Public Systems Under Tournament Pressure
2025-12-04
You’re part of Level Up Gaming Cafe’s incident response team, racing to restore 80 compromised gaming stations before Saturday’s major esports tournament.
Investigate and contain a malware outbreak across public customer systems while protecting customer data, maintaining payment security, and saving the biggest tournament of the year.
New to facilitating Malware & Monsters? Start here:
IM Quick Start Guide - Everything you need to run this scenario in one concise document
Your gaming cafe is buzzing with pre-tournament excitement. Saturday’s esports tournament has 150 registered participants, sponsors arriving tomorrow, and streaming partners ready to broadcast to thousands of viewers.
Then your Systems Administrator bursts into the office:
“We have a serious problem. Customers are complaining about browser redirects and weird ads during gameplay. I just checked—gaming stations are full of fake software. ‘Graphics driver updates,’ ‘game performance boosters,’ ‘essential gaming utilities’—customers have been downloading this stuff all week.”
Tournament starts in 48 hours. Your reputation, your revenue, and your customers’ data are all at stake.
Saturday Esports Tournament:
Staff have identified suspicious programs customers downloaded:
Jessica (Customer Support Lead) reports: “Payment terminals are on the same network as gaming stations. If those systems are compromised, customer credit card data could be at risk.”
What They Care About: Tournament success, customer trust, business reputation, revenue protection
Current State: Panicking about Saturday tournament—sponsors arriving tomorrow, can’t afford cancellation
Helpful For: Business constraints, tournament requirements, customer relationships, financial priorities
Potential Barrier: May pressure for quick fixes over thorough remediation to save tournament
What They Care About: System integrity, complete malware removal, payment security
Current State: Investigating scope across 80 stations, realizing mass-scale remediation challenge
Helpful For: Technical investigation, system architecture, remediation strategies, gaming station management
Potential Barrier: Overwhelmed by scale—needs guidance on mass station restoration vs individual cleanup
What They Care About: Tournament operations, participant experience, streaming quality, sponsor satisfaction
Current State: Reporting increasing customer complaints, worried about tournament cancellation impacts
Helpful For: Tournament technical requirements, participant expectations, sponsor commitments, backup planning
Potential Barrier: May not understand security implications—focuses on “just make it work for Saturday”
What They Care About: Customer safety, payment security, data protection, service quality
Current State: Handling customer complaints, discovering payment network concerns, worried about data breach
Helpful For: Customer impact assessment, payment system architecture, notification strategies, trust rebuilding
Potential Barrier: May push for customer notification before team is ready with complete information
Hidden Agenda: Already spent tournament sponsorship money on equipment upgrades—cancellation would create financial crisis
Secret Fear: Losing business to competitor gaming cafes if tournament fails or customers lose trust
Character Arc:
Roleplay Notes: Start fixated on tournament timeline, gradually recognize that customer data protection is fundamental to business survival
Hidden Agenda: Recommended trusting customers with admin access to install gaming mods—now realizes this created vulnerability
Secret Doubt: Questioning whether gaming cafe security is even possible with public customer systems
Character Arc:
Roleplay Notes: Transform from defensive and overwhelmed to proactive problem-solver as team demonstrates focus on solution, not blame
Hidden Agenda: Prioritizing sponsor satisfaction over everything—they funded the prize pool and expect successful event
Secret Pressure: Sponsors hinted at future partnerships if tournament succeeds—massive opportunity for venue growth
Character Arc:
Roleplay Notes: Use him to explore business pressure vs security thoroughness—eventually realizes sponsors want association with trustworthy venue, not risky event
Hidden Agenda: Knows customers provided credit card information on potentially compromised systems—legally and ethically concerned about notification requirements
Secret Worry: Personal liability for customer data protection failures—worried she should have escalated payment security concerns earlier
Character Arc:
Roleplay Notes: Use her moral compass to keep team focused on customer protection—transforms from anxiety-driven notification push to thoughtful communication strategy
Monday-Wednesday (Tournament Week): Customers download fake gaming software from compromised gaming-focused websites and ads
Monday, Various Times: Initial FakeBat installations across multiple gaming stations via customer downloads
Tuesday-Wednesday: FakeBat establishes browser hijacking, begins secondary payload downloads
Wednesday Evening: Browser redirections and advertisements become noticeable to customers
Thursday, 12:00 PM: Customer complaints increase, Emma begins investigation
