Ransomware Attack with Data Exfiltration

Scenario Overview

Exercise Type: Strategic & Technical Crisis Simulation Target Audience: Executive Leadership, IT Security Teams, Legal Counsel, PR/Communications Scenario: Dual Ransomware Encryption & Data Extortion Campaign Duration: 120-150 minutes Objective: Coordinate response to operational paralysis and sensitive data exposure while maintaining regulatory compliance and public trust

Exercise Script

INJECT 1: System-Wide Encryption (Day 1 - 08:00 AM)

Situation:

63% of workstations display ransom note:

"Pay 42 BTC by 48hrs or 1) Lose decryption keys 2) We leak 18GB client contracts"
Critical systems affected:
- ERP production scheduling
- Patient records database (Healthcare)
- SCADA control panels (Manufacturing)
Initial spread vector: Compromised VPN credentials with disabled MFA

Discussion Prompt: "What immediate containment steps prevent spread? How maintain critical operations manually?"

INJECT 2: Data Theft Confirmed (Day 1 - 08:45 AM)

Situation:

Threat actors provide:
- Sample files from CFO's encrypted drive
- Database schema of customer PII repository
- Screenshot of deleted backup scripts
Dark web monitoring shows:
- 2.8M employee/customer records for sale
- Countdown timer for "full data dump"

Discussion Prompt: "What breach notification timelines apply under HIPAA/GDPR? How verify data authenticity?"

INJECT 3: Ransom Negotiation (Day 1 - 10:30 AM)

Situation:

Attackers demand:
- $3.8M in Monero for decryptor
- Additional $1.2M to delete stolen data
Insurance carrier advises:
- 78% likelihood of decryption success based on claims history
- No coverage for extortion payments
Forensic analysis shows:
- Ransomware variant uses intermittent encryption (CryLock v4)
- Exfiltration via Cloudflare Tunnels to avoid detection

Discussion Prompt: "What factors determine payment decision? How coordinate with law enforcement discreetly?"

INJECT 4: Operational Paralysis (Day 1 - 01:00 PM)

Situation:

Business impacts:
- Production lines halted (24hr downtime = $4.2M loss)
- 911 dispatch relying on paper maps (Municipal)
- Pharmaceutical cold storage failing (IoT systems encrypted)
Employees report:
- Personal devices infected via "emergency update" SMS
- Phishing emails impersonating incident response team

Discussion Prompt: "How prioritize recovery across facilities? What safety protocols prevent physical harm?"

INJECT 5: Regulatory & Media Storm (Day 1 - 04:00 PM)

Situation:

Simultaneous crises:
- SEC subpoenas for cybersecurity governance documents
- Front-page headline: "[WithPCI.com Company Name] Paid Ransoms to Child Hospital Attackers"
- Hacktivists DDoS patient portal in "solidarity" with attackers
Payment processor revokes merchant account due to fraud risk

Discussion Prompt: "What public statements address ethical dilemmas? How manage investor relations during blackout periods?"

INJECT 6: Decryption Challenges (Day 1 - 08:00 PM)

Situation:

Partial decryption results:
- 92% file recovery rate but critical databases corrupted
- Ransomware modified NTFS timestamps, breaking legal hold
- Legacy manufacturing firmware unrecoverable
Attackers re-encrypt systems during recovery via dormant RAT

Discussion Prompt: "How validate decryption key effectiveness? What air-gapped recovery procedures prevent reinfection?"

INJECT 7: Post-Attack Transformation (Day 30 - 10:00 AM)

Situation:

Implemented changes:
- Immutable backups with 7-day rotation
- Network segmentation with OT/IT divide
- Cyber insurance requires breach simulations
Unresolved issues:
- 14% data integrity errors in financial records
- Ongoing class action from breach victims

Discussion Prompt: "What metrics define operational recovery? How rebuild partner trust after extended downtime?"

Debrief Focus Areas

Ransom Payment Ethics & Legal Exposure
Cross-Department Crisis Leadership
Immutable Infrastructure Design
Dual Extortion Threat Intelligence
Workforce Psychological Safety

Post-Exercise Deliverables:

Ransomware Decision Tree with Legal/PR Integration
Critical System Recovery Priority Matrix
Dark Web Monitoring Playbook
CEO Cyber Crisis Speaking Points

Next Steps:

Implement deception technology across endpoints
Conduct quarterly ransomware fire drills
Establish cross-functional "Breach Tribunal" for future incidents