Client presentation pressure creates fake update vulnerability
2025-12-04
Scenario Details:
IM Quick Start:
Press ‘P’ for player-safe mode before showing slides!
Other essential keys:
The Situation:
Creative Solutions Studio is managing client campaigns when employees notice their browsers redirecting to unexpected websites and displaying persistent advertisements. Staff report installing “critical software updates” for design tools, but these were sophisticated software masquerading attacks delivering multi-stage trojan payloads. Major client presentation scheduled for Friday.
Your Role:
You are the incident response team for Creative Solutions Studio. The agency’s business owner has called you in because the compromised design workstations are threatening both client data security and the ability to deliver a critical presentation that could make or break the company’s reputation.
Victory Condition:
Successfully identify and remove FakeBat downloader, restore design workstation integrity, protect client data, maintain Friday presentation timeline, and implement user education to prevent recurrence.
Overview:
Current State:
Managing multiple client campaigns with compromised design workstations affecting creative staff workflow. Limited IT resources (part-time coordinator) creating response challenges.
Key Systems:
Immediate Pressure:
Friday client presentation - major pitch that represents significant business opportunity. Cannot be rescheduled. Losing this account would severely impact agency survival.
Essential NPCs (appear in all rounds):
Lisa Martinez - Business Owner Managing agency operations while worried about reputation damage and client confidence
Jake Thompson - IT Coordinator Part-time IT support investigating unauthorized software installations and learning about sophisticated malware
Sarah Chen - Creative Director Reporting design software “updates” and persistent browser ads, frustrated by workflow disruption before major presentation
Mark Rodriguez - Client Relations Manager Assessing impact on client data security and managing client communication about potential exposure
Lisa Martinez (Business Owner):
Jake Thompson (IT Coordinator):
Sarah Chen (Creative Director):
Mark Rodriguez (Client Relations Manager):
Reported Issues:
Help Desk Reports:
“Sarah and three other designers are complaining about constant pop-ups and their browsers taking them to weird shopping sites. They all said they installed updates this morning to fix it, but it’s getting worse.”
Observable Evidence:
Timeline:
Actual Infection Vector:
Malicious advertisements (malvertising) on design resource websites led to fake software update pages. These pages mimicked legitimate Adobe and design tool update interfaces, delivering FakeBat downloader trojan when designers clicked “Install Critical Security Update.”
Full Attack Timeline:
Hidden Evidence:
Evidence players can discover through investigation:
What Players Don’t Know Yet:
Round 1 Discoveries:
Round 2 Discoveries:
Round 3 Discoveries:
Round 1: Discovery Phase
IF players investigate browser behavior first: → They discover malicious extensions and fake update downloads leading to FakeBat identification
IF players investigate network traffic first: → They discover C2 communications and ad network connections leading to Downloader classification
IF players miss both: → Jake reveals: “I found these weird browser extensions called ‘Adobe_Security_Update’ - is that normal?”
