Chinese APT Supply Chain Espionage Under Merger Pressure
2026-03-14
You’re part of BioGenix Solutions’ incident response team, facing the worst possible timing: a security incident surfacing on the same week as a major acquisition close.
Investigate and contain a sophisticated intrusion while protecting proprietary R&D, managing a live merger negotiation, meeting GDPR obligations to Datatilsynet, and coordinating with Danish intelligence agencies – all simultaneously.
New to facilitating Malware & Monsters? Start here:
IM Quick Start Guide – Everything you need to run this scenario in one concise document
Your on-call SOC analyst hands you a stack of alerts that accumulated overnight. They flagged them for escalation at shift change rather than acting alone – none individually looked catastrophic, but the pattern is wrong.
HANSEN-SAP-01, which the ITSM system lists as scheduled for decommissioning, authenticated into your Azure cloud R&D environment twice last nightSomething is active inside your environment right now. The question is what, and how long it has been there.
Sector: Precision fermentation and industrial enzyme engineering
Size: 1,800 employees, headquarters in Copenhagen
Current Situation: Active acquisition negotiation – an international buyer has been conducting due diligence for 8 weeks. The deal is expected to close by end of month. The acquisition data room contains 3+ years of proprietary R&D.
HANSEN-SAP-01), scheduled for decommissioning since September 2024, still network-connectedIf the R&D portfolio has been compromised, the acquisition counterparty is negotiating with incomplete information. And if proprietary genomic sequences are in foreign hands, the competitive damage is permanent.
Three workstations (BIOGEN-RD-WS-01, WS-02, WS-03) all show the same pattern: the calibration service calibsvc.exe spawned a PowerShell process with an encoded command, which then ran net.exe user svc-rdbridge-admin /domain.
The CaliSyncPro update v4.2.1 completed at 22:13 last night. The process anomalies started at 22:14.
HANSEN-SAP-01 is an on-premise SAP NetWeaver server that should be offline – it was marked for decommissioning 18 months ago. Last night it authenticated as svc-rdbridge-admin into your Azure AD environment, bypassing Conditional Access via a legacy exception called COLLBRIDGE-EXCL-003.
Six sequential batch reads of GenixLibrary sequence files, originating from the Azure cloud environment, between 22:21 and 23:48. The account used: svc-rdbridge-admin. No interactive logon preceded any of these sessions.
847 gigabytes of outbound HTTPS traffic over the past 90 days, all classified by your DLP system as Microsoft Graph API telemetry. The destination resolves to graph-api-sync.bioanalytics.net – a domain registered 4 months ago via a privacy proxy.
What They Care About: Closing the acquisition on schedule, protecting shareholder value, preserving BioGenix’s market position
Current State: Not yet fully briefed – knows there are “some security alerts” but doesn’t know the scope
Helpful For: Authorization for aggressive containment actions, acquisition counterparty communication, board-level decisions
Potential Barrier: May resist actions that could surface to the acquisition counterparty and complicate the deal
What They Care About: R&D pipeline integrity, system availability, the security of GenixLibrary
Current State: Alarmed – she knows GenixLibrary is the core acquisition asset and any integrity question is a deal-risk
Helpful For: Technical architecture, access controls, understanding what GenixLibrary data was accessible, authorizing forensic work on cloud R&D systems
Potential Barrier: Will want forensic work to be thorough but fast, which creates tension with evidence preservation
What They Care About: Containment, evidence preservation, regulatory compliance, counterintelligence coordination
Current State: Running the incident response – has escalated to you for structured team decision-making
Helpful For: Forensic strategy, GDPR 72-hour clock, CFCS coordination, what ITSM records show about HANSEN-SAP-01
Potential Barrier: Cautious by nature; may slow decisions trying to verify before acting
What They Care About: GenixLibrary data integrity, her research team’s work, understanding what was accessed and whether results are still valid
Current State: Deeply concerned – she assembled the acquisition data room packages personally
Helpful For: What data is in GenixLibrary, which datasets were included in the acquisition package, what an adversary would want
Potential Barrier: May become emotionally focused on one specific dataset or research program and narrow the team’s scope
Hidden Agenda: The acquisition timeline is under board pressure – a deal delay costs BioGenix significant bridge financing. Phillip will resist anything that requires disclosure to the counterparty.