Thursday, 3:45 PM (Current): Emma confirms 80-station compromise scope
Initial Access:
Browser Hijacking:
Secondary Payload Activity:
Data at Risk:
Immediate Danger: 80 gaming stations actively compromised with browser hijacking and ad injection
Escalating Risk: Cryptocurrency miners deploying on gaming PCs, degrading performance before tournament
Critical Threat: Information stealer scheduled to activate Friday evening—would harvest customer payment data and game accounts overnight
Attack Objective: Browser hijacking for ad revenue, cryptocurrency mining for profit, credential theft for account sales
Malmon Identification:
Initial Containment Actions:
Key Discovery: Gaming performance optimization trust created customer-driven infection across public systems
Scope Assessment:
Stakeholder Management:
Critical Decision Point: Team must decide between mass reimaging vs individual cleanup, tournament cancellation vs risk acceptance, customer notification vs silent remediation
Remediation Actions Chosen:
Response Effectiveness:
Outcome Assessment:
Technical Learning:
Collaboration Insights:
Reflection Questions:
Mass Station Reimaging:
Gaming Software Verification System:
Customer Education Program:
Network Segmentation:
Station Isolation:
Payment System Protection:
Antimalware Deployment:
Individual Station Cleanup (-1):
Trusting Customer Actions (-2):
Postponing Remediation (-2):
If team is stuck:
If team rushes to conclusions:
Common mistakes to address:
What Team Knows:
Available Actions:
Fake Software Analysis (DC 10):
Station Scope Assessment (DC 12):
Network Architecture Review (DC 15):
The Gaming Culture Exploitation:
When team investigates how infections spread:
“Customers routinely download ‘performance enhancers,’ ‘FPS optimizers,’ and ‘graphics driver updates’ to improve gaming experience. The fake software looked legitimate—it even appeared to work at first by displaying performance metrics. Gamers trust these tools as part of competitive gaming culture.”
The Scale Realization:
When Emma reports full assessment:
“I’ve completed automated scanning—all 80 gaming stations are compromised. If we do individual cleanup at 2 hours per station, that’s 160 hours of work. We have 48 hours until tournament, and I’m one person. We need a mass solution.”
The Payment Network Risk:
When Jessica investigates payment security:
“Our payment terminals process customer credit cards on the same network as the gaming stations. There’s no segmentation. If attackers pivot from gaming PCs to payment systems, every customer who’s used a credit card here is at risk.”
The Malmon Identity:
When team pieces together attack pattern:
“This is FakeBat—a Downloader/Social malmon that exploits trust in gaming performance software to establish browser hijacking, then downloads secondary payloads. It’s specifically designed to target gaming environments and public computer systems.”
What Team Should Discover:
Stakeholder Reactions:
Transition to Round 2:
“You’ve identified FakeBat across all 80 gaming stations and understand the scale challenge. But as Emma digs deeper into the malware behavior, she discovers something alarming: FakeBat is staging secondary payloads. A cryptocurrency miner is already deploying—and an information stealer is scheduled to activate Friday evening, targeting customer payment data and game account credentials. Your 48-hour timeline just became more urgent.”
Secondary Payload Discovery:
Customer Data Exposure Risk:
Tournament Sponsor Pressure:
Alex reports: “Sponsors are arriving tomorrow to set up branded stations and streaming equipment. They’ve invested $5,000 in the prize pool and expect professional tournament operations. If we cancel, they’ll work with our competitors instead.”
Tony Kim (Cafe Manager):
“I already used the sponsorship money to upgrade our streaming equipment—we needed it to host professional tournaments. If we cancel, I can’t return funds I’ve spent, and we lose future sponsorship opportunities. Can we just clean enough stations for the tournament and fix the rest later?”
Present choice: Partial cleanup for tournament vs complete remediation
Emma Foster (Systems Administrator):
“I can do mass reimaging—we have a master image for gaming stations. It’ll take 24 hours to reimage all 80 stations, or I can do just the 20 tournament stations in 6 hours. But if we don’t fix the underlying issue—customers downloading fake software—we’ll be reinfected within days.”
Present choice: Complete mass remediation vs tournament-only cleanup vs hybrid approach with customer controls
Alex Rodriguez (Tournament Coordinator):
“I need to communicate with 150 registered participants. Do I tell them the tournament is postponed? That we had a security incident? Or do I just confirm everything’s on schedule? Participants are traveling from across the state—some are already in hotels.”
Present choice: Tournament cancellation vs proceeding vs modified timeline
Jessica Wong (Customer Support Lead):
“If that information stealer activates Friday evening, it’ll harvest customer payment data. We have an ethical and possibly legal obligation to notify customers before their data is stolen. But if we tell them now, we’ll create panic and damage our reputation. What do we prioritize—their safety or our business?”
