WireLurker Scenario: Design Agency
WireLurker Scenario: Design Agency
Planning Resources
Scenario Details for IMs
Hook
Initial Symptoms to Present:
Key Discovery Paths:
Detective Investigation Leads:
Protector System Analysis:
Tracker Network Investigation:
Communicator Stakeholder Interviews:
Mid-Scenario Pressure Points:
- Hour 1: Leadership receives credible reports of leaked concept imagery online
- Hour 2: Production teams request security exceptions to keep final exports moving
- Hour 3: Client stakeholders request assurance that launch assets remain uncompromised
- Hour 4: Executive leadership requires a formal go/no-go launch recommendation
Evolution Triggers:
- If exfiltration containment is delayed, additional unreleased assets leak beyond recall control
- If mobile-device isolation is partial, persistence channels remain active despite workstation cleanup
- If asset integrity validation is rushed, compromised outputs enter final launch packages
Resolution Pathways:
Technical Success Indicators:
- Team blocks exfiltration channels and contains workstation-to-mobile spread
- Asset integrity checks identify trusted baselines for release-critical files
- Hardening controls enforce signed software trust and controlled device connectivity
Business Success Indicators:
- Launch decisions are based on verified asset integrity, not assumptions under pressure
- Client communication remains transparent, timely, and technically accurate
- Production continuity is preserved without accepting uncontrolled exfiltration risk
Learning Success Indicators:
- Team explains why macOS creative environments remain high-value malware targets
- Participants demonstrate balanced decision-making across security, delivery, and client trust
- Group operationalizes practical controls for third-party tool governance and device policy
Common IM Facilitation Challenges:
If Asset Integrity Is Assumed Too Early:
“You have partial restoration, but can you prove final assets are trustworthy before release? What evidence is still missing?”
If Creative Deadline Pressure Overrides Containment:
“Production wants exceptions now. Which exceptions are acceptable, and which would reopen the exact attack path you are trying to close?”
If Client Communication Is Delayed:
“Client leadership is asking direct questions. What can you communicate now with confidence, and what must remain explicitly provisional?”
Success Metrics for Session:
Template Compatibility
This scenario adapts to multiple session formats with appropriate scope and timing:
Quick Demo (35-40 minutes)
Structure: 2 investigation rounds, 1 decision round
Focus: Immediate exfiltration containment and launch integrity triage
Simplified Elements: Guided clues and constrained response choices
Key Actions: Stop outbound transfer, isolate risky workflows, validate release-critical assets
Lunch & Learn (75-90 minutes)
Structure: 4 investigation rounds, 2 decision rounds
Focus: Creative delivery continuity under active spyware pressure
Added Depth: Third-party tool governance and mobile workflow containment
Key Actions: Sequence secure restoration, maintain client confidence, preserve production capacity
Full Game (120-140 minutes)
Structure: 6 investigation rounds, 3 decision rounds
Focus: End-to-end creative-industry incident command with launch risk management
Full Complexity: Technical containment, integrity assurance, and high-stakes client communications
Key Actions: Integrate security response and delivery leadership into a defensible release decision
Quick Demo Materials (35-40 min)
Guided Investigation Clues
- Clue 1 (Minute 5): “Outbound transfer telemetry maps to unreleased campaign file paths in active production directories.”
- Clue 2 (Minute 10): “Workstation analysis identifies trojanized creative tools with persistence hooks.”
- Clue 3 (Minute 15): “Connected mobile-device workflows now represent an active secondary spread path.”
Pre-Defined Response Options
Option A: Hard Containment and Release Freeze
- Action: Isolate affected workstations and storage segments, suspend non-essential sync channels, and hold release packaging pending integrity verification.
- Pros: Maximizes certainty and stops further leakage quickly.
- Cons: Creates immediate production slowdown and leadership pressure.
- Type Effectiveness: Strong against active spyware exfiltration campaigns.
Option B: Phased Production Continuity with Tight Controls
- Action: Keep limited production online in clean zones while remediating infected systems and tightening device trust controls.
