-- Table structure for table `mobile_lesson_completions`
--

CREATE TABLE `mobile_lesson_completions` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `lesson_id` int(11) NOT NULL,
  `xp_earned` int(11) DEFAULT 0,
  `completed_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `mobile_lesson_completions`
--

INSERT INTO `mobile_lesson_completions` (`id`, `user_id`, `lesson_id`, `xp_earned`, `completed_at`) VALUES
(1, 34, 471, 25, '2026-01-12 03:27:48'),
(2, 34, 469, 25, '2026-01-12 03:27:55'),
(3, 34, 4, 15, '2026-01-12 13:16:39'),
(4, 76, 470, 25, '2026-01-13 00:47:15'),
(5, 34, 471, 25, '2026-01-13 02:18:10'),
(6, 34, 6, 15, '2026-01-13 02:18:16'),
(7, 34, 3, 15, '2026-01-13 02:18:18'),
(8, 34, 9, 15, '2026-01-13 02:18:21'),
(9, 34, 7, 15, '2026-01-13 02:18:24'),
(10, 80, 6, 15, '2026-01-15 23:43:36'),
(11, 80, 9, 15, '2026-01-15 23:43:39'),
(12, 80, 11, 15, '2026-01-15 23:43:42'),
(13, 80, 449, 25, '2026-01-15 23:43:45'),
(14, 80, 5, 15, '2026-01-15 23:43:48'),
(15, 79, 449, 25, '2026-01-16 04:04:19'),
(16, 79, 5, 15, '2026-01-16 04:05:25'),
(17, 79, 11, 15, '2026-01-16 04:05:50'),
(18, 79, 9, 15, '2026-01-16 04:06:01'),
(19, 79, 6, 15, '2026-01-16 04:06:07'),
(20, 79, 8, 15, '2026-01-24 12:38:58'),
(21, 102, 8, 15, '2026-01-30 02:11:32'),
(22, 78, 8, 15, '2026-02-13 18:59:13'),
(23, 78, 450, 25, '2026-02-13 18:59:17'),
(24, 78, 472, 25, '2026-02-13 18:59:19'),
(25, 78, 468, 25, '2026-02-13 18:59:21'),
(26, 78, 10, 15, '2026-02-13 18:59:23'),
(27, 151, 6, 15, '2026-02-14 19:17:47'),
(28, 148, 447, 25, '2026-02-15 04:24:48'),
(29, 99, 12, 15, '2026-02-15 04:53:34'),
(30, 109, 1, 15, '2026-02-15 08:32:51'),
(31, 156, 469, 25, '2026-02-15 20:45:59'),
(32, 161, 6, 15, '2026-02-16 05:01:04'),
(33, 99, 7, 15, '2026-02-16 17:15:25'),
(34, 165, 12, 15, '2026-02-16 17:19:30'),
(35, 147, 447, 25, '2026-02-16 21:28:45'),
(36, 165, 7, 15, '2026-02-17 05:26:10'),
(37, 109, 12, 15, '2026-02-17 21:11:39'),
(38, 78, 1, 15, '2026-02-18 02:25:57'),
(39, 170, 1, 15, '2026-02-18 08:21:32'),
(40, 99, 451, 25, '2026-02-18 09:14:58'),
(41, 177, 451, 25, '2026-02-19 04:07:06'),
(42, 78, 8, 15, '2026-02-19 08:27:09'),
(43, 99, 472, 25, '2026-02-19 15:20:47'),
(44, 180, 472, 25, '2026-02-19 15:46:21'),
(45, 109, 471, 25, '2026-02-19 16:01:40'),
(46, 34, 12, 15, '2026-02-20 02:54:34'),
(47, 187, 1, 15, '2026-02-21 03:10:08'),
(48, 182, 7, 15, '2026-02-22 02:45:48'),
(49, 177, 472, 25, '2026-02-22 08:47:47'),
(50, 194, 12, 15, '2026-02-23 03:21:52'),
(51, 177, 1, 15, '2026-02-23 10:55:33'),
(52, 180, 469, 25, '2026-02-23 11:33:24'),
(53, 99, 10, 15, '2026-02-23 15:35:39'),
(54, 196, 3, 15, '2026-02-23 17:47:38'),
(55, 177, 7, 15, '2026-02-24 11:44:14'),
(56, 99, 470, 25, '2026-02-24 13:33:45'),
(57, 147, 469, 25, '2026-02-24 17:11:26'),
(58, 202, 8, 15, '2026-02-24 18:59:18'),
(59, 203, 471, 25, '2026-02-24 19:48:18'),
(60, 165, 449, 25, '2026-02-24 19:53:49'),
(61, 177, 449, 25, '2026-02-25 12:08:00'),
(62, 99, 1, 15, '2026-02-25 16:16:02'),
(63, 174, 1, 15, '2026-02-26 05:00:25'),
(64, 109, 448, 25, '2026-02-26 05:38:01'),
(65, 195, 3, 15, '2026-02-26 07:44:44'),
(66, 99, 11, 15, '2026-02-26 15:09:23'),
(67, 210, 1, 15, '2026-02-26 21:10:14'),
(68, 209, 1, 15, '2026-02-27 04:03:26'),
(69, 99, 12, 15, '2026-02-27 15:41:32'),
(71, 179, 1, 15, '2026-03-01 18:40:25'),
(72, 177, 469, 25, '2026-03-01 21:51:58'),
(73, 109, 469, 25, '2026-03-01 23:02:01'),
(74, 177, 1, 15, '2026-03-03 08:35:45'),
(75, 234, 447, 25, '2026-03-03 19:47:00'),
(76, 237, 470, 25, '2026-03-04 00:44:59'),
(78, 229, 451, 25, '2026-03-04 10:39:27'),
(79, 238, 11, 15, '2026-03-04 15:24:05'),
(80, 220, 7, 15, '2026-03-05 06:42:05'),
(82, 109, 472, 25, '2026-03-06 05:15:36'),
(83, 229, 449, 25, '2026-03-06 20:54:06'),
(84, 259, 5, 15, '2026-03-06 21:49:59'),
(85, 177, 10, 15, '2026-03-07 19:10:20'),
(86, 177, 8, 15, '2026-03-08 11:22:07'),
(87, 109, 12, 15, '2026-03-08 12:48:39'),
(89, 264, 11, 15, '2026-03-09 09:48:04'),
(90, 266, 6, 15, '2026-03-09 12:22:07'),
(91, 195, 449, 25, '2026-03-09 20:58:17'),
(92, 273, 6, 15, '2026-03-10 13:59:07'),
(93, 266, 1, 15, '2026-03-10 14:33:19'),
(94, 274, 3, 15, '2026-03-10 21:03:08'),
(95, 229, 1, 15, '2026-03-11 01:35:29'),
(96, 78, 470, 25, '2026-03-11 07:48:14'),
(97, 275, 3, 15, '2026-03-11 10:53:17'),
(98, 195, 7, 15, '2026-03-11 12:05:45'),
(99, 285, 8, 15, '2026-03-12 07:40:14'),
(100, 288, 469, 25, '2026-03-12 10:23:54'),
(101, 290, 1011, 25, '2026-03-12 14:11:40'),
(102, 293, 449, 25, '2026-03-13 11:14:37'),
(103, 288, 448, 25, '2026-03-13 12:22:26'),
(104, 180, 1027, 25, '2026-03-13 18:04:25'),
(105, 266, 3, 15, '2026-03-14 02:17:15'),
(106, 294, 1, 15, '2026-03-14 04:15:23'),
(107, 295, 1006, 25, '2026-03-14 06:28:16'),
(108, 99, 472, 25, '2026-03-14 07:28:02'),
(109, 299, 470, 25, '2026-03-14 21:43:38'),
(110, 177, 1, 15, '2026-03-15 04:30:01'),
(111, 78, 1027, 25, '2026-03-15 05:51:51'),
(112, 78, 12, 15, '2026-03-15 05:52:03'),
(113, 78, 5, 15, '2026-03-15 05:52:05'),
(114, 78, 451, 25, '2026-03-15 05:52:06'),
(115, 266, 449, 25, '2026-03-15 14:35:10'),
(116, 99, 468, 25, '2026-03-15 17:43:57');

-- --------------------------------------------------------

--
-- Table structure for table `modules`
--

CREATE TABLE `modules` (
  `id` int(11) NOT NULL,
  `learning_path_id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `estimated_hours` int(11) DEFAULT 0,
  `display_order` int(11) DEFAULT 0,
  `prerequisite_module_id` int(11) DEFAULT NULL,
  `is_active` tinyint(1) DEFAULT 1,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `modules`
--

INSERT INTO `modules` (`id`, `learning_path_id`, `title`, `description`, `estimated_hours`, `display_order`, `prerequisite_module_id`, `is_active`, `created_at`, `updated_at`) VALUES
(1, 1, 'Introduction to Cybersecurity', 'Learn what cybersecurity is, why it matters, and explore career paths in the field.', 15, 1, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(2, 1, 'Linux Fundamentals', 'Master the Linux command line, file permissions, and basic system administration.', 25, 2, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(4, 1, 'Networking Essentials', 'Learn the OSI model, TCP/IP, subnetting, and common network protocols.', 30, 4, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(9, 1, 'Windows Fundamentals', 'Master Windows OS, Active Directory basics, and PowerShell for security operations.', 16, 3, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 03:05:08'),
(10, 1, 'Security Principles', 'Core security concepts: CIA Triad, AAA, encryption, defense in depth.', 14, 5, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 03:05:08'),
(11, 1, 'Windows Command Line', 'Master essential Windows commands: Navigation, Files, Networking, and Processes.', 5, 6, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12'),
(12, 2, 'Log Analysis Fundamentals', 'Master the art of reading logs, from basic authentication to advanced attack detection.', 8, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58'),
(14, 2, 'Web Proxies Fundamentals', 'Understand how proxies work, how to intercept traffic, and the basics of Burp Suite.', 5, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42'),
(15, 2, 'Introduction to IDS/IPS', 'Comprehensive guide to Intrusion Detection and Prevention Systems.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:20'),
(16, 2, 'Vulnerability Scanning', 'Master the Vulnerability Management Lifecycle.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21'),
(17, 2, 'Web App Scanning (DAST)', 'Dynamic Application Security Testing deep dive.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21'),
(18, 2, 'Introduction to OSINT', 'Master Open Source Intelligence gathering techniques and tools.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:25:25'),
(19, 2, 'Phishing & Email Analysis', 'Learn to dissect email headers and investigate phishing attacks.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:25:25'),
(20, 2, 'Social Engineering Defense', 'Understand the human element of security and how to defend against manipulation.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:28:54'),
(21, 2, 'Virtualization & Lab Setup', 'Build your own safe hacking laboratory using Virtual Machines.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:32:26'),
(22, 3, 'SIEM Fundamentals', 'Master the \"Brain\" of the SOC: Security Information and Event Management.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:35:58'),
(23, 3, 'SIEM Use Cases', 'Practical log analysis scenarios ranging from Easy to Data Exfiltration.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:41:26'),
(24, 3, 'EDR Concepts', 'Master Endpoint Detection & Response: Telemetry, Process Trees, and Threat Hunting.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:47:08'),
(25, 3, 'Intrusion Detection', 'Learn to identify and investigate network and host-based intrusions.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:50:58'),
(26, 3, 'Malware Analysis Basics', 'Learn to safely analyze malware: Static, Dynamic, and Behavioral techniques.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:55:56'),
(27, 3, 'Incident Response Framework', 'Master the structured approach to handling security incidents.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(28, 3, 'Digital Forensics Intro', 'Learn the fundamentals of collecting and analyzing digital evidence.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(29, 3, 'Network Traffic Analysis', 'Learn to capture and analyze network packets for threat detection.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(30, 3, 'Threat Hunting Basics', 'Proactively search for threats before they cause damage.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(31, 3, 'MITRE ATT&CK Framework', 'Understand the knowledge base of adversary tactics and techniques.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(32, 3, 'Cloud Security Basics', 'Understand security challenges and controls in cloud environments.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(33, 3, 'Security Automation', 'Learn to automate security tasks using SOAR and scripting.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(34, 3, 'Reporting & Documentation', 'Master the art of documenting investigations and writing reports.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(36, 4, 'Advanced SIEM', 'Deep dive into SIEM engineering: Query optimization, custom parsers, and correlation logic.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:16:31'),
(37, 4, 'Memory Forensics', 'Analyze volatile memory to uncover malware, rootkits, and attacker artifacts.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:18:03'),
(38, 4, 'Malware Reverse Engineering', 'Disassemble and analyze malicious code to understand its behavior.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:19:34'),
(39, 4, 'Advanced Threat Intelligence', 'Operationalize threat intel: Collection, analysis, dissemination, and integration.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:21:00'),
(40, 4, 'Red vs Blue Team Dynamics', 'Purple teaming: Collaboration between offensive and defensive security.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:22:23'),
(41, 4, 'Purple Teaming Exercises', 'Hands-on exercises combining offensive execution with defensive detection.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:26:00'),
(42, 4, 'Container Security', 'Secure Docker, Kubernetes, and container orchestration environments.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:27:22'),
(43, 4, 'Zero Trust Architecture', 'Never trust, always verify: Implementing zero trust principles.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:28:42'),
(44, 4, 'Compliance & Frameworks', 'Navigate security compliance: NIST, ISO, SOC 2, PCI-DSS, and HIPAA.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:30:07'),
(49, 9, 'EDR Investigations', 'Learn about EDR Investigations', 0, 1, NULL, 1, '2025-12-26 17:59:30', '2025-12-26 17:59:30'),
(51, 9, 'SIEM Log Analysis', 'Learn about SIEM Log Analysis', 0, 3, NULL, 1, '2025-12-26 17:59:30', '2025-12-26 17:59:30'),
(52, 9, 'Email Security & Phishing', 'Learn about Email Security & Phishing', 0, 4, NULL, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31'),
(53, 9, 'Vulnerability Management', 'Learn about Vulnerability Management', 0, 5, NULL, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31'),
(117, 6, 'CTI Fundamentals', 'Foundations of Cyber Threat Intelligence: The Intelligence Cycle, Types of Intel, and Pyramid of Value.', 3, 1, NULL, 1, '2025-12-29 13:30:44', '2025-12-29 13:30:44'),
(118, 6, 'OSINT Techniques', 'Open Source Intelligence: Gathering data from public sources using passive reconnaissance.', 4, 2, NULL, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(119, 6, 'Malware Analysis', 'Understand malware behavior, static vs dynamic analysis, and sandboxing.', 4, 3, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(120, 6, 'Indicators & Standards', 'IOCs, IOAs, TLP, and STIX/TAXII standards.', 3, 4, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(121, 6, 'MITRE ATT&CK', 'Master the framework.', 4, 5, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(122, 6, 'Threat Hunting', 'Proactive search for threats. Stacking, Clustering, and Hypothesis driven hunting.', 4, 6, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(123, 6, 'Intelligence Platforms', 'Using MISP and OpenCTI.', 5, 7, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(124, 6, 'Reporting & Dissemination', 'Writing effective reports for different audiences.', 2, 8, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(125, 11, 'Module 1: Introduction to DFIR', 'Understand the core concepts of Digital Forensics and the Incident Response lifecycle.', 0, 1, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(126, 11, 'Module 2: Evidence Acquisition & Handling', 'Learn how to properly secure, collect, and preserve digital evidence without destroying it.', 0, 2, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(127, 11, 'Module 3: Windows Forensics', 'Dive deep into the Windows Operating System to uncover attacker activity using the Registry, Event Logs, and system artifacts.', 0, 3, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(128, 11, 'Module 4: Memory Forensics (Volatility)', 'Learn how to extract hidden malware, running processes, and network connections from a captured RAM image.', 0, 4, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(129, 11, 'Module 5: Network Forensics (PCAP Analysis)', 'Learn how to analyze packet captures (PCAPs) using Wireshark and Tshark to trace attacker movements and extract stolen data.', 0, 5, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(130, 11, 'Module 6: Incident Response Methodology (PICERL)', 'Learn the standard active response framework used by defense teams to combat live attackers on the network.', 0, 6, NULL, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54'),
(131, 12, 'Module 1: TCP/IP & Protocols', 'Understand how computers communicate globally. Learn the OSI model, TCP/IP suite, and fundamental networking concepts.', 0, 1, NULL, 1, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(132, 12, 'Module 2: Traffic Analysis (Wireshark)', 'Learn how to use Wireshark to inspect packets, filter traffic, and reconstruct network events.', 0, 2, NULL, 1, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(133, 12, 'Module 3: Network Attacks (Spoofing, MITM)', 'Understand how attackers exploit network protocols to intercept data, redirect traffic, and disrupt services.', 0, 3, NULL, 1, '2026-03-09 22:28:55', '2026-03-09 22:28:55'),
(134, 12, 'Module 4: Firewalls & IDS/IPS', 'Learn how to defend networks using Firewalls, Intrusion Detection Systems, and Intrusion Prevention Systems.', 0, 4, NULL, 1, '2026-03-09 22:28:55', '2026-03-09 22:28:55');

