In March 2018, Atlanta's municipal services were brought to a standstill by a devastating ransomware attack orchestrated by the notorious Iranian hacker group, SamSam. The attack, which leveraged brute-force tactics to gain access via Remote Desktop Protocol (RDP), led to a ransom demand of $51,000. However, the true cost of recovery soared to an estimated $17 million. Participants are tasked with tracing the steps of this attack, from initial access to the eventual exfiltration, in a comprehensive cybersecurity investigation.