- Pros: Preserves some delivery velocity while risk is reduced.
- Cons: Requires high execution discipline and constant validation to avoid recontamination.
- Type Effectiveness: Moderate when segmentation and monitoring remain strict.
Option C: Client-Facing Delivery Priority First
- Action: Keep delivery timelines primary, apply selective remediation, and postpone broad lock-down until after milestone submission.
- Pros: Protects short-term schedule commitments.
- Cons: Highest risk of continued exfiltration and compromised release quality.
- Type Effectiveness: Weak against persistent exfiltration behavior.
Lunch & Learn Materials (75-90 min, 2 rounds)
Round 1: Containment and Asset Trust Establishment (30-35 min)
Investigation clues:
- “Primary compromise activity aligns with third-party utility installation and weak trust validation.”
- “Asset repositories show mixed integrity states across current release candidates.”
- “Mobile-connected workflows increase persistence and data movement risk.”
- “Leadership requires a recovery sequence that protects both launch viability and evidence quality.”
Facilitation questions:
- “Which assets are truly release-critical, and how will you validate them under time pressure?”
- “What trust controls must be mandatory before any workstation rejoins production?”
- “How do you split communication responsibilities between technical and client-facing leads?”
Round 1→2 Transition
Containment progress slows data loss, but launch viability now depends on integrity proof, not just restored access.
Round 2: Release Decision Under Uncertainty (30-35 min)
Developments:
- “Recovery options exist, but confidence in final asset integrity varies by workflow path.”
- “Client pressure increases for milestone confirmation and release timing assurance.”
- “Leadership must choose between earlier release with residual uncertainty or delayed release with stronger validation.”
Facilitation questions:
- “What minimum evidence threshold makes release defensible to both leadership and client stakeholders?”
- “If delay is necessary, how do you communicate impact without undermining trust?”
- “Which controls become permanent policy after this incident, and why?”
Full Game Materials (120-140 min, 3 rounds)
Round 1: Initial Compromise and Exfiltration Control (30 min)
Creative operations enter crisis mode as malware behavior collides with launch-critical production timelines. The team must establish immediate containment while preserving evidence and essential delivery capability.
Round 2: Workflow Recovery and Client Risk Management (35 min)
The team restores partial production capacity but faces unresolved integrity uncertainty and rising client demands for launch certainty.
Round 3: Strategic Hardening and Release Governance (35 min)
Immediate risk declines, and leadership shifts toward durable controls for tooling trust, mobile workflows, and incident-informed release governance.
Debrief Focus (Full Game)
- Why creative production ecosystems remain high-value targets despite platform assumptions
- How delivery pressure can either sharpen or degrade incident decision quality
- What constitutes defensible integrity evidence for high-visibility campaign launches
- Which governance upgrades most effectively reduce repeat risk in design-agency environments
Advanced Challenge Materials (150-170 min, 3+ rounds)
Red Herrings and Misdirection
- Legitimate high-volume render exports that resemble malicious outbound transfer spikes
- Scheduled synchronization tasks that create misleading lateral-movement signals
- Parallel productivity outages that distract teams from highest-risk exfiltration paths
Removed Resources and Constraints
- No immediate access to external specialist incident responders
- Incomplete asset inventory metadata for legacy campaign archives
- Limited endpoint visibility on personally connected mobile devices
Enhanced Pressure
- Public leak chatter accelerates while technical certainty remains incomplete
- Internal teams demand production exceptions that may reintroduce attack paths
- Client-side legal review begins before final root-cause confidence is established
Ethical Dilemmas
- Whether to disclose partial breach scope early or wait for stronger forensic confidence
- Whether to enforce strict device controls that disrupt urgent creative workflows
- Whether to delay a high-profile launch to protect integrity when commercial pressure is extreme
Advanced Debrief Topics
- Incident ethics in client IP-heavy creative industries
- Governance tradeoffs between speed, transparency, and defensible assurance
- Practical hardening patterns for macOS and mobile-first production teams