-- --------------------------------------------------------

--
-- Table structure for table `newsletter_subscribers`
--

CREATE TABLE `newsletter_subscribers` (
  `id` int(11) NOT NULL,
  `email` varchar(255) NOT NULL,
  `subscribed_at` datetime DEFAULT current_timestamp(),
  `is_active` tinyint(1) DEFAULT 1
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `newsletter_subscribers`
--

INSERT INTO `newsletter_subscribers` (`id`, `email`, `subscribed_at`, `is_active`) VALUES
(1, 'fdmtsknsy@gmail.com', '2026-01-22 02:42:12', 1),
(2, 'derrickngugi130@gmail.com', '2026-03-14 00:51:52', 1);

-- --------------------------------------------------------

--
-- Table structure for table `notifications`
--

CREATE TABLE `notifications` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `message` text DEFAULT NULL,
  `is_read` tinyint(1) DEFAULT 0,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `operations`
--

CREATE TABLE `operations` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `apt_group` varchar(255) DEFAULT NULL,
  `description` text DEFAULT NULL,
  `story_intro` text DEFAULT NULL,
  `difficulty_level` varchar(50) DEFAULT NULL,
  `display_order` int(11) DEFAULT 0,
  `is_active` tinyint(1) DEFAULT 1,
  `is_premium` tinyint(1) DEFAULT 0,
  `passing_grade` int(11) DEFAULT 60,
  `time_limit_hours` int(11) DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `scenario_prompt` text DEFAULT NULL,
  `total_alerts` int(11) DEFAULT 0,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp(),
  `seo_title` varchar(255) DEFAULT NULL,
  `seo_description` text DEFAULT NULL,
  `slug` varchar(255) DEFAULT NULL,
  `min_level` int(11) DEFAULT 1
) ;

