Noodle RAT Investment Bank Trading Floor - Planning Guide

Noodle RAT Investment Bank Trading Floor

Complete preparation guide for financial trading espionage scenario

Comprehensive facilitation guidance for Noodle RAT Investment Bank Trading Floor featuring memory-resident malware, high-frequency trading algorithm theft, market intelligence surveillance, and competitive financial espionage affecting $50B in managed assets.

1. Quick Reference

Element	Details
Malmon	Noodle RAT (Psychic/Flying dual-type)
Difficulty Tier	Tier 3 (Expert)
Scenario Variant	APT: Investment Bank Trading Floor
Organizational Context	Capital Markets International: 800 traders, $50B assets, high-frequency trading
Primary Stakes	Trading algorithms + Market intelligence + Client portfolios + Competitive advantage
Recommended Formats	Full Game / Advanced Challenge
Essential NPCs	Jennifer Wong (Trading Floor Director), Carlos Martinez (Cybersecurity Manager), Diana Foster (Senior Quant Analyst)
Optional NPCs	Michael Chen (SEC Compliance Officer), Market Manipulation Investigator, Competitive Trading Analyst

Scenario Hook

Capital Markets is executing high-frequency trading when traders notice workstation performance anomalies despite security finding no malicious files—fileless malware operates in memory, providing competitors invisible surveillance of proprietary trading algorithms and $50B market strategies.

Victory Condition

Team identifies memory-resident financial surveillance through behavioral analysis, protects proprietary trading algorithms from continued theft, ensures market integrity and SEC compliance, and addresses competitive espionage threatening trading advantage.

2-3. Configuration & Scenario Overview

Full Game (120-140 min): 3 rounds focusing on trading floor anomaly detection, algorithm protection, market manipulation prevention

Opening: “It’s Wednesday morning on Capital Markets International’s trading floor. Trading Floor Director Jennifer Wong oversees high-frequency algorithms managing $50B in assets. But quant analysts report workstations showing subtle performance issues during peak trading. Security scans find nothing. Yet Senior Quant Analyst Diana Foster insists: ‘Our proprietary algorithms are being surveilled—someone is stealing our trading strategies.’”

Initial Symptoms:

Trading workstations showing performance anomalies during high-frequency execution despite “clean” security scans
Proprietary algorithm files accessed at timestamps inconsistent with trader workflows
Network monitoring detecting data transfers during market hours traders don’t recall
Trading model files showing access patterns suggesting systematic competitive intelligence gathering
High-frequency trading performance degradation suggesting invisible surveillance overhead

Organizational Context:

Capital Markets International: Investment bank with proprietary high-frequency trading, algorithmic strategies
Key Assets: Trading algorithms, market intelligence, client portfolio strategies, quantitative models
Regulatory Environment: SEC compliance, FINRA oversight, market manipulation prevention
Cultural Factors: Competitive trading advantage culture, algorithmic secrecy, market timing pressure

4. NPC Reference

Essential NPCs

Jennifer Wong (Trading Floor Director)

Position: Managing high-frequency trading operations and algorithmic strategies
Personality: Results-driven, protective of proprietary algorithms, concerned about competitive theft
Agenda: Protect trading advantage while maintaining market execution during investigation
Knowledge: Trading strategies, algorithm value, competitive landscape
Pressure Point: $50B asset management depends on algorithm protection and competitive advantage
IM Portrayal: Emphasizes competitive stakes and market timing pressure

Carlos Martinez (Cybersecurity Manager)

Position: Financial institution cybersecurity, trading floor protection
Personality: Technical expert, concerned about fileless financial espionage
Agenda: Detect invisible surveillance while maintaining trading operations
Knowledge: Financial cybersecurity, regulatory requirements, detection challenges
Pressure Point: Professional responsibility for protecting trading intellectual property
IM Portrayal: Technical investigator facing sophisticated fileless threat

Diana Foster (Senior Quantitative Analyst)

Position: Developing and maintaining proprietary trading algorithms
Personality: Analytical, protective of her quantitative models, trusts her technical instincts
Agenda: Protect proprietary algorithms and trading strategies from competitive theft
Knowledge: Algorithm details, file access patterns, trading workflows
Pressure Point: Personal responsibility for algorithm intellectual property and competitive advantage
IM Portrayal: Quant detective who noticed surveillance through algorithm access patterns

5. Investigation Timeline

Round 1: Discovery

Automatic Reveals: Trading workstation performance anomalies; algorithm file access discrepancies

Investigation Leads:

Detective: Memory analysis reveals PowerShell code accessing trading algorithms and market intelligence systems
Protector: Proprietary trading models and high-frequency strategies compromised through memory surveillance
Tracker: Network traffic shows encrypted exfiltration of trading algorithms to competitor financial infrastructure
Communicator: Quant analysts describe financial industry recruitment emails containing sophisticated payloads
Crisis Manager: Market volatility Thursday; $50B trading operations at risk; SEC compliance notification concerns
Threat Hunter: Competitive financial espionage or nation-state market intelligence targeting

Rounds 2-3: [Investigation & Response - includes memory forensics, competitive attribution, SEC coordination, trading protection decisions]

6. Response Options

Most Effective:

Memory forensics with trading algorithm access analysis (DC 13)
PowerShell logging for fileless financial espionage detection (DC 14)
Behavioral monitoring for trading strategy protection (DC 15)

Moderately Effective:

Isolated trading environment rebuild (DC 12, market execution impact)
Network segmentation for algorithm intellectual property protection (DC 14)

Least Effective:

File-based detection on memory-only malware (DC 22)
Signature-based scanning for fileless operations (Automatic failure)

7-12. [Additional Sections - Structured Similarly]

Key Learning:

Fileless malware detection in high-frequency trading environments
Trading algorithm intellectual property protection under espionage
Financial market manipulation prevention and SEC compliance
Competitive intelligence threats to proprietary trading strategies
Memory forensics for financial institution protection

MITRE ATT&CK:

T1059.001 (PowerShell), T1055 (Process Injection), T1005 (Data from Local System - Trading Algorithms)

Notes for IM Customization

What worked well:

What to modify next time:

Creative player solutions:

Timing adjustments: