developments beyond Round 1: The RAT specifically targets defense contractors because they’re a single point of access to multiple high-value sectors. The attacker accessed: government client PHI through campaign targeting data, financial client competitive strategies, government contractor project details, and the agency’s own competitive proposals. A competitor agency has won three pitches in a row against your firm – using strategies that closely mirror your internal approaches.

Facilitation questions:

  • “Marketing agencies handle sensitive data from multiple sectors but often lack the security infrastructure of their clients – how does this ‘weakest link’ vulnerability work?”
  • “You have three different regulatory frameworks (ITAR, Defense Counterintelligence and Security Agency (DCSA) requirements, government security) with three different notification timelines – how do you prioritize?”
  • “Is the competitor agency behind this, or is someone else using your competitive intelligence? How do you investigate without tipping off the attacker?”

Round 2→3 Transition

The RAT is removed and systems secured. But the agency’s position as a trusted handler of multi-sector sensitive data is compromised. Focus shifts to: can a 75-person marketing agency survive when clients in defense, aerospace, and advanced materials all question your security practices?

Round 3: Agency Survival & Modernization Discussion (35 min)

Four weeks post-incident. The RAT is gone but the business impact is real – one government client has terminated the contract citing ITAR concerns, a government client has assigned the agency’s clearance pending review, and the financial client is conducting its own security audit of your systems.

Part 1 – Aftermath and recovery (15 min):

  • Client retention assessment – Robert Harrison evaluates: which client relationships are salvageable, what security commitments each sector requires, and whether a 75-person agency can afford the security infrastructure clients now demand
  • Regulatory compliance – ITAR, Defense Counterintelligence and Security Agency (DCSA) requirements, and government clearance reviews each proceeding on different timelines with different requirements
  • Competitive damage – Three weeks of stolen proposals and strategies means the competitor has lasting intelligence advantage
  • Agency security investment – What security controls can a 75-person marketing firm realistically implement and maintain?

Part 2 – Modernization discussion (20 min):

  • “How would this attack work against a modern marketing agency using cloud-based collaboration tools?” → SaaS compromise, OAuth token theft, cloud storage access
  • “What’s the modern equivalent of a RAT hidden in a marketing document?” → Malicious links in collaboration platforms, compromised SaaS integrations, supply chain attacks through marketing technology vendors
  • “How has the defense industry’s security posture changed since 2011?” → Cloud adoption, remote work, data privacy regulations (NIST Cybersecurity Framework, defense contractor supply chain security), vendor risk management
  • “Why are marketing and creative agencies still attractive targets today?” → Multi-client access, sensitive campaign data, creative industry supply chains

Facilitation questions:

  • “What surprised you about the scope of data a marketing agency handles across multiple sensitive sectors?”
  • “How does the 2011 Poison Ivy RAT compare to modern remote access tools used in corporate espionage?”
  • “What fundamental lessons about third-party risk from 2011 still apply to today’s interconnected business environment?”

Victory Conditions

  • RAT eliminated with security improvements appropriate for a small agency’s resources
  • Multi-sector client relationships assessed with regulatory compliance addressed
  • Competitive damage from stolen proposals and strategies acknowledged and mitigated
  • Meaningful modernization discussion connecting 2011 RAT threats to contemporary supply chain risks

Debrief Focus (Full Game)

  • How marketing and creative agencies serve as single points of access to multiple high-value sectors – the “weakest link” problem
  • Why 2011-era RATs like Poison Ivy represented a shift from destructive malware to surveillance-focused tools designed for intelligence gathering
  • The compounding challenge of multi-sector regulatory compliance (ITAR, Defense Counterintelligence and Security Agency (DCSA) requirements, government clearance) when a single agency breach affects all
  • How the 2011 threat landscape (RATs in email attachments) evolved into modern supply chain and SaaS-based threats
  • Why small service firms handling sensitive proprietary technical data face existential risk from security breaches they can’t afford to prevent

Advanced Challenge Materials (150-170 min, 3+ rounds)

Red Herrings & Misdirection

  • Legitimate remote access by IT vendor – the agency’s outsourced IT support uses remote desktop tools that create activity patterns similar to the Poison Ivy RAT
  • Marketing automation false positives – email marketing platform generates automated file access and data synchronization that mimics attacker data exfiltration
  • Competitor intelligence coincidence – competitor agency’s winning streak may reflect their own legitimate market research rather than stolen intelligence
  • Employee device confusion – personal devices connected to the office network generate unusual traffic patterns unrelated to the RAT infection

Removed Resources & Constraints

  • No dedicated IT security – Sarah Chen is IT Coordinator handling both general IT support and security response for a 75-person agency with no security budget
  • Client communication barriers – government client’s ITAR security officer imposes strict communication protocols, preventing informal breach discussion
  • 2011 forensic limitations – no SIEM, limited endpoint detection capabilities, manual analysis required for each potentially infected workstation
  • Financial constraints – agency’s margins don’t support external forensic engagement; response depends entirely on internal capabilities

Enhanced Pressure

  • Healthcare client ITAR audit – government client triggers formal ITAR security assessment of the agency, threatening contract and creating compliance documentation burden
  • Government clearance review – government client suspends agency clearance pending security investigation, immediately blocking all classified project work
  • Competitor escalation – competitor continues winning pitches using seemingly stolen intelligence, compounding revenue loss during investigation
  • Staff anxiety – employees learning that their workstations were remotely monitored experience privacy violations and productivity drops from security concerns

Ethical Dilemmas

  • Competitor accusation without proof – competitive intelligence strongly suggests the competitor is using your stolen data, but you can’t prove it; do you raise accusations that could damage your reputation if wrong?
  • Multi-client notification priority – government (ITAR, patient safety), finance (Defense Counterintelligence and Security Agency (DCSA) requirements, market integrity), and government (national security) all have compelling urgency claims; who do you notify first when you can’t notify all simultaneously?
  • Agency survival versus full disclosure – complete transparency about the breach scope to all clients likely means contract terminations that close the agency; 120 employees lose jobs. Controlled disclosure preserves some relationships but isn’t fully transparent
  • Security investment trade-off – the security infrastructure clients now demand costs more than the agency can afford; do you overpromise on security to retain clients, or honestly acknowledge your limitations?

Advanced Debrief Topics

  • How service firms (defense contractors, law firms, consulting companies) create systemic risk by aggregating sensitive data from multiple sectors without sector-appropriate security
  • The ethics of survival-oriented breach disclosure when full transparency likely destroys the organization and the jobs of innocent employees
  • Why small and medium businesses face a “security affordability gap” – they handle sensitive data but can’t afford enterprise security controls
  • How the 2011 Poison Ivy RAT era established the corporate espionage model that modern APT campaigns still follow
  • The evolution from 2011 email attachment delivery to modern SaaS-based attack vectors – what changed and what stayed the same

Handouts for Players