--
-- Dumping data for table `operations`
--

INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(1, 'Operation Iron Grid', 'Sandworm (Russian GRU)', 'Investigate a massive power outage affecting critical infrastructure. Use OT/ICS forensics to track the attacker\'s pivot from the corporate IT network into the SCADA control systems using BlackEnergy malware variants.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 5, '2025-12-31 13:08:59', NULL, NULL, 'operation-iron-grid', 1),
(2, 'Operation Silent Tsunami', 'Lazarus Group (North Korea)', 'A major decentralized finance (DeFi) platform has been drained of $600M. Trace the laundered cryptocurrency through mixer services and analyze the social engineering campaign that targeted developers with weaponized job offers.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 4, '2025-12-31 13:42:03', NULL, NULL, 'operation-silent-tsunami', 1),
(3, 'Operation Glass Serpent', 'APT41 (Barium)', 'A distinct supply chain attack compromising a popular server management software. Identify the malicious DLL injection in the signed update package and track the actor\'s dual-mission of espionage and financial theft across victim networks.\n', '', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 4, '2025-12-31 13:44:55', 'Operation Glass Serpent', 'A distinct supply chain attack compromising a popular server management software. Identify the malicious DLL injection in the signed update package and track the actor\'s dual-mission of espionage and financial theft across victim networks.\n', 'operation-glass-serpent', 1),
(4, 'Operation Phantom Ballot', 'APT28 (Fancy Bear)', 'Uncover a disinformation and spear-phishing campaign targeting political organizations ahead of a national election. Analyze leaked documents, track domain infrastructure used for credential harvesting, and identify the OAuth token abuse techniques.\n', '', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"\\\\\\\\\\\\\\\"[]\\\\\\\\\\\\\\\"\\\\\\\"\\\"\"', '', 4, '2025-12-31 15:16:16', 'Operation Phantom Ballot', 'Uncover a disinformation and spear-phishing campaign targeting political organizations ahead of a national election. Analyze leaked documents, track domain infrastructure used for credential harvesting, and identify the OAuth token abuse techniques.\n', 'operation-phantom-ballot', 1),
(5, 'Operation Black Harvest', 'Wizard Spider (Ryuk/Conti)', 'Respond to a catastrophic ransomware attack paralyzing a regional hospital network. Recover patient data from shadow copies, identify the initial access broker\'s entry point via TrickBot, and trace the lateral movement using Cobalt Strike beacons.', '', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 5, '2025-12-31 15:21:18', 'Operation Black Harvest', 'Respond to a catastrophic ransomware attack paralyzing a regional hospital network. Recover patient data from shadow copies, identify the initial access broker\'s entry point via TrickBot, and trace the lateral movement using Cobalt Strike beacons.', 'operation-black-harvest', 1),
(6, 'Operation Golden Ticket', 'Carbanak / FIN7', 'A global banking heist involving the manipulation of ATM withdrawal limits and SWIFT transaction gateways. Analyze the specialized administrative tools used by the attackers to impersonate bank clerks and authorize fraudulent transfers.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 4, '2025-12-31 15:22:51', 'Operation Golden Ticket', 'A global banking heist involving the manipulation of ATM withdrawal limits and SWIFT transaction gateways. Analyze the specialized administrative tools used by the attackers to impersonate bank clerks and authorize fraudulent transfers.\n', 'operation-golden-ticket', 1),
(7, 'Operation Desert Mirage', 'APT34 (OilRig)', 'A simulated cyber operation led by the APT34 group aimed at infiltrating a multinational energy corporation to exfiltrate sensitive geological data.', 'In this scenario, participants will defend against a targeted cyber attack by APT34, also known as OilRig. The group is known for its focus on the energy sector, and they are suspected to be backed by a nation-state. The exercise will challenge participants to identify and mitigate threats across multiple stages of an advanced persistent threat operation.', 'intermediate', 0, 1, 1, 60, NULL, '[]', '', 5, '2026-01-02 04:27:59', NULL, NULL, 'operation-desert-mirage', 1),
(8, 'Operation Silent Harvest', 'APT10 (Stone Panda)', 'This training scenario simulates a cyber attack by APT10 (Stone Panda), known for its sophisticated cyber espionage campaigns. Participants will navigate through a series of alerts representing different stages of an attack, aiming to understand and mitigate each threat effectively.', 'In recent months, there has been an increase in suspicious activities targeting a fictional multinational corporation, TechGlobal Inc. Intelligence suggests that APT10 is behind these attacks, with the intent to exfiltrate sensitive intellectual property and confidential business data. Your task is to identify and neutralize the threats as they unfold.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 5, '2026-01-02 20:23:41', NULL, NULL, 'operation-silent-harvest', 1),
(9, 'Operation Infinite Loop', 'Equation Group / Lamberts', 'Analyze a sophisticated firmware implant discovered on enterprise firewalls. This advanced persistent threat persists across reboots and OS re-installations. Conduct low-level forensic analysis of the SPI flash memory to extract the payload.', '', 'advanced', 0, 1, 1, 60, NULL, '[]', NULL, 10, '2026-01-02 20:26:53', NULL, NULL, 'operation-infinite-loop', 1),
(10, 'Operation Ocean Lotus', 'APT32 (OceanLotus)', 'A targeted watering hole attack on a human rights organization\'s website. Users are infected with a custom backdoor upon visiting the site. Analyze the obfuscated JavaScript payload and the subsequent macOS malware deployment.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"[]\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\"\\\"\"', '', 5, '2026-01-02 20:30:06', 'Operation Ocean Lotus', 'A targeted watering hole attack on a human rights organization\'s website. Users are infected with a custom backdoor upon visiting the site. Analyze the obfuscated JavaScript payload and the subsequent macOS malware deployment.\n', 'operation-ocean-lotus', 1),
(11, 'Operation Radiant Horizon', 'Hafnium (China)', 'Train in identifying and mitigating Hafnium\'s exploitation of Exchange servers using ProxyLogon and China Chopper.', 'In early 2021, organizations worldwide faced a sophisticated onslaught by Hafnium, a Chinese state-sponsored APT group. This scenario puts you in the shoes of a cyber defense team responding to a mass exploitation event targeting on-premise Exchange servers. Your mission: analyze web shell artifacts, uncover the chain of zero-day vulnerabilities used for initial access, and determine the scope of data exfiltration. This advanced training will test your skills in real-world threat detection and incident response.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Hafnium\\\\\\\",\\\\\\\"ProxyLogon\\\\\\\",\\\\\\\"China Chopper\\\\\\\",\\\\\\\"Exchange Server Exploitation\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\"]\\\"\"', '', 8, '2026-01-03 00:02:24', 'Advanced Response to Hafnium\'s Mass Exploitation of Exchange Servers', 'Train in identifying and mitigating Hafnium\'s exploitation of Exchange servers using ProxyLogon and China Chopper.', 'operation-radiant-horizon', 1),
(12, 'Operation Silent Star', 'Turla (Snake / Uroburos)', 'Investigate Turla\'s hijacking of satellite links to mask C2 locations using rootkits on diplomatic networks.', 'In a world where digital espionage knows no bounds, the notorious Turla group has taken cyber warfare to new heights. By hijacking commercial satellite internet links, they\'ve crafted an insidious method to conceal their command and control locations. As a cyber threat analyst, your mission is to dismantle this operation by tracing the hijacked downstream traffic and unearthing the sophisticated rootkit deployed within diplomatic networks. Can you unravel the layers of deception and thwart Turla\'s ambitions?', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Turla APT\\\\\\\",\\\\\\\"cyber espionage\\\\\\\",\\\\\\\"satellite hijacking\\\\\\\",\\\\\\\"network security\\\\\\\",\\\\\\\"rootkit analysis\\\\\\\"]\\\"\"', '', 5, '2026-01-03 00:36:50', 'Operation Satellite Serpent: Uncovering Turla\'s Covert Channels', 'Investigate Turla\'s hijacking of satellite links to mask C2 locations using rootkits on diplomatic networks.', 'operation-silent-star', 1),
(13, 'Operation Dragon Breath', 'APT40 (Periscope)', 'Uncover APT40\'s tactics in stealing maritime research data via compromised servers and custom malware.', 'In an unprecedented cyber breach, APT40 has targeted a naval engineering university, stealing sensitive maritime research data. Analysts must uncover how compromised web servers were used as relay points and analyze the custom malware deployed to exfiltrate proprietary sonar technology schematics. This operation requires a keen understanding of APT40\'s tactics and technical prowess to unravel their sophisticated attack chain.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT40\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"maritime data breach\\\\\\\",\\\\\\\"custom malware\\\\\\\",\\\\\\\"threat analysis\\\\\\\"]\\\"\"', '', 5, '2026-01-03 00:41:42', 'Investigating APT40\'s Maritime Data Heist', 'Uncover APT40\'s tactics in stealing maritime research data via compromised servers and custom malware.', 'operation-dragon-breath', 1),
(14, 'Operation Wasted Locker', 'Evil Corp (Indrik Spider)', 'Engage in simulated ransomware negotiation and decryption against Evil Corp in this advanced cybersecurity training scenario.', 'In a high-stakes cybersecurity operation, a Fortune 500 company falls victim to a sophisticated ransomware attack by the notorious APT group, Evil Corp. As the company\'s data is held hostage, your team is tasked with negotiating with the attackers while simultaneously reverse-engineering the malware to identify a vulnerability in its encryption. The initial infection vector is traced back to a cunning drive-by download, demonstrating Evil Corp\'s technical prowess. Can you outsmart the attackers, recover the data, and trace the attack back to its source?', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Evil Corp\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"malware analysis\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 7, '2026-01-03 00:49:14', 'Evil Corp Ransomware Negotiation and Decryption Challenge', 'Engage in simulated ransomware negotiation and decryption against Evil Corp in this advanced cybersecurity training scenario.', 'operation-wasted-locker', 1),
(15, 'Operation Soft Cell', 'Gallium (Soft Cell)', 'Beginner-level scenario to detect and remediate Gallium APT\'s long-term intrusion in telecoms capturing call records.', 'In this training scenario, participants will dive into the covert world of cyber espionage as they work to uncover and disrupt Gallium APT\'s intrusion into global telecommunications networks. The attackers are meticulously capturing Call Detail Records of high-value targets, using stealthy web shells and \'living off the land\' tactics to remain undetected. Trainees will learn to identify these threats and employ effective remediation strategies.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Gallium APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"telecommunications security\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"web shell detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cyber threat intelligence\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"call detail record\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-03 00:53:35', 'Gallium APT: Telecom Intrusion Detection Training', 'Beginner-level scenario to detect and remediate Gallium APT\'s long-term intrusion in telecoms capturing call records.', 'operation-soft-cell', 1),
(16, 'Operation Rabid Dog', 'MuddyWater (Static Kitten)', 'Uncover and mitigate MuddyWater\'s destructive wiper attack disguised as ransomware against a government agency.', 'In the heart of a bustling government agency, a seemingly routine email arrives, carrying a sinister payload. The notorious APT group MuddyWater, known for their cunning tactics, has launched a deceptive wiper attack, masquerading as ransomware. The operation requires the team to dissect the macro-enabled document that serves as the initial vector, analyze the embedded \'POWERSTATS\' backdoor, and extract critical forensic artifacts before the destructive wiping logic can execute. The race against the clock is on, as every second counts in preventing irreversible damage.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"MuddyWater\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"wiper attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 10, '2026-01-03 23:50:48', 'MuddyWater\'s Deceptive Wiper Attack on Government Infrastructure', 'Uncover and mitigate MuddyWater\'s destructive wiper attack disguised as ransomware against a government agency.', 'operation-rabid-dog', 1),
(17, 'Operation Horizon', 'APT1 ', 'Engage in a beginner-friendly cyber operation simulation featuring APT1\'s well-known tactics and techniques.', 'In this training scenario, participants will dive into a simulated cyber espionage operation orchestrated by the notorious APT1 group. Known for its sophisticated attacks and persistence, APT1 has launched a new campaign targeting a fictional global manufacturing company. Trainees will navigate through realistic alerts to identify and mitigate threats, gaining insights into APT1\'s tactics, techniques, and procedures (TTPs) as they progress through the attack lifecycle.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT1 operation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"beginner cyber scenario\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"threat intelligence\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cyber espionage\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 00:58:38', 'APT1 Cyber Espionage Scenario: Beginner\'s Threat Simulation', 'Engage in a beginner-friendly cyber operation simulation featuring APT1\'s well-known tactics and techniques.', 'operation-horizon', 1),
(18, 'Operation Gothic Panda', 'APT3 (Gothic Panda)', 'Train to counter APT3\'s sophisticated cyberattack, simulating their known TTPs in a realistic, intermediate-level scenario.', 'In this scenario, your organization is targeted by APT3, also known as Gothic Panda, a notorious cyber espionage group. Known for their sophisticated techniques and extensive resource access, APT3 has set its sights on exfiltrating your company\'s sensitive data. Your mission is to navigate through a series of alerts, utilizing threat intelligence and defensive strategies to thwart their multi-stage infiltration attempt.', 'Intermediate', 0, 1, 1, 60, NULL, '\"[]\"', '', 5, '2026-01-04 02:06:57', 'Defend Against Gothic Panda\'s Multi-Stage Infiltration', 'Train to counter APT3\'s sophisticated cyberattack, simulating their known TTPs in a realistic, intermediate-level scenario.', 'operation-gothic-panda', 1),
(19, 'Operation Red Apollo', 'APT10 (MenuPass)', 'Explore APT10\'s DLL side-loading techniques in a complex aerospace sector espionage campaign.', 'In the ever-evolving landscape of cyber threats, APT10, also known as MenuPass, has launched a sophisticated espionage campaign targeting the aerospace industry. Leveraging DLL side-loading techniques, the threat actors aim to infiltrate, persist, and exfiltrate critical intellectual property, including large CAD files, to gain a competitive edge in aerospace technology.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"APT10\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DLL Side-Loading\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Aerospace Espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Intellectual Property Theft\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 7, '2026-01-04 02:13:24', 'APT10\'s Aerospace Espionage - DLL Side-Loading Tactics', 'Explore APT10\'s DLL side-loading techniques in a complex aerospace sector espionage campaign.', 'operation-red-apollo', 1),