Secret Fear: That the exfiltration scope, once disclosed, collapses the valuation or kills the deal entirely.
Character Arc:
Roleplay Notes: Phillip is not malicious – he’s protecting his company. His arc is about understanding that opacity is a greater deal risk than honest, qualified disclosure.
Hidden Agenda: She approved the COLLBRIDGE-EXCL-003 Conditional Access exception during the merger integration. She knows this, and she’s aware it’s the policy gap that let the attacker in.
Secret Fear: That the forensic investigation will surface her name on that exception approval.
Character Arc:
Roleplay Notes: Katrine is an asset to the response – her obstruction only appears on one specific topic. Push her gently if the team notices inconsistency in her cooperation.
Hidden Agenda: He tried to get HANSEN-SAP-01 decommissioned six months ago. The ITSM ticket is still open. Facilities and Finance blocked it for budget reasons.
Secret Frustration: He has documentation of the risk – and he’s furious it went unaddressed.
Character Arc:
Roleplay Notes: Bent is a sympathetic figure. His caution and frustration are both justified. He becomes more decisive as the team validates his prior risk assessments.
Hidden Agenda: She suspects the attacker specifically targeted the acquisition data room packages – GenixLib-Acquisition-Package-v1 and v2 – because those datasets contain the full competitive picture, not just individual research files.
Secret Knowledge: She knows which competitor nations would benefit most from this specific data – she’s been tracking parallel research programs at Chinese state-backed institutions.
Character Arc:
Roleplay Notes: Ida’s technical knowledge is a pivot point for the counterintelligence dimension. She can help the team understand why this incident is more than corporate espionage.
2025-11-20: Domain graph-api-sync.bioanalytics.net registered via privacy proxy.
2025-11-14: Code-signing certificate for CaliSync Instrumentation GmbH (SN 4A9F02B1) is revoked by the issuing CA.
2025-12-04 (estimated): CaliSyncPro update v4.2.1 compiled with Winnti dropper embedded.
2025-12-04: CaliSyncPro v4.2.1 delivered via vendor update channel; trusted vendor exception policy skips OCSP/CRL check at deployment. Winnti dropper executes on three bioreactor workstations, harvests NTLM credential hash for svc-rdbridge-admin from memory via encoded PowerShell command.
2025-12-10 (first session): HANSEN-SAP-01 uses harvested svc-rdbridge-admin hash (Pass-the-Hash via NTLM) to authenticate through the Collaborative Bridge into Azure AD, bypassing Conditional Access via COLLBRIDGE-EXCL-003. First GenixLibrary batch read session: 19 files, Fermentation-Seq-Archive-2023.
2025-12-10 to 2026-03-09: 43 additional off-hours batch read sessions. 847 GB exfiltrated via port 443 to graph-api-sync.bioanalytics.net, TLS SNI spoofed as graph.microsoft.com.
2026-03-09 22:14: Process anomaly on calibration workstations triggers EDR alert (44th session underway).
2026-03-10 07:45 (now): On-call analyst escalates overnight alert batch at shift change.
Supply Chain Entry:
v4.2.1 update from CaliSync Instrumentation GmbHcalibsvc.exe on 3 bioreactor workstationssvc-rdbridge-admin NTLM hash from memoryKernel-Level Persistence on HANSEN-SAP-01:
4A9F02B1) loaded at ring-0NtQuerySystemInformation hook hides 5 processes from standard enumerationtasklist.exe203.0.113.44:443HANSEN-SAP-01 excluded from SOC monitoring under decommission-backlog exclusionLateral Movement:
HANSEN-SAP-01 using harvested hash – no interactive logon ever recordedCOLLBRIDGE-EXCL-003 Conditional Access exception (created 2024-11-14, never reviewed, no expiry) bypasses MFA requirementExfiltration:
GENIX-PROD-01 and AZURE-RD-ENV-01graph.microsoft.com; actual destination graph-api-sync.bioanalytics.netsvc-rdbridge-admin excluded from off-hours DLP policy as a service accountActive persistence: Kernel rootkit on HANSEN-SAP-01 with live C2 connection to 203.0.113.44:443.
