Trace a multi-subnet ransomware incident from phishing macro to shadow-copy destruction, then choose containment that preserves evidence
At 06:00 the SOC at the fictional Solstice Retail Group is flooded with mass file-rename alerts and ransom notes spreading across three network segments. Trace patient-zero back to a phishing macro, reconstruct the WMI/SMB propagation and shadow-copy destruction, and choose containment that preserves evidence instead of paying the ransom.
Meadowbrook Dental Group, a small three-office practice, arrives Monday morning to find their single file server displaying a ransom note and every patient-record file renamed with a new extension. There was no phishing email, no lateral movement, just one server. Reconstruct how a single exposed service let an attacker walk straight in over the weekend.
Vantage Municipal Services, a regional utility billing provider, discovers ransomware across its finance and customer-records servers on a Tuesday morning. Unlike a simple smash-and-grab, logs show days of quiet reconnaissance and a large outbound transfer the night before encryption began. Reconstruct the full intrusion, confirm what left the network before the files were locked, and determine what that means for notification obligations.
Fairhaven Regional Hospital's entire virtualized infrastructure, dozens of guest VMs running EHR, imaging, and lab systems, goes dark within minutes, well before any single guest OS would show ransomware symptoms. The attack targeted the ESXi hypervisors directly. Reconstruct how the hypervisor layer itself was compromised and used to take down every VM at once, without any of the usual Windows-endpoint artifacts this lab's other cases rely on.
Pinegrove Credit Union recovers every encrypted file using a publicly-documented decryptor for the GREYLATCH ransomware family, and leadership wants to close the ticket. A wider 30-day log pull an analyst insisted on turns up an outbound transfer two days before encryption that nobody had looked for. Determine whether a fully successful decryption actually closes this incident.
Alderney School District's EDR fires a 'mass file modification' ransomware-behavior alert at 2 AM against its file server, 38,000 files touched in six minutes. There's no ransom note, no new extension, and no encryptor process. Determine whether this is ransomware in progress or a legitimate, scheduled bulk job that simply looks the same to a files-per-minute heuristic.
EDR at Tallgrass Manufacturing actually catches an encryptor mid-run on FS-TALLGRASS-02 and kills the process, but the share is left with three different kinds of files: untouched originals, fully encrypted files, and a third group renamed with the ransomware extension whose content looks only partially scrambled. Determine what an interrupted, intermittent-encryption run actually did to each file before deciding what needs restoring.
Castleview School District's backups are supposed to be immutable, stored in a cloud object-storage repository with a locked retention policy. The backups are gone anyway. Reconstruct how compromising a single backup-administrator workstation led to the immutable repository's own retention lock being disabled before a single file was ever encrypted.
Kestrel Point Insurance Agency restored from backup after a ransomware incident in July and declared it resolved. In August, a different-looking ransom note appears on the same servers. Reconstruct why restoring the files the first time never actually evicted the attacker, and what a real eradication step would have found.
Driftwood Marina & Resort's negotiator receives a 'proof' file from the ransomware operators claiming to be stolen guest records, posted as leverage during a stalled negotiation. Statically compare the sample against Driftwood's actual data schema and the network telemetry from the incident window to determine whether any data actually left the network at all.