(20, 'Operation Whitefly', 'Whitefly (Singapore-based?)', 'Investigate Whitefly APT\'s breach using Vcrodat malware in the healthcare sector, focusing on persistence and compromised open-source tools.', 'In this advanced scenario, analysts are tasked with investigating a sophisticated breach within the healthcare and materials science sectors. The notorious Whitefly APT group has employed their custom Vcrodat malware to maintain persistence while cleverly blending their malicious activities with legitimate developer behaviors by compromising open-source tools. Participants will need to piece together clues from multiple alerts to unravel the attackers\' tactics, techniques, and procedures.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Whitefly APT\\\\\\\",\\\\\\\"Vcrodat malware\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"healthcare breach\\\\\\\",\\\\\\\"open-source compromise\\\\\\\"]\\\"\"', '', 7, '2026-01-04 02:14:54', 'Advanced Breach Investigation: Whitefly APT in Healthcare', 'Investigate Whitefly APT\'s breach using Vcrodat malware in the healthcare sector, focusing on persistence and compromised open-source tools.', 'operation-whitefly', 1),
(21, 'Operation Silent Shield', 'Kimsuky (Velvet Chollima)', 'Explore Kimsuky\'s use of malicious browser extensions and BabyShark malware in a targeted spear-phishing campaign.', 'In a rapidly evolving cyber landscape, the global think tank specializing in nuclear policy finds itself under siege. The notorious APT group Kimsuky, known for its advanced tactics, has launched a spear-phishing campaign employing malicious browser extensions and the insidious BabyShark malware. As a beginner analyst, your mission is to unravel the layers of this attack, tracing each step from initial access to data exfiltration, and fortifying defenses against future threats.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Kimsuky APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"spear-phishing\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"BabyShark malware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"nuclear policy\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 02:18:07', 'Kimsuky Spear-Phishing Tactics Against Nuclear Policy Think Tanks', 'Explore Kimsuky\'s use of malicious browser extensions and BabyShark malware in a targeted spear-phishing campaign.', 'operation-silent-shield', 1),
(22, 'Operation Double Dragon', 'APT41 (Double Dragon)', 'Investigate APT41\'s dual-mode operation targeting gaming source code and PII for espionage.', 'In this advanced training scenario, participants will track APT41, a notorious cyber threat actor known for conducting both state-sponsored espionage and financially-motivated attacks. The operation begins with the theft of strategic game source code for profit and pivots to a more sinister goal: accessing databases containing citizens\' PII. As they unravel this complex operation, participants will navigate through sophisticated supply chain attacks and lateral movements emblematic of APT41\'s tactics, techniques, and procedures.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"APT41\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cyber Espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Gaming Industry\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Supply Chain Attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"PII Theft\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 02:21:13', 'APT41: Dual-Mode Cyber Operation Training', 'Investigate APT41\'s dual-mode operation targeting gaming source code and PII for espionage.', 'operation-double-dragon', 1),
(23, 'Operation Red Echo', 'APT41 / RedEcho', 'Engage with APT41 tactics in Operation Red Echo, a realistic cyber defense scenario for intermediate analysts.', 'In this immersive training scenario, participants are tasked with defending a fictional telecom company under siege by the notorious APT41, known as RedEcho. This advanced persistent threat group, originating from China, has launched a multi-vector attack, leveraging their expertise in supply chain compromises and ransomware to infiltrate the company\'s network. Your mission is to detect, analyze, and mitigate the threats as they unfold in a five-step attack sequence. Can you thwart RedEcho\'s espionage and financial motives before critical data is exfiltrated?', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT41\\\\\\\",\\\\\\\"RedEcho\\\\\\\",\\\\\\\"Cyber Defense Training\\\\\\\",\\\\\\\"Intermediate Cybersecurity\\\\\\\",\\\\\\\"Supply Chain Attack\\\\\\\"]\\\"\"', '', 5, '2026-01-04 04:11:04', 'Operation Red Echo: Intermediate Cyber Defense Training', 'Engage with APT41 tactics in Operation Red Echo, a realistic cyber defense scenario for intermediate analysts.', 'operation-red-echo', 1),
(24, 'Operation Pipeline Shut', 'DarkSide', 'Learn to defend against DarkSide with this beginner operation: Pipeline Shut, designed for cybersecurity training.', 'In the wake of increasing cyber threats, DarkSide has targeted a major energy pipeline. As part of the security team, you must identify and mitigate their efforts. This operation will take you through the critical stages of an attack, from initial access to data exfiltration.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"DarkSide\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"pipeline security\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"beginner threat detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:13:17', 'Operation Pipeline Shut: Training Scenario Against DarkSide', 'Learn to defend against DarkSide with this beginner operation: Pipeline Shut, designed for cybersecurity training.', 'operation-pipeline-shut', 1),
(25, 'Operation Kinetic Strike', 'REvil (Sodinokibi)', 'Intermediate cybersecurity operation simulating REvil\'s tactics for effective threat response training.', 'In the wake of escalating ransomware attacks, Operation Kinetic Strike challenges your cybersecurity team to defend against REvil, a notorious APT group. Your mission is to detect and mitigate their attack as they compromise a fictional corporation\'s network. Stay vigilant as REvil employs sophisticated techniques in a bid to encrypt sensitive data and demand a hefty ransom.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"REvil Ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT Group Simulation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Threat Detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Ransomware Defense\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:24:42', 'Operation Kinetic Strike: REvil Ransomware Simulation', 'Intermediate cybersecurity operation simulating REvil\'s tactics for effective threat response training.', 'operation-kinetic-strike', 1),
(26, 'Operation File Transfer', 'Cl0p (TA505)', 'Engage in an advanced simulation against Cl0p (TA505), focusing on their sophisticated file transfer tactics.', 'In the midst of a bustling financial quarter, your organization receives a tip-off about Cl0p (TA505) targeting your infrastructure. This notorious APT group is known for their adeptness in exploiting network vulnerabilities for massive data exfiltration. As part of the cybersecurity team, you must thwart their Operation File Transfer before critical data falls into the wrong hands.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Cl0p APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"advanced threat simulation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"file transfer security\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:37:17', 'Operation File Transfer: Cl0p\'s Advanced Tactics', 'Engage in an advanced simulation against Cl0p (TA505), focusing on their sophisticated file transfer tactics.', 'operation-file-transfer', 1),
(27, 'Operation Midnight Storm', 'Nobelium (Midnight Blizzard)', 'Train on detecting and mitigating Nobelium\'s cloud-based identity attacks targeting diplomatic entities.', 'In a world of escalating cyber threats, a new wave of attacks has emerged, targeting diplomatic entities through sophisticated cloud identity compromises. Nobelium, the notorious APT group linked to Russia\'s SVR, has launched a campaign using advanced techniques like password spraying and token theft to bypass MFA. Your mission is to investigate these breaches, uncover rogue OAuth applications, and secure the compromised systems.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Nobelium\\\",\\\"cloud security\\\",\\\"identity compromise\\\",\\\"APT29\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-04 23:54:35', 'Nobelium Cloud Identity Compromise Simulation', 'Train on detecting and mitigating Nobelium\'s cloud-based identity attacks targeting diplomatic entities.', 'operation-midnight-storm', 1),
(28, 'Operation Volt Strike', 'Volt Typhoon', 'Train to detect Volt Typhoon\'s stealthy living off the land tactics using built-in Windows tools in critical infrastructure.', 'In the world of cyber espionage, stealth is paramount. Volt Typhoon, a notorious APT group, has launched a covert operation targeting critical infrastructure sectors. Their modus operandi: blending in with legitimate administrative activity using only native Windows tools. As a cybersecurity analyst, your mission is to uncover this clandestine campaign, piecing together subtle clues that reveal their presence. Can you follow the trail and mitigate the threat before it\'s too late?', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Volt Typhoon\\\",\\\"cybersecurity training\\\",\\\"LOLBins\\\",\\\"critical infrastructure\\\",\\\"advanced threat detection\\\"]\"', '', 5, '2026-01-04 23:56:24', 'Advanced Detection of LOLBins in Critical Infrastructure by Volt Typhoon', 'Train to detect Volt Typhoon\'s stealthy living off the land tactics using built-in Windows tools in critical infrastructure.', 'operation-volt-strike', 1),
(29, 'Operation Charming Charter', 'Charming Kitten (Phosphorus)', 'Analyze Charming Kitten\'s social engineering campaign targeting journalists via WhatsApp and email using DownPaper backdoor.', 'In recent months, the notorious APT group Charming Kitten has intensified its operations, targeting journalists and human rights activists. Using social engineering tactics via WhatsApp and email, they aim to infiltrate networks and extract sensitive information. This operation focuses on analyzing the DownPaper backdoor and the credential harvesting tactics disguised as legitimate interview requests.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Charming Kitten\\\\\\\",\\\\\\\"social engineering\\\\\\\",\\\\\\\"DownPaper\\\\\\\",\\\\\\\"credential harvesting\\\\\\\"]\\\"\"', '', 5, '2026-01-04 23:58:37', 'Charming Kitten Social Engineering and DownPaper Analysis', 'Analyze Charming Kitten\'s social engineering campaign targeting journalists via WhatsApp and email using DownPaper backdoor.', 'operation-charming-charter', 1),
(30, 'Operation Fox Hunt', 'Fox Kitten', 'Experience Fox Kitten\'s APT exploitation of VPN concentrators to infiltrate and compromise domain controllers.', 'In this scenario, the notorious Fox Kitten APT group targets unpatched VPN concentrators, swiftly penetrating corporate networks. Once inside, they rapidly deploy web shells and move laterally to compromise the domain controller, dumping critical credentials and paving the way for further exploitation. Participants must identify and neutralize the threat to protect sensitive enterprise environments.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Fox Kitten\\\\\\\",\\\\\\\"VPN Exploit\\\\\\\",\\\\\\\"Domain Controller\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\",\\\\\\\"APT\\\\\\\"]\\\"\"', '', 7, '2026-01-05 00:00:59', 'Fox Kitten\'s VPN Exploit and Domain Controller Breach', 'Experience Fox Kitten\'s APT exploitation of VPN concentrators to infiltrate and compromise domain controllers.', 'operation-fox-hunt', 1),
(33, 'Operation Swipe Left', 'FIN6', 'Investigate a breach by FIN6 using Trinity malware to scrape credit card data from a retail giant\'s POS network.', 'In this intermediate-level training scenario, participants will dive into a high-stakes breach investigation involving the notorious cybercrime group FIN6. The group has infiltrated a leading retail company\'s Point-of-Sale (POS) network using compromised vendor credentials. Their goal? To deploy the insidious \'Trinity\' malware, designed to scrape sensitive credit card data directly from RAM before it can be encrypted. As the investigation unfolds, you must trace their steps through the network, piece together the attack sequence, and mitigate the damage.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"FIN6\\\",\\\"Trinity malware\\\",\\\"POS network breach\\\",\\\"cybersecurity training\\\",\\\"credit card data\\\"]\"', '', 5, '2026-01-05 00:09:23', 'FIN6 Breach Simulation: Uncovering Trinity Malware in Retail POS Network', 'Investigate a breach by FIN6 using Trinity malware to scrape credit card data from a retail giant\'s POS network.', 'operation-swipe-left', 1),
(32, 'Operation Cart Skimmer', 'Magecart (Group 12)', 'Experience an intermediate-level Magecart attack scenario with digital skimming and data exfiltration analysis.', 'In this scenario, participants are tasked with analyzing a sophisticated digital skimming attack orchestrated by Magecart Group 12. The attack targets the checkout pages of numerous online stores through a compromised third-party advertising library. Participants will uncover obfuscated JavaScript code and trace the exfiltrated data to an external drop server, simulating real-world cybersecurity challenges.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Magecart\\\",\\\"digital skimming\\\",\\\"cybersecurity training\\\",\\\"JavaScript analysis\\\",\\\"data exfiltration\\\"]\"', '', 3, '2026-01-05 00:06:31', 'Magecart Digital Skimming Attack Simulation', 'Experience an intermediate-level Magecart attack scenario with digital skimming and data exfiltration analysis.', 'operation-cart-skimmer', 1),
(34, 'Operation Primitive Bear', 'Gamaredon (Shuckworm)', 'Simulate a Gamaredon cyber-espionage campaign targeting military personnel with weaponized Word documents and VBScript backdoors.', 'In this training scenario, participants will navigate a simulated cyber-espionage campaign orchestrated by the notorious APT group, Gamaredon, also known as Shuckworm. The operation centers around a high-volume attack targeting military personnel using weaponized Word documents. Trainees will delve into how these documents leverage template injection techniques and incorporate custom VBScript backdoors to facilitate rapid data theft. This exercise will enhance understanding of how such threats manifest in real-world scenarios and prepare analysts to identify and mitigate similar threats.', 'beginner', 0, 1, 0, 60, NULL, '\"[\\\"Gamaredon\\\",\\\"cyber-espionage\\\",\\\"Word document injection\\\",\\\"VBScript backdoor\\\",\\\"military cybersecurity\\\"]\"', '', 3, '2026-01-05 02:58:53', 'Gamaredon Espionage Simulation: Weaponized Word Docs & VBScript Backdoors', 'Simulate a Gamaredon cyber-espionage campaign targeting military personnel with weaponized Word documents and VBScript backdoors.', 'operation-primitive-bear', 1),
(35, 'Operation Energy Bear', 'Dragonfly (Energetic Bear)', 'Simulate Dragonfly\'s strategic intrusion in the energy sector using trojanized ICS software updates.', 'In this scenario, the notorious Dragonfly APT group, also known as Energetic Bear, targets the energy sector by infiltrating the supply chain. The attackers have trojanized legitimate software updates for industrial control systems (ICS) equipment. This operation will train participants to identify the \'Havex\' RAT and trace the network reconnaissance activities within an industrial control network, enhancing their skills in defending critical infrastructure.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Dragonfly APT\\\\\\\",\\\\\\\"ICS security\\\\\\\",\\\\\\\"Havex RAT\\\\\\\",\\\\\\\"cyber threat intelligence\\\\\\\",\\\\\\\"supply chain attack\\\\\\\"]\\\"\"', '', 5, '2026-01-05 03:01:44', 'Dragonfly\'s ICS Supply Chain Attack Simulation', 'Simulate Dragonfly\'s strategic intrusion in the energy sector using trojanized ICS software updates.', 'operation-energy-bear', 1),
