Round 1: Discovery
Opening Narration:
“It’s Friday afternoon at MedTech Solutions. The implementation team has been working nonstop for weeks, and the Riverside General Hospital EMR go-live is just 72 hours away. The energy should be celebratory—this $2M contract represents the biggest success in company history. But instead, there’s tension in the air.
Sarah Chen, the IT Director, has just called an emergency meeting. Multiple team members are reporting computer issues: slowdowns, unexpected pop-ups, applications taking longer to start. Yesterday evening, during the final implementation push, several IT staff received what appeared to be critical security updates from trusted software vendors. Everyone was working late, clicking through warnings to maintain momentum toward Monday’s deadline.
Now Sarah needs answers. And as she explains the situation, her phone rings—it’s David Kim, the CIO of Riverside General Hospital, calling for his daily status update. She lets it go to voicemail. You can see the stress in her face as she says, ‘We need to figure out what’s going on without derailing Monday’s go-live. This contract is everything.’
What do you do?”
IM Questions to Ask:
- “What would be your first concern hearing these symptoms—computers slowing down after staff clicked security updates during a critical project deadline?”
- “How might you investigate what happened yesterday evening without alarming the client or disrupting the implementation timeline?”
- “What would make experienced IT staff click on security update emails during a high-pressure project? What does that tell you about the attack?”
- “Which of your roles would approach this investigation differently, and how do those perspectives complement each other?”
Expected Player Actions:
- Detective examining email logs: Reveal sophisticated spoofing, fake security vendor domains, attachment analysis showing executables masquerading as updates. Ask: “What patterns do you notice in the timing and targeting of these emails?”
- Protector analyzing running processes: Show process injection into legitimate Windows processes, memory-resident operation, network connections to suspicious IPs. Ask: “What does it mean when malware hides inside trusted system processes?”
- Tracker investigating network traffic: Display C2 communication patterns, recently registered domains, encrypted command channels. Ask: “How do these connection patterns help you understand attacker infrastructure?”
- Communicator interviewing staff: Sarah admits bypassing approval processes, reveals management pressure to prioritize speed over security. Ask: “What organizational factors made this attack successful beyond the technical vulnerabilities?”
- Crisis Manager assessing scope: 12 infected workstations, 48 hours to go-live, hospital test environment exposure. Ask: “What’s your priority: understanding everything perfectly or making decisions with incomplete information?”
Malmon Identification Moment:
Guide the team through evidence synthesis: “You’ve found process injection, memory-resident operation, sophisticated social engineering, and C2 infrastructure. The behavioral patterns—especially hiding within legitimate processes and using convincing fake software updates—point to a specific type of threat. What kind of Malmon combines stealth, social engineering mastery, and fileless techniques?”
When team identifies Trojan characteristics, introduce GaboonGrabber specifically: “Your threat intelligence matches this to GaboonGrabber, a Trojan-type Malmon known for Perfect Mimicry and Fileless Deployment. But there’s something in your research that’s concerning—GaboonGrabber has a hidden ability called Multi-Payload Deployment that activates after 24 hours. You’re approaching that threshold.”
Round Conclusion:
“As Round 1 ends, you’ve identified GaboonGrabber and understand the basic attack. But Sarah’s phone is ringing again—it’s David Kim calling for the third time today. In the background, you hear Jennifer Park, the COO, talking loudly about quarterly earnings and client retention. And your timeline analysis shows you’re 2 hours away from the 24-hour mark where GaboonGrabber typically deploys secondary payloads.
You understand what happened. Now you need to understand how bad this could get—and fast.”
Round 2: Investigation
Situation Update:
“It’s Friday evening, several hours into your investigation. The office is mostly empty except for your incident response team, Sarah Chen nervously checking her phone, and the sound of Jennifer Park on a conference call in the next room discussing ‘the IT situation.’
Your deeper investigation has revealed troubling details: Three of the infected workstations had active VPN connections to Riverside General’s test environment when the malware was installed. Your behavioral analysis confirms this is GaboonGrabber, and you’re now 90 minutes away from the 24-hour threshold.
Sarah just got off the phone with David Kim. His exact words: ‘I have the hospital board expecting a Monday go-live announcement. I have alternative vendors ready if MedTech can’t deliver. I need a yes or no by morning: Is Monday’s go-live happening or not?’
The question now is: How bad is this, and what are we going to do about it?”
IM Questions to Ask:
- “Now that you’ve confirmed hospital test environment exposure from infected machines, what are the realistic worst-case scenarios?”
- “GaboonGrabber’s Multi-Payload Deployment ability is about to activate. What kinds of secondary payloads would worry you most in this scenario?”
- “How do you balance the need for thorough investigation against the business pressure of a Monday deadline and a $2M contract at risk?”
- “What information do you need to make an informed recommendation about whether Monday’s go-live can safely proceed?”
Pressure Points to Introduce:
- Time pressure (Hour 1): Sarah reveals that IT department temporarily disabled certain security controls to “streamline” implementation. How does this change your assessment?
- Stakeholder pressure (Hour 2): Mike Rodriguez calls from the hospital: “Our nursing staff completed EMR training last week. They’re prepared for Monday. If we delay, we have to reschedule training for 200 nurses. How does that affect patient care continuity?”
- Business pressure (Hour 3): Jennifer Park demands explanation: “I have a quarterly earnings call next week. I need to announce this major contract success. Why are IT problems preventing us from meeting client commitments?”
- Technical complication (Hour 4): Your monitoring detects GaboonGrabber attempting to download secondary payloads—you’re seeing the beginning of Multi-Payload Deployment. The threat is evolving in real-time.