Present choice: Immediate customer notification vs delayed notification vs targeted notification after remediation
Emma’s Technical Assessment:
“Here are our options:
Option A: Mass Reimaging (24 hours)
Option B: Tournament-Only Cleanup (6 hours)
Option C: Hybrid Approach (30 hours)
“Which approach balances security, customer protection, and business needs?”
Secondary Payload Analysis (DC 15):
Mass Remediation Planning (DC 12):
Stakeholder Communication (DC 18):
What Team Must Decide:
The Central Tension:
Public customer systems created vulnerability through gaming culture trust—now that same business model pressures team to prioritize tournament over customer data protection.
Transition to Round 3:
“You have complete technical information about FakeBat’s behavior and timeline. The question now is: What kind of gaming cafe do you want to be? One that prioritizes single events over customer protection? Or one that demonstrates trustworthy security practices even when it costs business in the short term?”
Technical Status:
Stakeholder Positions:
Timeline Pressure:
Path A: Customer Protection Priority (Complete Remediation)
Actions:
Consequences:
Type Effectiveness: Mass Reimaging +3, Software Verification +3, Customer Education +2, Network Segmentation +2
DC Requirements: Technical remediation (DC 15), Sponsor negotiation (DC 18), Customer communication (DC 15)
Path B: Hybrid Approach (Balanced Risk Management)
Actions:
Consequences:
Type Effectiveness: Mass Reimaging +3, Network Segmentation +2, Software Verification +3, Station Isolation +1
DC Requirements: Technical remediation (DC 15), Tournament logistics modification (DC 12), Customer communication (DC 15)
Path C: Tournament Priority (Minimal Remediation)
Actions:
Consequences:
Type Effectiveness: Individual Cleanup -1, Postponing Remediation -2, Trusting Customer Actions -2 (ineffective approaches compound failure)
DC Requirements: All DCs increased +5 due to data breach aftermath, customer lawsuits, regulatory investigation
Mass Remediation (DC 15 for tournament stations, DC 18 for all 80):
Sponsor Communication (DC 18 for postponement, DC 12 for modification):
Customer Notification (DC 15):
Software Verification Deployment (DC 12):
Victory Conditions Met:
Partial Success:
Failure:
Success Narrative Example (Path A or B):
“By Friday morning, all tournament gaming stations are restored to clean baselines with software verification systems preventing reinfection. You’ve notified affected customers about the security incident and your proactive protection measures. Some customers appreciate the transparency; others are concerned but respect your honesty.
“Saturday’s tournament proceeds with 20 secured stations instead of the planned 80. Sponsors are impressed by your transparent handling—they’d rather be associated with a trustworthy venue that handles incidents professionally than one that takes security shortcuts. Several sponsors commit to future partnerships specifically because you demonstrated customer protection priority.
“By Monday, all 80 stations are clean with software verification active. You’ve implemented customer education about safe gaming software sources. Level Up Gaming Cafe becomes known as the secure gaming venue—the place that chose customer protection over a single tournament’s revenue.”
Failure Narrative Example (Path C):
“The tournament proceeds Saturday with manually cleaned stations. Friday evening at 8 PM, the information stealer activates across 60 non-tournament gaming stations, harvesting customer payment data and game account credentials from 300 customers.
“By Sunday, customers report fraudulent charges and compromised game accounts. By Monday, your data breach notification reveals the full scope. Customer lawsuits are filed for negligent data protection. Sponsors distance themselves from the venue, citing security concerns. Competitor cafes advertise your breach in their marketing: ‘Play Secure—We Protect Your Data.’
“Level Up Gaming Cafe faces financial crisis from legal costs, lost business, and reputation damage. The single tournament you saved becomes the event that destroyed your business—because you chose short-term revenue over customer protection.”
What Just Happened (Technical Summary):
Type Effectiveness Review:
Technical Learning Question:
“How would you design gaming cafe security that allows customer freedom while preventing malware reinfection through gaming culture trust?”
Stakeholder Management Review:
Communication Strategies:
Collaboration Learning Question:
“How does public customer system security require different stakeholder management than corporate IT? What unique challenges does gaming culture create?”
Scenario Themes:
Personal Reflection Questions:
Real-World Context:
Session Assessment:
Adaptation Notes for Next Time:
If Team Succeeded:
Acknowledge specific excellent decisions:
What This Victory Means:
“You protected 300 customers from financial fraud and game account theft. You demonstrated that customer security and business success aren’t competing priorities—they’re integrated. Level Up Gaming Cafe will be known as the secure venue, the place that chose customer protection over a single tournament’s revenue. That reputation will drive long-term business growth that far exceeds one event’s sponsorship.”
May your systems stay clean and your tournaments run smoothly!