Active exfiltration channel: 44th session was underway at time of detection – status of final session unclear.
Suspected scope: All 44 GenixLibrary dataset archives accessed, including GenixLib-Acquisition-Package-v1 and v2.
Attribution indicators: Kernel driver certificate matches CFCS bulletin CB-2026-0312 citing identical revocation date across 3 other Danish biotech/pharma targets.
Initial Discovery:
Key Decision: Isolate HANSEN-SAP-01 first (cuts active Azure access) vs isolate calibration workstations first (stops ongoing harvesting but attacker already has credentials)
Correct Priority: HANSEN-SAP-01 – the attacker has current active Azure R&D access from there right now
Forensic Discovery:
Key Decision: Preserve memory image and kernel driver artifact before any remediation action
Red Flag: Team reimages without capturing memory image – attribution and counterintelligence value permanently lost
Lateral Movement Confirmed:
Key Decision: Revoke credentials and close exception immediately vs wait for full scope picture
Red Flag: Team delays credential revocation – active cloud R&D access continues during the delay
Exfiltration Scope:
Key Decision: Scope statement to merger counterparty – what can be confirmed vs what is still under investigation
Red Flag: Team overstates certainty; later scope revisions damage credibility with regulators and counterparty
Multi-Stakeholder Coordination:
Key Decision: How to share indicators with CFCS without compromising merger timeline or regulatory obligations
Red Flag: Team allows CFCS coordination to delay GDPR notification – they are separate obligations
Post-Incident:
Memory Forensics:
tasklist.exeCertificate Validation Enforcement:
v4.2.1 installationBehavioral Analysis (process tree):
calibsvc.exe spawning PowerShell with encoded command is a high-confidence indicatorNetwork Traffic Analysis:
graph-api-sync.bioanalytics.net destination despite SNI spoofingLegacy System Governance:
HANSEN-SAP-01 was the persistence anchor; decommissioning it would have closed the attack pathConditional Access Policy Review:
COLLBRIDGE-EXCL-003 would have stopped all 11 lateral movement sessionsSignature-Based Antivirus:
tasklist.exe returns clean output – rootkit hides own entriesHANSEN-SAP-01 returned clean throughout 90-day dwell periodDLP Alert Tuning (alone):
If team isolates workstations before HANSEN-SAP-01:
HANSEN-SAP-01If team rushes to reimage without preserving forensics:
If team conflates regulatory and counterintelligence workstreams:
What the team receives at 07:45:
calibsvc.exe → svchost.exe → powershell.exe -encodedCommand → net.exe user svc-rdbridge-admin /domain on BIOGEN-RD-WS-01, WS-02, WS-03HANSEN-SAP-01 authenticated as svc-rdbridge-admin twice last night; COLLBRIDGE-EXCL-003 exception bypassed Conditional Accesssvc-rdbridge-admin, no interactive logonHandout: Distribute Handout A: Supply Chain Evidence
Drive toward the isolation sequence:
HANSEN-SAP-01? It’s in the Collaborative Bridge dependency chain – Katrine and Bent both have a stake.”Conditional outcomes:
HANSEN-SAP-01 first: Active Azure R&D access cut. Collaborative Bridge drops briefly. Calibration workstations isolated next – rootkit artifacts preserved.HANSEN-SAP-01 isolation: Attacker maintains active Azure access during delay. Additional GenixLibrary read sessions possible before cutoff.Success indicators: Incident command established, isolation sequence prioritized (HANSEN-SAP-01 first), evidence preservation owner assigned.