(36, 'Operation Hotel Guest', 'DarkHotel', 'Advanced scenario: DarkHotel targets luxury hotel executives via Wi-Fi, delivering Tapaoux malware disguised as updates.', 'In a high-stakes cyber operation, the notorious APT group DarkHotel has launched a precision spear-phishing campaign targeting executives staying at luxury hotels. Leveraging the hotel\'s Wi-Fi network, they deliver sophisticated, signed malware disguised as software updates. Trainees will analyze the Tapaoux malware and investigate certificate spoofing tactics used by the attackers to compromise their high-profile targets.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"DarkHotel\\\\\\\",\\\\\\\"spear-phishing\\\\\\\",\\\\\\\"Tapaoux malware\\\\\\\",\\\\\\\"certificate spoofing\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\"]\\\"\"', '', 5, '2026-01-05 03:03:57', 'DarkHotel Spear-Phishing Attack on Luxury Hotel Executives', 'Advanced scenario: DarkHotel targets luxury hotel executives via Wi-Fi, delivering Tapaoux malware disguised as updates.', 'operation-hotel-guest', 1),
(37, 'Operation Sea Lotus', 'Naikon', 'Investigate Naikon\'s espionage using RoyalRoad and Aria-body in a South China Sea cyber operation.', 'In the geopolitical hotspot of the South China Sea, a sophisticated threat actor, Naikon, has launched a stealthy cyber espionage campaign. Using the RoyalRoad RTF weaponizer, they deliver the Aria-body backdoor, gaining access to sensitive information. This operation requires you to meticulously analyze alerts, trace the attack path, and uncover the command and control infrastructure disguised as legitimate government domains. Your mission is to dismantle this campaign and safeguard regional cybersecurity.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Naikon APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"RoyalRoad exploit\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Aria-body backdoor\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Espionage campaign\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity training\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-05 03:07:33', 'South China Sea Espionage: Uncovering Naikon\'s RoyalRoad Exploit', 'Investigate Naikon\'s espionage using RoyalRoad and Aria-body in a South China Sea cyber operation.', 'operation-sea-lotus', 1),
(39, 'Operation Ghost Writer', 'UNC1151', 'Train on UNC1151\'s tactics in hacking news sites to spread misinformation, from CMS breaches to social media manipulation.', 'In this training scenario, participants will dive into the world of cyber-influence operations orchestrated by UNC1151. This APT group has targeted popular news websites, compromising their CMS accounts to publish false narratives. As the fabricated stories spread, a coordinated effort on social media amplifies the misinformation, challenging trainees to trace the attack and mitigate its impact.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"UNC1151\\\",\\\"cyber-influence\\\",\\\"APT training\\\",\\\"media manipulation\\\",\\\"CMS hacking\\\"]\"', '', 5, '2026-01-05 03:21:54', 'UNC1151\'s Media Manipulation: A Cyber-Influence Training Scenario', 'Train on UNC1151\'s tactics in hacking news sites to spread misinformation, from CMS breaches to social media manipulation.', 'operation-ghost-writer', 1),
(40, 'Operation Wicked Game', 'APT41 (Wicked Panda)', 'Experience an advanced simulation of APT41\'s supply chain attack on the gaming industry, featuring the ShadowPad payload.', 'In this high-stakes training scenario, participants will delve into a sophisticated supply chain attack orchestrated by APT41, a notorious cyber threat group from China. The operation focuses on the gaming industry, where attackers have infiltrated the build environment of a popular game to inject a malicious backdoor, known as ShadowPad, into the game\'s executable. This backdoor is then distributed to millions of unsuspecting players, setting the stage for a widespread cybersecurity breach. Trainees must navigate through a series of alerts to uncover the full scope of the attack and neutralize the threat.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Supply Chain Attack\\\",\\\"APT41\\\",\\\"ShadowPad\\\",\\\"Cybersecurity Training\\\",\\\"Gaming Industry\\\"]\"', '', 5, '2026-01-05 03:25:53', 'Advanced Supply Chain Attack Simulation with APT41', 'Experience an advanced simulation of APT41\'s supply chain attack on the gaming industry, featuring the ShadowPad payload.', 'operation-wicked-game', 1),
(41, 'Operation Heavy Anchor', 'Lazarus (Andariel)', 'Advanced training scenario exploring Lazarus Group\'s cyber-attack on South Korean defense firms to steal sensitive tank and laser weapon designs.', 'In a high-stakes cyber espionage campaign, the notorious Lazarus Group, specifically its Andariel sub-group, has set its sights on the South Korean defense industrial base. Their objective: to infiltrate and exfiltrate sensitive schematics of cutting-edge tank and laser weaponry. Utilizing their signature DTrack malware, the attackers employ a sophisticated kill chain to breach defenses, maintain persistence, and ultimately achieve their goal of intelligence theft.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"DTrack malware\\\\\\\",\\\\\\\"cyber espionage\\\\\\\",\\\\\\\"defense industrial base\\\\\\\",\\\\\\\"APT\\\\\\\"]\\\"\"', '', 5, '2026-01-05 04:00:31', 'Operation Stealth Blueprint: Lazarus Group Targeting Defense Secrets', 'Advanced training scenario exploring Lazarus Group\'s cyber-attack on South Korean defense firms to steal sensitive tank and laser weapon designs.', 'operation-heavy-anchor', 1),
(42, 'Operation Kitty Corner', 'CopyKittens', 'Train to counter CopyKittens\' Matryoshka RAT targeting foreign affairs via DNS tunneling.', 'In this scenario, participants will engage in a simulated espionage campaign orchestrated by the notorious APT group, CopyKittens. The group has set its sights on Ministries of Foreign Affairs, deploying their infamous \'Matryoshka\' RAT to infiltrate and exfiltrate sensitive governmental documents. Participants must decode encrypted DNS traffic to thwart the attackers and secure critical intelligence.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"CopyKittens\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Matryoshka RAT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DNS tunneling\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-05 04:02:16', 'Operation Matryoshka: CopyKittens Espionage Drill', 'Train to counter CopyKittens\' Matryoshka RAT targeting foreign affairs via DNS tunneling.', 'operation-kitty-corner', 1),
(43, 'Operation Rocket Man', 'Rocket Kitten', 'Simulate and analyze Rocket Kitten\'s tactics targeting aerospace firms using \'Gholee\' malware and fake personas.', 'In a world where every byte of data can shape destinies, Rocket Kitten, a notorious APT group, sets its sights on the aerospace industry. Utilizing their infamous \'Gholee\' malware and deceptive social engineering via fake Facebook profiles, they embark on a mission to infiltrate, persist, and exfiltrate critical data. Trainees, prepare to navigate through a web of deceit and cybersecurity challenges.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Rocket Kitten\\\",\\\"Gholee malware\\\",\\\"cybersecurity training\\\",\\\"APT simulation\\\",\\\"aerospace security\\\"]\"', '', 6, '2026-01-06 01:22:55', 'Rocket Kitten\'s Aerospace Intrusion Simulation', 'Simulate and analyze Rocket Kitten\'s tactics targeting aerospace firms using \'Gholee\' malware and fake personas.', 'operation-rocket-man', 1),
(44, 'Operation Jolly Roger', 'Lazarus (WannaCry)', 'Engage in an advanced cybersecurity scenario analyzing the SMB propagation of WannaCry via EternalBlue.', 'In May 2017, the world witnessed a massive ransomware outbreak known as WannaCry, orchestrated by the notorious Lazarus APT group. Exploiting the EternalBlue vulnerability in Microsoft SMB protocol, the ransomware spread rapidly, causing widespread panic and disruption. As a senior cyber threat intelligence analyst, your mission is to dissect this attack, understanding its propagation mechanics, identifying potential kill-switch domains, and determining if decryption is possible without succumbing to ransom demands.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"WannaCry\\\\\\\",\\\\\\\"EternalBlue\\\\\\\",\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"Ransomware\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\"]\\\"\"', '', 8, '2026-01-06 01:32:21', 'Global Ransomware Outbreak Simulation: Analyzing EternalBlue and WannaCry', 'Engage in an advanced cybersecurity scenario analyzing the SMB propagation of WannaCry via EternalBlue.', 'operation-jolly-roger', 1),
(45, 'Operation Blackout', 'Sandworm (NotPetya)', 'Train to identify Sandworm\'s wiper attack masquerading as ransomware via compromised software updates.', 'In this beginner-level training scenario, you\'ll confront a cyber attack orchestrated by the notorious Sandworm group. Disguised as ransomware, the attack spreads through a compromised update of an accounting software, aiming to destroy data and disrupt operations. Participants will learn to identify the master boot record (MBR) overwriting behavior and the use of Mimikatz to harvest credentials, facilitating rapid lateral movement across networks.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sandworm\\\\\\\",\\\\\\\"wiper attack\\\\\\\",\\\\\\\"NotPetya\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"ransomware disguise\\\\\\\"]\\\"\"', '', 5, '2026-01-06 01:35:52', 'Sandworm\'s Ransomware Disguise: MBR Wiper Attack', 'Train to identify Sandworm\'s wiper attack masquerading as ransomware via compromised software updates.', 'operation-blackout', 1),
(46, 'Operation Bad Rabbit', 'Callisto Group? (Unattributed)', 'Investigate Callisto Group\'s ransomware drive-by download attack using fake Adobe Flash updates and analyze the DiskCryptor ransomware code.', 'In a rapidly evolving digital landscape, the Callisto Group has launched a sophisticated ransomware campaign. Utilizing compromised news sites as a vector, unsuspecting users are lured into downloading fake Adobe Flash updates. Once executed, the payload encrypts the victim\'s hard drive using DiskCryptor and propagates through networks via SMB, demanding a hefty ransom. This scenario will take participants through a realistic threat investigation to dissect the attack\'s stages.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"drive-by download\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DiskCryptor\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-06 01:38:27', 'Analyzing Callisto Group\'s Ransomware via Fake Adobe Updates', 'Investigate Callisto Group\'s ransomware drive-by download attack using fake Adobe Flash updates and analyze the DiskCryptor ransomware code.', 'operation-bad-rabbit', 1),
(47, 'Operation False Flag', 'Sandworm (Olympic Destroyer)', 'Investigate a Sandworm cyberattack disrupting a major sporting event, uncovering false flags and true attribution.', 'As the world gathers to witness the grandeur of a major sporting event\'s opening ceremony, chaos ensues as an unexpected cyberattack disrupts the celebration. The attack, attributed to the notorious Sandworm group, carries false flags pointing towards other nations. Participants will deconstruct the malware to trace its true origins, drawing parallels to Sandworm\'s previous operations. This exercise will test your skills in attribution and understanding of advanced persistent threats.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sandworm\\\\\\\",\\\\\\\"Olympic Destroyer\\\\\\\",\\\\\\\"cyberattack\\\\\\\",\\\\\\\"malware analysis\\\\\\\",\\\\\\\"APT Group\\\\\\\"]\\\"\"', '', 5, '2026-01-06 01:43:17', 'Sandworm Cyberattack: Unveiling the Olympic Ceremony Disruption', 'Investigate a Sandworm cyberattack disrupting a major sporting event, uncovering false flags and true attribution.', 'operation-false-flag', 1),
(48, 'Operation Shadow Hammer', 'Barium (Winnti)', 'Investigate a sophisticated supply chain attack that compromised the ASUS Live Update utility, targeting specific MAC addresses.', 'In an unprecedented cyber offensive, APT41, also known as Barium, launched a surgical strike within a mass infection by compromising the ASUS Live Update utility. This operation, dubbed \'Shadow Strike\', saw the deployment of malware targeting specific MAC addresses, revealing a calculated and highly selective attack amidst a sea of potential victims. Trainees must navigate through this complex landscape to uncover the true objectives and mitigate the threats posed by this advanced persistent threat group.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Supply Chain Attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT41\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"ASUS Live Update\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Barium\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 8, '2026-01-06 02:34:49', 'Operation Shadow Strike: The ASUS Supply Chain Breach', 'Investigate a sophisticated supply chain attack that compromised the ASUS Live Update utility, targeting specific MAC addresses.', 'operation-shadow-hammer', 1),
(49, 'Operation Cloud Atlas', 'Inception', 'Train on detecting Inception APT\'s Cloud Atlas malware targeting Eastern European diplomats.', 'In the heart of Eastern Europe, diplomatic entities face a sophisticated threat. The Inception APT group, known for its high-level espionage capabilities, launches a campaign using the elusive Cloud Atlas malware. Leveraging popular cloud storage services, they aim to infiltrate and extract sensitive information while evading detection. As a cybersecurity analyst, you are tasked with unraveling their tactics and protecting critical diplomatic communications.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"cybersecurity training\\\",\\\"APT Inception\\\",\\\"Cloud Atlas malware\\\",\\\"espionage campaign\\\",\\\"Eastern Europe\\\"]\"', '', 3, '2026-01-07 22:28:11', 'Inception APT: Espionage in Eastern Europe', 'Train on detecting Inception APT\'s Cloud Atlas malware targeting Eastern European diplomats.', 'operation-cloud-atlas', 1),
(50, 'Operation Red October', 'Rocra', 'Analyze Rocra\'s malware in a cyber-espionage campaign targeting diplomatic and research sectors.', 'In the shadows of international diplomacy and scientific innovation, a silent threat emerges. Rocra, an advanced persistent threat group, launches a massive cyber-espionage campaign targeting diplomatic, governmental, and scientific research organizations. The objective: to pilfer sensitive, encrypted information and recover deleted data from unsuspecting victims\' USB drives. Trainees must navigate this intricate operation, uncover the Rocra malware framework, and counteract its espionage tactics.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Rocra\\\",\\\"cyber-espionage\\\",\\\"APT\\\",\\\"malware analysis\\\",\\\"data exfiltration\\\"]\"', '', 5, '2026-01-07 22:28:37', 'Operation Red October: Unveiling Rocra\'s Cyber-Espionage Tactics', 'Analyze Rocra\'s malware in a cyber-espionage campaign targeting diplomatic and research sectors.', 'operation-red-october', 1),