Round Conclusion:
“Your investigation has painted a clear picture—and it’s worse than you initially thought. GaboonGrabber has hospital network exposure, is preparing to deploy secondary payloads (your analysis shows signs of Snake Keylogger, AgentTesla, and possibly Redline staging), and you’ve discovered the infection is more widespread than initial reports suggested.
But you’ve also discovered something important: This happened because of organizational culture and deadline pressure, not just technical vulnerabilities. The IT team bypassed security controls, management prioritized speed over safety, and everyone was conditioned to click through warnings during implementation crunch time.
David Kim’s email just arrived. The hospital’s legal team is CC’d. The subject line: ‘Re: Contract Penalty Clauses for Delayed Implementation.’
It’s time to make decisions. What’s your response strategy?”
Round 3: Response
Critical Decision Point:
“It’s late Friday night. You’ve got all the information you’re going to get before decisions must be made. The technical picture is clear: GaboonGrabber is confirmed, secondary payload deployment is imminent, hospital network exposure is real, and thorough cleanup will take 36-48 hours minimum—well past Monday’s deadline.
The business picture is equally clear: $2M contract with penalty clauses, client relationship at breaking point, company reputation in healthcare market at stake, quarterly earnings announcement depending on this success.
Sarah Chen looks exhausted but determined: ‘Tell me what you need. I’ll support whatever decision protects our client and makes this right, even if it costs me my job.’
David Kim’s assistant just called to schedule a 7am Saturday morning call with hospital executives.
Jennifer Park sent a one-line email: ‘Decision needed within 1 hour: Are we go for Monday launch?’
What do you do?”
IM Questions to Ask:
- “Given this is a Trojan-type threat, what approaches give you the best chance of successful containment even if complete eradication takes time?”
- “How do you explain the security risks to David Kim and hospital executives in a way that demonstrates competence rather than failure?”
- “What’s your strategy for balancing speed with thoroughness? Can you design a response that addresses immediate threat while scheduling complete cleanup?”
- “How does your team coordinate between technical response, stakeholder communication, and business continuity? What needs to happen simultaneously?”
Success and Failure Branches:
If team chooses comprehensive cleanup (delay go-live):
“You make the difficult call: Thorough cleanup is necessary, Monday go-live must be delayed. Sarah supports your decision and personally calls David Kim to explain.
The conversation is tense. David’s initial reaction: ‘This is exactly what I was afraid of. I have vendors who could have this system live by Monday. Why should I wait for MedTech?’
But then Sarah does something important. She doesn’t make excuses. She explains exactly what happened, what the team discovered, why patient data protection requires thorough response, and how quickly MedTech identified and is containing a sophisticated threat that many organizations wouldn’t even detect.
David is silent for a long moment. Then: ‘Let me call you back.’
Thirty minutes later, he does. ‘I talked to our CISO. He said most vendors would have tried to hide this or rush through cleanup. He convinced the board that your transparency and security competence is exactly what we want in a healthcare technology partner. We’re delaying go-live to Wednesday. Get this done right.’”
If team chooses balanced approach (enhanced monitoring + phased remediation):
“You propose a hybrid strategy: Immediate containment of infected systems, enhanced behavioral monitoring to prevent secondary payload deployment, network microsegmentation to isolate hospital connectivity through monitored channels, and Monday go-live proceeds with increased security vigilance and post-implementation complete cleanup scheduled.
Sarah presents this to David Kim with transparent risk communication: ‘Here’s what we know, here’s the immediate threat we’re containing, here’s the long-term cleanup plan, here’s how we’re protecting patient data throughout.’
David asks hard questions. Mike Rodriguez asks about patient safety. Your team answers honestly, demonstrating both technical competence and business understanding.
The decision: Go-live proceeds Monday with security team on-site throughout, enhanced monitoring active, and contractual agreement for phase 2 cleanup the following week. The incident actually strengthens the relationship—Riverside General’s security team becomes partners in the response.”
If team chooses inadequate response (minimize incident, proceed normally):
“You decide to downplay the incident and proceed with Monday go-live without significant remediation. ‘We’ve removed the malware, everything’s fine,’ Sarah tells David Kim.
Monday morning, during go-live, your enhanced monitoring (which you did implement, at least) detects a catastrophic event: GaboonGrabber’s secondary payload deploys ransomware across the hospital’s test environment, which isn’t as isolated from production as anyone thought.
Patient care isn’t directly affected, but the incident makes regional news. HIPAA breach notifications are required. David Kim’s email is brief: ‘Contract terminated effective immediately. Legal team will be in touch regarding penalties and damages.’
The lesson is painful but clear: Security shortcuts during high-pressure projects don’t just create technical debt—they destroy business relationships and reputations.”
Resolution Narration (Adapt based on team approach):
“[Based on their response strategy, narrate the outcome, emphasizing how their decisions played out and what they learned about balancing security, business needs, and stakeholder management.]
As the incident winds down and you prepare for Monday—whether that’s go-live day or cleanup continuation—Sarah Chen pulls the team aside. ‘I learned something important,’ she says. ‘We created a culture where deadline pressure made clicking through security warnings normal. That culture made us vulnerable. This incident happened because of how we work, not just because of technical factors. We’re changing that.’
And David Kim sends one final email: ‘[Adapt message based on outcome - either praising transparency and competence, or expressing disappointment in the handling.]’
The Riverside General implementation will proceed—your decisions determined whether it happens as a partnership strengthened by security cooperation, or as a lesson learned through painful consequences.”