Malware & Monsters

Biotech R&D Espionage

Malware & Monsters

A Collaborative Cybersecurity Exercise

Malware & Monsters is an open-source incident response training framework. You learn by doing – investigating a simulated cyberattack as a team, making decisions under pressure, and discovering what works and what doesn’t.

There are no trick questions. There are no wrong answers.

There are decisions, consequences, and a debrief where the real learning happens.

malwareandmonsters.com

30 seconds. Most players don’t need a long framework introduction. They need to know: this is collaborative, there are no gotchas, and the debrief is where we connect it to real life.

This Version is Custom

Today’s scenario is a custom exercise built for this session.

The full M&M framework – including a visual guide and zero-prep scenarios you can run tomorrow – is available free at malwareandmonsters.com

One slide. Point people to the site if they want to run their own session. Don’t dwell – this is context, not a sales pitch.

Three Teams. One Incident.

You have been divided into three specialist teams.

Each team receives different evidence.

No team has the complete picture. That is deliberate.

Your Incident Commander synthesises across all three teams.

The key insight for players: information asymmetry is the mechanic, not a bug. Teams are supposed to have incomplete pictures. The synthesis moment is where the learning happens.

Your Teams

ALPHA	BRAVO	CHARLIE
Forensics	Network & Infrastructure	Threat Intel & Recovery
What happened on the systems. Processes, artefacts, evidence.	How it moved through the network. Connections, access, traffic.	Who is behind it and how to respond. Attribution, scope, recovery.

Each team’s lens is genuinely different – not a difficulty tier. Alpha is not “harder” than Charlie. They are different angles on the same incident.

The Incident Commanders

Two ICs Today

• IC #1 manages the first half – Rounds 1 and 2
• IC #2 takes over mid-session after a structured handover

The IC does not join a team. The IC listens, connects the threads, and decides when teams disagree.

Brief the ICs privately before this slide if not already done. Key message: the IC is the listener and synthesiser, not the technical lead.

The Whiteboard

The IC owns the whiteboard. It is the single source of truth.

whiteboard

CONTAINED

✓ svc-rdbridge-admin

✓ C2 blocked

OPEN

COLLBRIDGE-EXCL-003

HANSEN-SAP-01

GenixLibrary

??? more ???

When a containment action succeeds, the IC moves the note from OPEN to CONTAINED.

Point at the physical whiteboard in the room. If it’s not set up yet, set it up now. The IC should draw the two columns and the dashed line before Round 1 starts. The sticky notes start in OPEN and move left as the team contains things. This is the game’s visual scoreboard.

How a Round Works

1. Pick up your evidence cards – each team gets new cards
2. Analyse as a team – 8-12 minutes at your table
3. Team Lead briefs the IC – 60-90 seconds each, one at a time.
4. IC synthesises – connects the threads, updates the whiteboard
5. Next round – new envelopes, deeper evidence

If you need more information or context at any point, ask the facilitator.

Walk through these steps slowly. Most players will not have done this format before. The “ask the facilitator” line is important – without it, players will not know they can ask, and the facilitator has no natural opening to release supplemental information.

The Rules

1. Your evidence stays at your table. Do not show cards to other teams.
2. When the facilitator calls time, analysis stops immediately and IC briefings begin. No extensions.
3. Team Leads brief the IC one at a time.
4. The IC’s call is the call. Voice disagreement once, then commit.
5. You will not have all the answers. That is fine. Neither does anyone else.

Read these aloud, slowly, one at a time. Rule 5 is the most important for managing anxiety – especially with senior participants who are not used to working with incomplete information.

Dice

When the IC proposes a containment action:

1. Which team owns this? The IC assigns it.
2. How hard is it? The facilitator decides difficulty and drives the storyline accordingly.
3. What could go wrong? The team states the risk.
4. Roll. Success, partial, or failure.

Difficulty: Easy 5+ · Medium 10+ · Hard 15+ (d20)

Helps your roll: All teams briefed (+2) · Written rationale (+1) · Team named this risk before rolling: advantage (roll twice, take higher)

One pass through is enough – players do not need to memorise modifiers. The facilitator sets difficulty (Easy = 5+, Medium = 10+, Hard = 15+) and applies modifiers. Advantage = roll two d20s, keep the better result. It triggers only when the team explicitly named the specific risk before rolling – not after the fact. Rewards careful risk articulation. Skip this slide if not using dice.

BioGenix Solutions

• Danish biosolutions company, 1,800 employees
• Precision fermentation and industrial enzyme engineering
• Major acquisition completed in 2024 – post-merger integration ongoing
• GenixLibrary – proprietary R&D sequence database, most commercially valuable research data
• Legacy infrastructure from the merger still connected to the environment

This establishes the company context and the stakes. GenixLibrary is the crown jewel. Legacy infrastructure is the weak point. Don’t elaborate beyond what’s on the slide – the evidence cards will tell the rest of the story.

Something Has Gone Wrong

CFCS contacted your CISO a couple of hours ago.

A supply chain compromise campaign targeting European life sciences.

Indicators match your infrastructure.

We do not yet know if we are compromised.

Your job is to find out.

This is the atmosphere-setter. Pause here. Let the room quiet down. This replaces the CISO read-aloud from the cue script – you can either read it from this slide or deliver the full briefing verbally. Either way, don’t rush.

Check In

• Who is your Team Lead?
• Does everyone know which team they are on?
• Has the IC been briefed?
• IC #2 – please leave the room now.

You have 2 minutes.

The scenario begins when the evidence cards are distributed.

Breathing space before cards go out. Confirm IC has been briefed. Make sure the whiteboard is set up with CONTAINED / OPEN columns. When ready: distribute Round 1 evidence cards.

Round 1 begins now.

Distribute Round 1 evidence cards. Start timer. The game has begun.