(51, 'Operation Flame', 'Equation Group', 'Analyze Equation Group\'s sophisticated malware in the Middle East using MD5 collisions and espionage modules.', 'In the dimly lit corridors of cyberspace, the Equation Group has unleashed a sophisticated malware platform targeting Middle Eastern entities. This scenario requires you to dissect intricate modules for audio recording, Bluetooth sniffing, and screen capture, while unraveling the mystery of MD5 collision attacks used to sign their malware. As tensions rise, your mission is to trace the attackers\' steps, analyze their tactics, and neutralize the threat before critical data is exfiltrated.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Equation Group\\\\\\\",\\\\\\\"cyber-espionage\\\\\\\",\\\\\\\"malware analysis\\\\\\\",\\\\\\\"MD5 collision\\\\\\\",\\\\\\\"Middle East\\\\\\\"]\\\"\"', '', 5, '2026-01-07 22:31:17', 'Unraveling Equation Group\'s Espionage: A Deep Dive into Advanced Malware Tactics', 'Analyze Equation Group\'s sophisticated malware in the Middle East using MD5 collisions and espionage modules.', 'operation-flame', 1);
INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(52, 'Operation Centrifuge Saboteur', 'Equation Group (Stuxnet)', 'Investigate a PLC rootkit by Equation Group causing physical damage to industrial systems.', 'Amidst rising geopolitical tensions, a covert cyber-weapon has been unleashed on critical infrastructure. The Equation Group, with its sophisticated arsenal, has deployed a rootkit targeting industrial PLCs. Your mission is to unravel this operation\'s intricacies, uncovering the plot that manipulates centrifuges while deceiving monitoring systems, ultimately leading to physical sabotage.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"cyber-weapon\\\\\\\",\\\\\\\"industrial control systems\\\\\\\",\\\\\\\"PLC rootkit\\\\\\\",\\\\\\\"Equation Group\\\\\\\",\\\\\\\"Stuxnet\\\\\\\"]\\\"\"', '', 5, '2026-01-07 22:33:37', 'Operation Centrifuge Saboteur', 'Investigate a PLC rootkit by Equation Group causing physical damage to industrial systems.', 'operation-centrifuge-saboteur', 1),
(53, 'Operation Sunburst', 'APT29 (Cozy Bear / Nobelium)', 'Analyze the SolarWinds attack by APT29, focusing on the SUNBURST backdoor and C2 techniques.', 'In December 2020, one of the most sophisticated cyber espionage operations in history was uncovered. APT29, a cyber threat group linked to Russia\'s Foreign Intelligence Service, infiltrated the software supply chain of SolarWinds. By injecting a backdoor known as SUNBURST into an Orion software update, they gained access to multiple high-value targets, including government agencies. This training scenario will guide you through the investigation of this complex supply chain attack, exploring the domain generation algorithm used for command and control, and the second-stage payloads deployed to compromise sensitive networks.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT29\\\\\\\",\\\\\\\"SolarWinds\\\\\\\",\\\\\\\"Cyber Espionage\\\\\\\",\\\\\\\"Supply Chain Attack\\\\\\\",\\\\\\\"SUNBURST\\\\\\\"]\\\"\"', '', 8, '2026-01-07 22:37:57', 'Advanced Cybersecurity Training: APT29\'s SolarWinds Supply Chain Attack', 'Analyze the SolarWinds attack by APT29, focusing on the SUNBURST backdoor and C2 techniques.', 'operation-sunburst', 1),
(54, 'Operation Sony Spectacle', 'Lazarus Group (North Korea)', 'Beginner-level training on the Sony Pictures hack by Lazarus Group, focusing on Destover malware analysis and data exfiltration tracing.', 'In 2014, the entertainment industry was rocked by a devastating cyberattack on Sony Pictures, attributed to the notorious Lazarus Group. This training scenario invites you to step into the shoes of a cybersecurity analyst, dissecting the infamous attack. You\'ll analyze the destructive \'Destover\' wiper malware, trace complex proxy chains used for data exfiltration, and delve into the geopolitical motivations that drove this high-profile breach.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sony Pictures hack\\\\\\\",\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"Destover malware\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"beginner\\\\\\\"]\\\"\"', '', 7, '2026-01-07 22:38:59', 'Cybersecurity Training: Analyzing the Sony Pictures Hack by Lazarus Group', 'Beginner-level training on the Sony Pictures hack by Lazarus Group, focusing on Destover malware analysis and data exfiltration tracing.', 'operation-sony-spectacle', 1),
(55, 'Operation Bullseye', 'FIN7 / Anunak', 'Investigate the FIN7 APT Target breach, tracing from HVAC vendor compromise to POS malware and payment network infiltration.', 'During the bustling holiday season, a major retail chain, Target, fell victim to an orchestrated cyberattack. This operation simulates the breach orchestrated by the notorious FIN7 group, also known as Anunak, which led to the compromise of 40 million credit cards. Participants will follow the trail from an unsuspecting HVAC vendor compromise to sophisticated RAM-scraping malware infiltrating POS systems and finally, uncover the lateral movements within the payment network.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Target breach\\\\\\\",\\\\\\\"FIN7\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"APT\\\\\\\",\\\\\\\"POS malware\\\\\\\"]\\\"\"', '', 5, '2026-01-08 21:59:26', 'FIN7\'s Retail Breach: Uncovering the Target Holiday Heist', 'Investigate the FIN7 APT Target breach, tracing from HVAC vendor compromise to POS malware and payment network infiltration.', 'operation-bullseye', 1),
(56, 'Operation Credit Bureau', 'Chinese State-Sponsored (Unattributed)', 'Train on responding to the Equifax breach; analyze Apache Struts exploitation and persistence tactics.', 'In 2017, Equifax faced a catastrophic data breach, exposing 147 million Americans\' personal data. This scenario immerses you in the incident response team tasked with analyzing and mitigating the attack. You will navigate through the exploitation of Apache Struts vulnerability CVE-2017-5638, uncover the undetected dwell time, and understand the persistence mechanisms employed by a Chinese state-sponsored APT group.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Equifax breach\\\",\\\"Apache Struts\\\",\\\"CVE-2017-5638\\\",\\\"cybersecurity training\\\",\\\"APT\\\"]\"', '', 10, '2026-01-08 22:03:35', 'Operation Breach Analysis: Equifax 2017 Incident Response Training', 'Train on responding to the Equifax breach; analyze Apache Struts exploitation and persistence tactics.', 'operation-credit-bureau', 1),
(57, 'Operation Log4Chaos', 'Multiple (Chinese APTs, Ransomware Groups)', 'Advanced training on Log4Shell exploitation by Chinese APTs and ransomware groups. Analyze JNDI payloads and cryptominer deployments.', 'In late 2021, a critical vulnerability known as Log4Shell (CVE-2021-44228) began affecting millions of Java applications worldwide. As organizations scrambled to patch, Chinese APTs and ransomware groups initiated a mass exploitation campaign. Trainees will navigate through the chaotic landscape, analyzing JNDI injection payloads and cryptominer deployments while racing against time to defend critical systems.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Log4Shell\\\",\\\"APT\\\",\\\"Ransomware\\\",\\\"Cybersecurity Training\\\",\\\"JNDI Injection\\\"]\"', '', 5, '2026-01-08 22:08:03', 'Operation Log4Shell: APT and Ransomware Exploit Race', 'Advanced training on Log4Shell exploitation by Chinese APTs and ransomware groups. Analyze JNDI payloads and cryptominer deployments.', 'operation-log4chaos', 1),
(58, 'Operation MOVEit Mayhem', 'Cl0p (TA505)', 'Train on Cl0p\'s zero-day exploitation of MOVEit, focusing on SQL injection, mass data theft, and unique extortion tactics.', 'In this scenario, the notorious Cl0p group has discovered a zero-day vulnerability in the widely-used MOVEit file transfer platform. As organizations worldwide unknowingly expose sensitive data due to an SQL injection flaw, Cl0p orchestrates an unprecedented mass data theft. Uniquely, the group opts for a strategic extortion model, choosing not to deploy ransomware encryptors, challenging security teams to respond without the typical encryption-based clues.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Cl0p\\\\\\\",\\\\\\\"Zero-Day Exploitation\\\\\\\",\\\\\\\"SQL Injection\\\\\\\",\\\\\\\"MOVEit Platform\\\\\\\",\\\\\\\"Cyber Extortion\\\\\\\"]\\\"\"', '', 5, '2026-01-08 22:11:08', 'Cl0p\'s Zero-Day Exploitation of MOVEit: A Cybersecurity Training Scenario', 'Train on Cl0p\'s zero-day exploitation of MOVEit, focusing on SQL injection, mass data theft, and unique extortion tactics.', 'operation-moveit-mayhem', 1),
(59, 'Operation ProxyShell', 'Multiple (Hafnium, LockBit, Conti)', 'Investigate APT and ransomware exploitation of Microsoft Exchange vulnerabilities for web shell deployment and privilege escalation.', 'In early 2021, Microsoft Exchange servers worldwide became prime targets due to critical vulnerabilities. These security gaps were rapidly weaponized by both state-sponsored APT groups like Hafnium and financially-motivated ransomware operators such as LockBit and Conti. Trainees will investigate the exploitation chain, from initial access to data exfiltration, understanding the threat landscape\'s complexity.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Microsoft Exchange vulnerabilities\\\",\\\"APT groups\\\",\\\"ransomware\\\",\\\"cybersecurity training\\\",\\\"web shell\\\"]\"', '', 5, '2026-01-08 22:14:11', 'Operation Exchange Exploit: APTs and Ransomware', 'Investigate APT and ransomware exploitation of Microsoft Exchange vulnerabilities for web shell deployment and privilege escalation.', 'operation-proxyshell', 1),
(60, 'Operation Meat Grinder', 'REvil (Sodinokibi)', 'Learn to respond to the REvil ransomware attack on JBS Foods by analyzing tactics, tracing Bitcoin payments, and investigating fund recovery.', 'In May 2021, JBS Foods, a global meat processing giant, was hit by a notorious ransomware attack orchestrated by the REvil group. The attack disrupted meat production across North America and Australia, leading to an $11 million Bitcoin ransom payment. In this training scenario, you will step into the shoes of a cyber threat analyst. Your mission is to unravel the intricate layers of this attack, trace the ransom payment, and understand the FBI\'s role in recovering part of the funds. Prepare to dive deep into the tactics of REvil\'s affiliates and strengthen your cyber defense skills.', 'novice', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"REvil\\\\\\\",\\\\\\\"ransomware\\\\\\\",\\\\\\\"JBS Foods\\\\\\\",\\\\\\\"Bitcoin tracing\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\"]\\\"\"', '', 3, '2026-01-11 23:32:33', 'REvil Ransomware Training: Tracing JBS Foods Attack and Bitcoin Ransom', 'Learn to respond to the REvil ransomware attack on JBS Foods by analyzing tactics, tracing Bitcoin payments, and investigating fund recovery.', 'operation-meat-grinder', 1),
(61, 'Operation Meat Grinder', 'REvil (Sodinokibi)', 'Master an expert-level response to the REvil ransomware attack on JBS Foods, tracing ransom payments and analyzing FBI fund recovery.', 'In this expert-level training scenario, participants will be immersed in the high-stakes environment following the REvil group’s notorious ransomware attack on JBS Foods. The attack, which halted meat production across North America and Australia, resulted in a staggering $11 million Bitcoin ransom payment. Trainees will work to trace the digital ransom trail, dissect the affiliate\'s advanced tactics, and delve into the FBI\'s partial recovery of funds, unraveling the sophisticated layers of this cyber offensive.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"REvil\\\",\\\"ransomware\\\",\\\"JBS Foods\\\",\\\"cybersecurity training\\\",\\\"Bitcoin ransom\\\"]\"', '', 5, '2026-01-11 23:34:33', 'Expert Response to REvil\'s JBS Foods Ransomware Attack', 'Master an expert-level response to the REvil ransomware attack on JBS Foods, tracing ransom payments and analyzing FBI fund recovery.', 'operation-meat-grinder', 1),
(62, 'Operation BlackEnergy', 'Sandworm (Russian GRU Unit 74455)', 'Investigate Sandworm\'s 2015 cyberattack on Ukraine\'s power grid via BlackEnergy malware and KillDisk wiper.', 'In December 2015, the world witnessed the first confirmed cyberattack on a power grid. The notorious Sandworm group, a Russian cyber military unit, executed a meticulously planned attack that plunged 230,000 Ukrainians into darkness. Trainees will dissect the sophisticated use of BlackEnergy malware, the destructive KillDisk wiper, and the manipulation of SCADA systems, unraveling the methods behind this landmark cyber assault.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Sandworm\\\",\\\"BlackEnergy\\\",\\\"KillDisk\\\",\\\"SCADA\\\",\\\"Cyberattack\\\"]\"', '', 5, '2026-01-11 23:36:40', 'Advanced Analysis of Sandworm\'s 2015 Ukrainian Power Grid Attack', 'Investigate Sandworm\'s 2015 cyberattack on Ukraine\'s power grid via BlackEnergy malware and KillDisk wiper.', 'operation-blackenergy', 1),
(63, 'Operation Anthem Blues', 'Deep Panda (APT19)', 'Investigate Deep Panda\'s breach of Anthem, exposing 78.8M records via a phishing campaign and \'Derusbi\' malware.', 'In a chilling demonstration of stealth and strategy, APT19, also known as Deep Panda, executed a sophisticated cyberattack on Anthem, one of the largest health insurance providers in the United States. The breach resulted in the exposure of 78.8 million patient records, revealing a calculated phishing campaign targeting IT administrators, the deployment of custom \'Derusbi\' malware, and an unusual lack of encryption on the stolen database. As an investigator, you will delve into the intricacies of this operation, following the digital breadcrumbs left by the attackers.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Deep Panda\\\",\\\"Anthem breach\\\",\\\"cybersecurity training\\\",\\\"APT19\\\",\\\"Derusbi malware\\\"]\"', '', 5, '2026-01-11 23:41:38', 'Deep Panda\'s Infiltration: The Anthem Health Breach', 'Investigate Deep Panda\'s breach of Anthem, exposing 78.8M records via a phishing campaign and \'Derusbi\' malware.', 'operation-anthem-blues', 1),
(64, 'Operation OPM Heist', 'APT1 (Comment Crew) / Deep Panda', 'Analyze the OPM breach exposing federal data, focusing on PlugX RAT and counterintelligence implications.', 'In 2015, the U.S. Office of Personnel Management was breached by a sophisticated APT group, resulting in the compromise of 21.5 million federal employee records. This training scenario focuses on the deployment of the PlugX RAT, theft of fingerprint records, and the impact on national security through stolen SF-86 forms. Trainees will delve into the tactics and techniques used by the attackers, specifically APT1\'s strategic exploitation, persistence, and data exfiltration operations.', 'novice', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT1\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"OPM breach\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"PlugX RAT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"counterintelligence\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 3, '2026-01-11 23:43:46', 'Investigating the OPM Breach: Unraveling APT1\'s PlugX RAT Deployment', 'Analyze the OPM breach exposing federal data, focusing on PlugX RAT and counterintelligence implications.', 'operation-opm-heist', 1),
(65, 'Operation Marriott Checkout', 'APT1 (Chinese State-Sponsored)', 'Investigate APT1\'s stealthy breach of Marriott, analyzing RAT persistence and data encryption over four years.', 'In this operation, analysts are tasked with uncovering the sophisticated tactics employed by APT1, a Chinese state-sponsored group, in their prolonged and undetected breach of the Starwood/Marriott database. This breach, affecting 500 million guest records, showcases the group\'s expertise in maintaining persistence and evading detection through strategic use of Remote Access Trojans (RATs) and advanced data encryption. Participants will dive into the intricacies of the attack, focusing on the exposure of sensitive data such as passport numbers, and how the attackers leveraged the Starwood acquisition to their advantage.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT1\\\",\\\"Marriott Breach\\\",\\\"Cybersecurity Training\\\",\\\"Data Encryption\\\",\\\"Threat Intelligence\\\"]\"', '', 5, '2026-01-12 22:13:17', 'APT1 Infiltration: Unraveling the Starwood/Marriott Breach', 'Investigate APT1\'s stealthy breach of Marriott, analyzing RAT persistence and data encryption over four years.', 'operation-marriott-checkout', 1),