Round 2: Deep Dive
Branching point based on Round 1 approach:
Round 3: Response Decision
Critical choices with consequences:
Stuck? Use These:
Classification: Downloader / Social
Behavioral Patterns:
Observable Indicators:
Threat Level: ⭐⭐ (Intermediate)
Potential Approaches:
Players have suggested:
Resources Available:
Known Effectiveness:
Based on malmon type (Downloader/Social):
Time Pressure:
48 hours until Friday client presentation - cannot be rescheduled without major business impact
Type Matchups for Downloader/Social:
Super Effective (+3):
Effective (+2):
Moderately Effective (+1):
Normal Effectiveness (0):
Ineffective (-1):
Very Ineffective (-2):
Success Probabilities:
Round 1 Objectives:
Key NPCs This Round:
Critical Inflection Point:
Sarah mentions: “Three other designers installed the same update I did - we were all trying to fix the browser problems.” → Players realize reinfection cycle is active
IM Scratchpad:
Use this for:
Round 2 Objectives:
NPC Escalation:
Critical Decision:
Players must choose cleanup approach balancing: - Thoroughness (complete remediation) vs Speed (meet Friday deadline) - Security (comprehensive cleanup) vs Usability (designers need tools) - Transparency (tell clients) vs Discretion (silent cleanup)
Branching Paths:
Common Player Mistakes:
Round 3 Objectives:
Response Implementation:
Based on Round 2 choice, players now execute:
Success Calculation:
Type effectiveness + Business continuity + User education quality = Outcome
Possible Outcomes:
Complete Success: Browser forensics + Software verification + User education implemented → Presentation happens Friday, malware removed, staff trained, long-term protection (requires Path C with strong execution)
Partial Success: Technical cleanup good but user education rushed → Presentation succeeds, malware removed from critical systems, but reinfection risk remains (common outcome)
Complicated Success: Business wins but security compromised → Presentation happens but incomplete remediation, client notification required later (Path B outcome)
Failure Forward: Cleanup delays presentation but builds security foundation → Business takes short-term hit, long-term security gains (Path A outcome - reframe as investment)
Unexpected Events:
Technical Concepts:
Real-World Parallels:
FakeBat represents real malware families like SocGholish, FakeUpdates, and various browser hijackers that exploit user trust in software updates. The malvertising → fake update → trojan platform chain is common in real attacks targeting businesses.
Collaboration Skills:
MITRE ATT&CK Techniques:
For the Group:
Decision-Making: “What was the hardest decision you made? How did business pressure influence your security choices?”
Team Dynamics: “How did different perspectives (technical, business, creative) shape your approach? What role did user education play?”
Real-World Application: “How would your organization handle this situation? What’s similar or different from Creative Solutions’ challenges?”
Type System: “How did understanding FakeBat as a Downloader/Social type help you choose response strategies?”
Learning Moments: “What will you remember from this scenario? How might you apply user education in your own work?”
If Players Chose Security First (Path A):
Emphasize: Professional responsibility and long-term client trust - delaying presentation shows commitment to security Connect to: Real businesses that chose security over expediency and built stronger client relationships Missed opportunity: They didn’t see business continuity angle - but security foundation is solid
If Players Chose Business First (Path B):
Emphasize: Real-world pressure and risk management - understanding business context is valid Connect to: Incidents where “good enough for now” led to major breaches - when does technical debt become unmanageable? Missed opportunity: Reinfection risk still exists - what’s the follow-up plan?
If Players Chose Hybrid (Path C):
Emphasize: Excellent risk management and balanced thinking - no perfect answer exists Connect to: Real incident response balances business continuity with security - this is professional-level decision making Extension: How would you measure success of user education program? How would you prevent next infection?
If Players Struggled:
Focus on: They learned how business pressure affects security decisions - that’s the core lesson Avoid: Emphasizing “optimal” solution - real IR teams struggle with these trade-offs too Next time: Try similar small business scenario with different malmon type to build confidence
If Players Excelled:
Challenge: “How would you design a security program for Creative Solutions with their budget constraints?” Extension: Try Tier 2 scenario (Poison Ivy) with more complex technical challenges Share: Ask them to mentor newer players in future sessions
Connections to Other Scenarios:
Malware & Monsters Materials:
Related Scenarios:
Real-World Learning:
Type Effectiveness Quick Ref:
Victory Condition:
Identify/remove FakeBat + Restore workstations + Protect client data + Maintain Friday timeline + Implement user education
NPC Quick Ref:
Pressure Timeline:
Friday 2 PM - Client presentation (48 hours from scenario start)
Common Player Pitfalls:
Stuck? Use:
Pacing Adjustments:
Running Long:
Running Short:
Congratulations on completing this scenario!
Post-Session Tasks:
Questions or Issues?
See the Using Scenario Slides Guide for troubleshooting and facilitation tips.
Session Controls:
malwareMonsters.session.export() - Download session statemalwareMonsters.session.clear() - Reset for next session