“Hardware-assisted memory enumeration of HANSEN-SAP-01 is complete. Standard tasklist.exe shows 87 processes. Physical memory enumeration shows 92. Five hidden PIDs. PID 4028 has an ESTABLISHED connection to 203.0.113.44:443 right now. The kernel driver masking these processes is signed by CaliSync Instrumentation GmbH – but that certificate was revoked on 2025-11-14. And HANSEN-SAP-01 hasn’t had a security patch since August 2024. It’s been excluded from SOC monitoring since the decommission ticket was opened.”
Handout: Distribute Handout B: Rootkit Forensic Artifacts
Drive toward evidence preservation:
Conditional outcomes:
Success indicators: Memory image captured, kernel driver artifact preserved, CFCS notification decision made, certificate revocation investigation initiated.
“Correlation complete. svc-rdbridge-admin authenticated from HANSEN-SAP-01 into the Azure R&D environment 11 times over 90 days. Every session is NTLM. No interactive logon preceding any session – not one. COLLBRIDGE-EXCL-003 is a Conditional Access exception created on 2024-11-14 during the SAP migration window. Expiry: NONE SET. Last reviewed: NEVER.”
Handout: Distribute Handout C: Lateral Movement Log
Drive toward credential revocation and policy closure:
svc-rdbridge-admin – and does that scope match your current exfiltration estimate?”COLLBRIDGE-EXCL-003 was created during merger integration and never reviewed. What governance process should have caught this?”Surface Katrine’s involvement (optional pressure):
Conditional outcomes:
Success indicators: svc-rdbridge-admin credentials revoked, COLLBRIDGE-EXCL-003 closed, scope of Azure resources documented.
“847 gigabytes outbound over port 443, destination graph-api-sync.bioanalytics.net. Domain registered 4 months ago, privacy proxy, self-signed certificate impersonating Microsoft. DLP classified all of it as Microsoft telemetry – it trusted the SNI header and never validated the certificate. GenixLibrary audit log shows 44 off-hours batch read sessions since December 10. svc-rdbridge-admin was excluded from off-hours movement policy as a service account. This was methodical.”
Handout: Distribute Handout D: Exfiltration Traffic Analysis
Drive toward scoped disclosure decisions:
Phillip Christensen enters:
“I’ve just been briefed. I need to understand what we can tell the counterparty without blowing the deal. What’s your recommendation?”
Present the tension: proactive calibrated disclosure vs waiting for full certainty vs saying nothing.
Conditional outcomes:
Success indicators: Exfiltration scope documented with confidence level, GDPR notification draft initiated, merger briefing position agreed.
Datatilsynet: GDPR notification status requested. Reference DT-2026-0847. 72-hour clock is running.
CFCS: They have seen this exact supply chain pattern at 3 other Danish biotech and pharma firms. CFCS bulletin CB-2026-0312 cites identical kernel driver certificate revocation date. They want your indicators.
PET: Counterintelligence inquiry. A foreign state actor is collecting Danish genomic and fermentation IP. They want a coordination call.
Merger advisor: Calls next. Counterparty has heard there is “a security matter” from a contact at one of the other affected firms.
Force workstream separation:
If team conflates workstreams:
IM reference numbers (share if asked):
DT-2026-0847CB-2026-0312Conditional outcomes:
Success indicators: GDPR notification owner assigned, CFCS coordination scope agreed, merger advisor briefing position confirmed.
“Immediate containment is in place. You have stopped the bleeding. But 847 gigabytes of genomic R&D may already be in the hands of a foreign intelligence service. The next decisions you make determine whether this becomes a repeat event or a turning point for BioGenix.”
Technical:
Governance:
Strategic:
Red flag: Debrief narrows to “Katrine should have expired the exception” – individual fault framing. Redirect toward the governance structure that should have caught it regardless of who created it.
Institutional pressure – decommissioning backlogs, merger integration shortcuts, compliance exceptions with no expiry – created the conditions the attacker exploited. The technical sophistication of Winnti is real. But the attack succeeded because of governance failures that predated it by 18 months.
Patient adversaries reveal impatient defenses. The 90-day dwell time was not a limitation – it was a choice.