(66, 'Operation Capitol Breach', 'APT28 (Fancy Bear)', 'Analyze APT28\'s tactics in the 2016 DNC hack, focusing on X-Agent, X-Tunnel, and credential harvesting via spear-phishing.', 'In 2016, the Democratic National Committee was subjected to a sophisticated cyber attack that would become a pivotal moment in modern political history. The aggressive operation was attributed to APT28, a notorious Russian state-sponsored group known for its strategic cyber campaigns. This training scenario will delve into the group\'s use of X-Agent and X-Tunnel implants, the weaponization of stolen emails through WikiLeaks, and the spear-phishing techniques employed to harvest credentials, providing a comprehensive understanding of the cyber kill chain involved in this landmark attack.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"APT28\\\",\\\"DNC Hack\\\",\\\"Election Interference\\\",\\\"Cybersecurity Training\\\",\\\"Spear-Phishing\\\"]\"', '', 5, '2026-01-12 22:15:24', 'Investigating APT28\'s 2016 DNC Hack: A Comprehensive Training Scenario', 'Analyze APT28\'s tactics in the 2016 DNC hack, focusing on X-Agent, X-Tunnel, and credential harvesting via spear-phishing.', 'operation-capitol-breach', 1),
(67, 'Operation Shamoon Storm', 'APT33 (Elfin)', 'Dive into the analysis of APT33\'s Shamoon attack on Saudi Aramco, focusing on MBR overwrite and political motives.', 'In August 2012, a politically charged cyber assault shook the oil giant Saudi Aramco, wiping out data on 35,000 workstations. The attack, attributed to the notorious APT33 group, showcased a sophisticated MBR overwriting mechanism and left behind the telling image of a burning American flag. Investigators must dissect this complex attack, understanding the timing, motives, and techniques employed by the attackers.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"APT33\\\",\\\"Shamoon\\\",\\\"Saudi Aramco\\\",\\\"cybersecurity\\\",\\\"MBR overwrite\\\"]\"', '', 5, '2026-01-12 22:16:19', 'APT33 Shamoon Attack Investigation: Unraveling the Destruction of Saudi Aramco', 'Dive into the analysis of APT33\'s Shamoon attack on Saudi Aramco, focusing on MBR overwrite and political motives.', 'operation-shamoon-storm', 1),
(68, 'Operation Cobalt Factory', 'Cobalt Group', 'Investigate Cobalt Group\'s campaign targeting global ATM networks to prevent cyber heists.', 'The notorious Cobalt Group has launched a campaign targeting ATM infrastructures across more than 40 countries. Participants must unravel the complex web of ATM software manipulation, compromised card processing networks, and a sophisticated money mule operation. Your mission is to dissect each phase of the attack, understand the adversary\'s tactics, and devise strategies to thwart their efforts.', 'novice', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Cobalt Group\\\\\\\",\\\\\\\"ATM Cybersecurity\\\\\\\",\\\\\\\"Banking Threats\\\\\\\",\\\\\\\"Cyber Heist\\\\\\\",\\\\\\\"Financial Cybercrime\\\\\\\"]\\\"\"', '', 8, '2026-01-12 22:18:23', 'Cobalt Group ATM Heist Investigation Training', 'Investigate Cobalt Group\'s campaign targeting global ATM networks to prevent cyber heists.', 'operation-cobalt-factory', 1),
(69, 'Operation Swift Heist (Bangladesh)', 'Lazarus Group (APT38)', 'Explore the Lazarus Group\'s tactics in the $951 million Bangladesh Bank heist via SWIFT network manipulation.', 'In 2016, the cyber world was rocked by an audacious attempt to steal $951 million from the Bangladesh Bank. At the heart of this operation was the infamous Lazarus Group, a North Korean state-sponsored threat actor known for its cunning and precision. This training scenario will guide you through the investigation of this high-stakes heist. You will analyze the custom malware that concealed fraudulent transactions, the critical typo that thwarted the full theft, and how the stolen funds were laundered through Philippine casinos. Prepare yourself for an expert-level challenge in cyber threat intelligence analysis.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"Bangladesh Bank Heist\\\",\\\"SWIFT network\\\",\\\"cybersecurity training\\\",\\\"APT38\\\"]\"', '', 7, '2026-01-12 22:18:54', 'Lazarus Group\'s Bangladesh Bank Heist Analysis', 'Explore the Lazarus Group\'s tactics in the $951 million Bangladesh Bank heist via SWIFT network manipulation.', 'operation-swift-heist-bangladesh', 1),
(70, 'Operation CCleaner', 'Barium (Winnti / APT41)', 'Investigate the CCleaner attack affecting 2.27M users, analyzing targeted espionage on 40 tech firms.', 'In September 2017, the world witnessed a massive supply chain attack on CCleaner, a popular utility tool. While 2.27 million users were affected, the true intent of the attack was far more sinister. Hidden within the chaos was a highly targeted espionage operation by APT41, surgically focused on 40 specific technology companies. Participants will delve into this complex scenario, tracing the steps of this notorious APT group and unveiling their covert objectives.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"CCleaner Supply Chain Attack\\\",\\\"APT41\\\",\\\"Cyber Espionage\\\",\\\"Technology Sector\\\",\\\"Supply Chain Security\\\"]\"', '', 3, '2026-01-12 22:24:29', 'Unveiling the CCleaner Supply Chain Attack by APT41', 'Investigate the CCleaner attack affecting 2.27M users, analyzing targeted espionage on 40 tech firms.', 'operation-ccleaner', 1),
(71, 'Operation Triton', 'EMP.Veles (Russian CNIIHM)', 'Learn to investigate the Triton/TRISIS malware targeting Triconex systems in a petrochemical plant by EMP.Veles.', 'In the heart of a bustling petrochemical plant, the hum of machinery is a constant backdrop. However, a sinister threat lurks beneath the surface. The notorious APT group, EMP.Veles, has set its sights on the plant\'s Schneider Electric Triconex safety systems. Their goal: to manipulate the safety instrumented systems (SIS) using the Triton/TRISIS malware, potentially causing catastrophic physical damage or even loss of life. As part of the cybersecurity response team, it is your mission to unravel this plot and prevent disaster.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Triton malware\\\",\\\"EMP.Veles\\\",\\\"Schneider Electric\\\",\\\"SIS\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-13 01:50:57', 'Beginner Training: Investigating Triton/TRISIS Attack by EMP.Veles', 'Learn to investigate the Triton/TRISIS malware targeting Triconex systems in a petrochemical plant by EMP.Veles.', 'operation-triton', 1),
(72, 'Operation Conti Ransomware', 'Conti', 'Simulate a response to Conti\'s attack on Ireland\'s HSE, focusing on data theft and system crippling.', 'In May 2021, the Conti ransomware group executed a highly sophisticated attack on Ireland\'s Health Service Executive (HSE), leading to the theft of 700GB of sensitive data and a temporary shutdown of critical healthcare systems, including COVID-19 vaccination services. While decryption keys were eventually provided, the attackers still leaked parts of the stolen data, raising questions about their motives and tactics. This training scenario will guide you through the steps of analyzing and responding to this complex cyber crisis.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Conti ransomware\\\",\\\"HSE cyberattack\\\",\\\"cybersecurity training\\\",\\\"data breach analysis\\\",\\\"novice cyber operations\\\"]\"', '', 3, '2026-01-13 01:55:42', 'Conti Ransomware Response Training: The HSE Attack', 'Simulate a response to Conti\'s attack on Ireland\'s HSE, focusing on data theft and system crippling.', 'operation-conti-ransomware', 1),
(73, 'Operation VPN Exploit', 'Hafnium', 'Investigate Hafnium\'s mass exploitation of VPNs targeting defense contractors and government agencies.', 'In early 2023, the notorious APT group Hafnium launched a coordinated attack targeting vulnerable VPN appliances. Utilizing authentication bypass vulnerabilities, they infiltrated networks of defense contractors and government agencies. Your mission is to investigate these breaches, analyze the persistence mechanisms, and understand the implications of these intrusions for national security.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Hafnium\\\",\\\"VPN exploitation\\\",\\\"defense contractors\\\",\\\"government agencies\\\",\\\"cybersecurity training\\\"]\"', '', 4, '2026-01-15 00:48:47', 'Hafnium\'s VPN Exploitation Tactics: A Cybersecurity Training Scenario', 'Investigate Hafnium\'s mass exploitation of VPNs targeting defense contractors and government agencies.', 'operation-vpn-exploit', 1),
(74, 'Operation Kaseya Cascade', 'REvil (Sodinokibi)', 'Investigate REvil\'s Kaseya VSA exploit targeting 1,500+ businesses via MSP supply chain compromise.', 'On the eve of Independence Day, a notorious APT group, REvil, executed a massive ransomware attack exploiting a zero-day vulnerability in Kaseya VSA software. This sophisticated supply chain compromise struck over 1,500 businesses in one fell swoop. Trainees will delve into the intricacies of this attack, from the initial infiltration to the decryption key acquisition, and explore the $70 million ransom demand that held global businesses at ransom.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"REvil\\\",\\\"Kaseya VSA\\\",\\\"ransomware\\\",\\\"supply chain attack\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-15 00:49:21', 'REvil\'s Supply Chain Infiltration: Kaseya VSA Exploit', 'Investigate REvil\'s Kaseya VSA exploit targeting 1,500+ businesses via MSP supply chain compromise.', 'operation-kaseya-cascade', 1),
(75, 'Operation Ukraine Grid 2016', 'Sandworm (Industroyer/CrashOverride)', 'Dive into Sandworm\'s 2016 Ukrainian power grid attack, analyzing the Industroyer malware framework\'s ICS protocol intricacies.', 'In December 2016, Ukraine faced a second debilitating cyberattack on its power grid, orchestrated by the notorious Sandworm group. Using the sophisticated Industroyer framework, this operation marked the first deployment of malware specifically tailored for electric grid systems. Your mission is to unravel the complexities of this attack, focusing on the threat actor\'s deep understanding of critical ICS protocols like IEC 101, IEC 104, and OPC, and the seamless coordination of multi-substation assaults.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Sandworm\\\",\\\"Industroyer\\\",\\\"ICS Protocols\\\",\\\"Cybersecurity Training\\\",\\\"Ukrainian Power Grid Attack\\\"]\"', '', 6, '2026-01-15 00:51:24', 'Investigate Sandworm\'s Industroyer Attack on Ukrainian Power Grid', 'Dive into Sandworm\'s 2016 Ukrainian power grid attack, analyzing the Industroyer malware framework\'s ICS protocol intricacies.', 'operation-ukraine-grid-2016', 1),
(76, 'Operation Capital One', 'Insider / Opportunistic', 'Investigate the Capital One breach involving AWS misconfiguration, SSRF attack, and insider IAM role abuse.', 'In July 2019, a massive data breach exposed 100 million credit applications at Capital One due to a sophisticated attack involving a misconfigured AWS Web Application Firewall (WAF). The breach was orchestrated by an insider with deep cloud expertise, leveraging a Server-Side Request Forgery (SSRF) attack vector and abusing IAM roles. Your mission is to analyze the attack sequence, identify the security gaps exploited, and understand the insider\'s motivations and methods.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Capital One breach\\\",\\\"SSRF attack\\\",\\\"AWS misconfiguration\\\",\\\"insider threat\\\",\\\"IAM role abuse\\\"]\"', '', 5, '2026-01-15 00:52:37', 'Insider Threat: Capital One Cloud Breach Investigation', 'Investigate the Capital One breach involving AWS misconfiguration, SSRF attack, and insider IAM role abuse.', 'operation-capital-one', 1),
(77, 'Operation Twitter Takeover', 'Social Engineering / Insider', 'Investigate the Twitter hack targeting high-profile accounts via social engineering and insider threats, leading to a Bitcoin scam.', 'In the summer of 2020, Twitter faced a significant breach that saw high-profile accounts like Barack Obama, Elon Musk, and Bill Gates compromised. This operation examines the social engineering tactics used against Twitter employees, the exploitation of internal admin tools, and the ultimate cryptocurrency theft of $120,000. Participants will delve into the attack chain, understanding how insider threats can unravel even the most secure systems.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"social engineering\\\",\\\"Twitter hack\\\",\\\"insider threat\\\",\\\"Bitcoin scam\\\",\\\"cybersecurity training\\\"]\"', '', 4, '2026-01-15 00:55:02', 'Social Engineering Exploitation: The 2020 Twitter Hack', 'Investigate the Twitter hack targeting high-profile accounts via social engineering and insider threats, leading to a Bitcoin scam.', 'operation-twitter-takeover', 1),
(78, 'Operation Mimecast Compromise', 'APT29 (Nobelium/Cozy Bear)', 'Investigate APT29\'s strategic compromise of Mimecast certificates to infiltrate Microsoft 365 environments.', 'In the wake of the infamous SolarWinds attack, APT29 has launched a sophisticated campaign targeting Mimecast to exploit trust in the supply chain. Tasked with investigating the breach, analysts must uncover how stolen certificates facilitated unauthorized access to Microsoft 365 environments, threatening critical infrastructure and government entities.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"APT29\\\",\\\"Mimecast\\\",\\\"Microsoft 365\\\",\\\"Supply Chain Attacks\\\",\\\"Cybersecurity Training\\\"]\"', '', 5, '2026-01-15 00:55:32', 'APT29\'s Exploitation of Mimecast in SolarWinds Aftermath', 'Investigate APT29\'s strategic compromise of Mimecast certificates to infiltrate Microsoft 365 environments.', 'operation-mimecast-compromise', 1),
(79, 'Operation Uber Breach', 'Lapsus$ (Teen Hackers)', 'Investigate the 2022 Uber breach by Lapsus$ using advanced techniques like MFA fatigue and social engineering.', 'In 2022, the notorious teenage hacker group Lapsus$ launched a brazen attack on Uber, exploiting human vulnerabilities and technical gaps. Your mission is to dissect the breach, understand the attack vectors, and uncover the methods used to infiltrate and exfiltrate sensitive data. This scenario challenges you to think like an attacker and defend like a cybersecurity expert.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Lapsus$\\\",\\\"Uber breach\\\",\\\"MFA fatigue\\\",\\\"cybersecurity training\\\",\\\"APT simulation\\\"]\"', '', 7, '2026-01-15 00:55:57', 'Lapsus$ APT Simulation: Unraveling the Uber Breach', 'Investigate the 2022 Uber breach by Lapsus$ using advanced techniques like MFA fatigue and social engineering.', 'operation-uber-breach', 1),
(80, 'Operation LastPass Vault', 'Unknown (Targeted Attack)', 'Investigate the sophisticated LastPass breach affecting 30 million users by tracing initial access and assessing risks to encryption keys.', 'In an alarming breach affecting 30 million users, LastPass\'s encrypted vaults were compromised. The initial vector exploited a DevOps engineer\'s home computer, leading to the theft of critical cloud storage encryption keys. As part of a skilled cybersecurity team, you\'re tasked with dissecting this attack to uncover the unknown APT group behind it and determine the threat to users\' master passwords.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"LastPass breach\\\",\\\"APT investigation\\\",\\\"DevOps compromise\\\",\\\"encryption keys\\\",\\\"cybersecurity training\\\"]\"', '', 6, '2026-01-15 00:58:12', 'Advanced Analysis of LastPass Breach: DevOps Compromise Investigation', 'Investigate the sophisticated LastPass breach affecting 30 million users by tracing initial access and assessing risks to encryption keys.', 'operation-lastpass-vault', 1),
(81, 'Operation Okta Intrusion', 'Lapsus$ (DEV-0537)', 'Investigate the Okta breach by Lapsus$ through third-party access, focusing on the SuperUser portal and 366 affected customers.', 'In this expert-level training scenario, you will delve into the infamous Okta breach orchestrated by the Lapsus$ group. As a senior analyst, your mission is to unravel the complexities of this attack, which compromised 366 customers through a third-party support contractor. You will explore the implications on supply chain trust for identity-as-a-service providers and gain insights on securing the SuperUser portal.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Okta breach\\\",\\\"Lapsus$\\\",\\\"supply chain attack\\\",\\\"identity-as-a-service\\\",\\\"cybersecurity\\\"]\"', '', 6, '2026-01-15 00:58:37', 'Advanced Cyber Training: Analyzing the Lapsus$ Okta Breach', 'Investigate the Okta breach by Lapsus$ through third-party access, focusing on the SuperUser portal and 366 affected customers.', 'operation-okta-intrusion', 1),
(82, 'Operation Nvidia Heist', 'Lapsus$', 'Investigate a 1TB data theft by Lapsus$, analyze extortion demands, and explore public spectacle tactics.', 'In a high-stakes cybercrime scenario, the notorious APT group Lapsus$ has struck again, claiming responsibility for the theft of 1TB of Nvidia\'s proprietary data. Among the stolen assets are GPU drivers, firmware, and code-signing certificates. Lapsus$ demands Nvidia to open-source their drivers, using unconventional public spectacle tactics to amplify their extortion. As part of an expert team, your mission is to dissect this complex breach, unravel the group\'s attack chain, and determine how they leveraged public disclosure to pressure Nvidia.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Lapsus$\\\",\\\"Nvidia breach\\\",\\\"cybersecurity training\\\",\\\"APT investigation\\\",\\\"data theft\\\"]\"', '', 7, '2026-01-15 00:59:01', 'Advanced Cyber Ops Training: Lapsus$ Nvidia Breach Investigation', 'Investigate a 1TB data theft by Lapsus$, analyze extortion demands, and explore public spectacle tactics.', 'operation-nvidia-heist', 1),
(83, 'Operation Samsung Leak', 'Lapsus$', 'Intermediate-level scenario investigating Lapsus$ APT\'s theft of Samsung source code and extortion via Telegram.', 'In March 2023, the notorious APT group Lapsus$ executed a bold cyber heist, extracting 190GB of sensitive Samsung source code. This breach, targeting crucial Galaxy device components, sent shockwaves through the mobile security industry. Trainees must now dissect the attack\'s trajectory, unravel the Telegram-based extortion tactics, and assess the lasting impact on future security protocols.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Lapsus$\\\",\\\"Samsung breach\\\",\\\"cybersecurity training\\\",\\\"APT group\\\",\\\"mobile security\\\"]\"', '', 5, '2026-01-15 01:01:36', 'Lapsus$ APT: Samsung Source Code Breach Simulation', 'Intermediate-level scenario investigating Lapsus$ APT\'s theft of Samsung source code and extortion via Telegram.', 'operation-samsung-leak', 1),
(84, 'Operation Costa Rica', 'Conti', 'Investigate Conti\'s ransomware attack on Costa Rica, analyzing encryption tactics, ransom demands, and political messaging.', 'In April 2022, Costa Rica faced a national emergency when the notorious Conti group launched a ransomware attack on multiple government ministries. This operation will guide you through the investigation of how Conti encrypted critical systems, demanded a $20 million ransom, and issued politically charged messages, disrupting the nation\'s infrastructure.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Conti ransomware\\\",\\\"Costa Rica cyber attack\\\",\\\"APT group tactics\\\",\\\"ransomware investigation\\\",\\\"cybersecurity training\\\"]\"', '', 4, '2026-01-15 01:01:56', 'Conti Ransomware Attack on Costa Rica: A Cybersecurity Training Scenario', 'Investigate Conti\'s ransomware attack on Costa Rica, analyzing encryption tactics, ransom demands, and political messaging.', 'operation-costa-rica', 1),
(85, 'Operation WannaCry NHS', 'Lazarus Group', 'Investigate the WannaCry ransomware impact on NHS, focusing on unpatched systems, canceled surgeries, and kill-switch discovery.', 'In May 2017, the infamous Lazarus Group launched a global ransomware attack known as WannaCry, crippling over 80 NHS hospital trusts in the UK. This operation explores the devastating impact on healthcare services, highlighting the vulnerability of unpatched Windows XP systems, the chaos caused by canceled surgeries, and the serendipitous discovery of a kill-switch domain that halted further damage. Participants will delve into the intricacies of the attack, learning to identify and mitigate similar threats in the future.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"WannaCry\\\",\\\"Lazarus Group\\\",\\\"NHS Cyber Attack\\\",\\\"Ransomware\\\",\\\"Cybersecurity Training\\\"]\"', '', 6, '2026-01-15 01:02:19', 'Advanced Analysis of Lazarus Group\'s Impact on WannaCry NHS Attack', 'Investigate the WannaCry ransomware impact on NHS, focusing on unpatched systems, canceled surgeries, and kill-switch discovery.', 'operation-wannacry-nhs', 1),
(86, 'Operation City of Atlanta', 'SamSam (Iranian Hackers)', 'Expert scenario to dissect SamSam\'s ransomware attack on Atlanta, focusing on RDP brute-force and $51,000 ransom demand.', 'In March 2018, Atlanta\'s municipal services were brought to a standstill by a devastating ransomware attack orchestrated by the notorious Iranian hacker group, SamSam. The attack, which leveraged brute-force tactics to gain access via Remote Desktop Protocol (RDP), led to a ransom demand of $51,000. However, the true cost of recovery soared to an estimated $17 million. Participants are tasked with tracing the steps of this attack, from initial access to the eventual exfiltration, in a comprehensive cybersecurity investigation.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"SamSam ransomware\\\",\\\"Atlanta attack\\\",\\\"RDP brute-force\\\",\\\"cybersecurity training\\\",\\\"APT group\\\"]\"', '', 6, '2026-01-15 01:02:46', 'Cybersecurity Operation: Unraveling SamSam\'s Ransomware Attack on Atlanta', 'Expert scenario to dissect SamSam\'s ransomware attack on Atlanta, focusing on RDP brute-force and $51,000 ransom demand.', 'operation-city-of-atlanta', 1),
(87, 'Operation Baltimore', 'RobbinHood', 'Investigate and analyze the RobbinHood ransomware attack exploiting Baltimore\'s systems via a vulnerable remote access tool.', 'In early 2023, Baltimore\'s city systems were hit by a devastating ransomware attack perpetrated by the notorious APT group, RobbinHood. Over several months, key operations were hindered, causing widespread impact. The city made headlines with its controversial decision to refuse ransom payment, leaving systems crippled. Your mission is to delve into the intricacies of the attack, focusing on the exploitation of a vulnerable remote access tool, to piece together the attack chain and provide actionable insights.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"RobbinHood\\\",\\\"ransomware attack\\\",\\\"Baltimore city systems\\\",\\\"cybersecurity training\\\",\\\"APT group\\\"]\"', '', 5, '2026-01-17 03:36:38', 'RobbinHood Ransomware Attack on Baltimore City Systems', 'Investigate and analyze the RobbinHood ransomware attack exploiting Baltimore\'s systems via a vulnerable remote access tool.', 'operation-baltimore', 1),
(88, 'Operation Garmin Outage', 'Evil Corp (WastedLocker)', 'Investigate Evil Corp\'s WastedLocker ransomware attack on Garmin, analyze a $10 million ransom and aviation service disruption.', 'In this training scenario, participants will dive into the infamous WastedLocker ransomware attack orchestrated by Evil Corp that crippled Garmin\'s operations. The attack not only demanded a staggering $10 million ransom but also highlighted vulnerabilities in aviation services, raising significant concerns about sanctions evasion. Trainees will follow the digital breadcrumbs left by the attackers, piecing together the sophisticated tactics, techniques, and procedures that led to one of the most notable cyber incidents of recent times.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Evil Corp\\\",\\\"WastedLocker\\\",\\\"ransomware\\\",\\\"Garmin attack\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-17 03:37:30', 'Evil Corp WastedLocker Attack Simulation on Garmin', 'Investigate Evil Corp\'s WastedLocker ransomware attack on Garmin, analyze a $10 million ransom and aviation service disruption.', 'operation-garmin-outage', 1),
(89, 'Operation Norsk Hydro', 'LockerGoga', 'Advanced training on investigating LockerGoga\'s ransomware impact on aluminum giant, focusing on backup restoration and manual operations.', 'In early 2019, a major aluminum manufacturing giant faced a severe ransomware attack by the notorious APT group, LockerGoga. The company, refusing to succumb to demands, decided to restore from backups, incurring a significant $75 million impact. This operation simulation takes you through the stages of the attack, the strategic decision to switch to manual operations, and the subsequent investigation into the incident.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"LockerGoga\\\",\\\"ransomware\\\",\\\"cybersecurity\\\",\\\"APT\\\",\\\"backup restoration\\\"]\"', '', 6, '2026-01-17 03:38:07', 'LockerGoga Ransomware Attack Simulation on Aluminum Manufacturing', 'Advanced training on investigating LockerGoga\'s ransomware impact on aluminum giant, focusing on backup restoration and manual operations.', 'operation-norsk-hydro', 1),
(90, 'Operation Maersk NotPetya', 'Sandworm', 'Explore Maersk\'s recovery from the $300M NotPetya attack with analysis of IT rebuild and strategic incident response.', 'In 2017, the world witnessed one of the most devastating cyberattacks in history when the NotPetya malware struck, inflicting over $10 billion in damages globally. Among its victims was Maersk, the world\'s largest shipping company, whose operations ground to a halt, resulting in a $300 million impact. This training scenario dives into the intricate investigation of the attack, focusing on the complete IT infrastructure rebuild, the serendipitous discovery of a functional domain controller in Ghana, and the relentless 10-day recovery effort.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"NotPetya\\\",\\\"cyberattack recovery\\\",\\\"Maersk\\\",\\\"cybersecurity training\\\",\\\"Sandworm APT\\\"]\"', '', 3, '2026-01-17 03:39:02', 'NotPetya Aftermath: Rebuilding Maersk\'s IT Infrastructure', 'Explore Maersk\'s recovery from the $300M NotPetya attack with analysis of IT rebuild and strategic incident response.', 'operation-maersk-notpetya', 1),
(91, 'Operation Merck Disruption', 'Sandworm (NotPetya)', 'Investigate the $1.4B NotPetya impact on pharmaceuticals and the cyber insurance \'act of war\' legal battle.', 'In the wake of the infamous NotPetya attack, the pharmaceutical industry faced unprecedented challenges. Operations worth $1.4 billion were disrupted, particularly affecting vaccine production. As Sandworm\'s malicious campaign unfolded, questions arose about the adequacy of cyber insurance coverage, sparking a landmark legal battle over \'act of war\' exclusions. In this expert-level training scenario, participants will delve into the intricate details of Sandworm\'s tactics and the ensuing fallout.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"NotPetya\\\",\\\"Sandworm\\\",\\\"Cyber Insurance\\\",\\\"Pharmaceutical Cybersecurity\\\",\\\"APT Training\\\"]\"', '', 7, '2026-01-17 03:40:33', 'Expert Cybersecurity Training: Analyzing NotPetya\'s Impact on Pharma', 'Investigate the $1.4B NotPetya impact on pharmaceuticals and the cyber insurance \'act of war\' legal battle.', 'operation-merck-disruption', 1),
(92, 'Operation FedEx TNT', 'Sandworm (NotPetya)', 'Explore the $400M NotPetya impact on FedEx\'s TNT Express. Analyze data loss and integration challenges in this intermediate training scenario.', 'In 2017, the notorious APT group Sandworm unleashed the NotPetya cyberattack, which rippled across the globe, causing billions in damage. Among its victims was FedEx\'s TNT Express, suffering a staggering $400 million impact. Trainees will dive into the depths of this attack, exploring the permanent data loss in legacy systems and the integration challenges that magnified the damage. As you investigate, you\'ll uncover the motives, methods, and missteps that defined this cataclysmic event.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"NotPetya\\\",\\\"Sandworm\\\",\\\"FedEx\\\",\\\"Cybersecurity Training\\\",\\\"APT Group\\\"]\"', '', 5, '2026-01-17 03:41:03', 'NotPetya Impact Analysis on FedEx\'s TNT Express: A Cyber Operation Case Study', 'Explore the $400M NotPetya impact on FedEx\'s TNT Express. Analyze data loss and integration challenges in this intermediate training scenario.', 'operation-fedex-tnt', 1),
(93, 'Operation Ronin Bridge', 'Lazarus Group', 'Investigate the Ronin Bridge hack, uncover compromised keys, and follow blockchain forensics in this beginner-level cyber operation.', 'In March 2022, the Ronin Bridge network suffered a staggering $625 million cryptocurrency theft, marking it as the largest crypto hack in history. At the heart of this operation is the notorious Lazarus Group, a North Korean cybercrime syndicate known for its sophisticated financial heists. As a budding cyber threat intelligence analyst, you are tasked with piecing together how this attack unfolded, tracking the compromised validator keys, and following the complex trail of stolen funds through blockchain forensics.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Ronin Bridge hack\\\",\\\"Lazarus Group\\\",\\\"cryptocurrency theft\\\",\\\"cybersecurity training\\\",\\\"blockchain forensics\\\"]\"', '', 5, '2026-01-17 03:41:32', 'Lazarus Group\'s Ronin Bridge Cryptocurrency Heist Investigation', 'Investigate the Ronin Bridge hack, uncover compromised keys, and follow blockchain forensics in this beginner-level cyber operation.', 'operation-ronin-bridge', 1),
(94, 'Operation Harmony Bridge', 'Lazarus Group', 'Investigate the Harmony Protocol bridge heist by Lazarus Group, focusing on compromised multi-sig schemes and crypto laundering.', 'In the heart of the cryptocurrency realm, a staggering $100 million has vanished from Harmony Protocol\'s bridge. The infamous Lazarus Group is suspected, leveraging its expertise in financial theft to crack the multi-sig scheme. Analysts must dive into the remnants of this cyber theft, unraveling the threads of a North Korean cryptocurrency laundering operation.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"Harmony Protocol\\\",\\\"cryptocurrency theft\\\",\\\"APT investigation\\\",\\\"cybersecurity training\\\"]\"', '', 3, '2026-01-17 03:44:07', 'Lazarus Group\'s $100M Crypto Heist Investigation', 'Investigate the Harmony Protocol bridge heist by Lazarus Group, focusing on compromised multi-sig schemes and crypto laundering.', 'operation-harmony-bridge', 1),
(95, 'Operation Wormhole Bridge', 'Unknown', 'Investigate the $325 million theft via a signature verification flaw in Wormhole\'s smart contract and the unusual $10M bug bounty offer.', 'In the early hours of a cold Tuesday morning, chaos erupted in the blockchain community as reports emerged of a massive $325 million theft from the Wormhole bridge. The cyber heist, executed by an unidentified APT group, exploited a critical vulnerability in the smart contract’s signature verification process. Surprisingly, a $10 million bug bounty was offered to the attacker. Your mission: dissect the smart contract exploitation and unravel the mystery behind the bounty offer, tracing the steps of this audacious cyber operation.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"cybersecurity training\\\",\\\"smart contract exploitation\\\",\\\"blockchain security\\\",\\\"APT investigation\\\",\\\"signature verification\\\"]\"', '', 4, '2026-01-17 03:44:35', 'Wormhole Bridge Heist: Analyzing Smart Contract Exploitation', 'Investigate the $325 million theft via a signature verification flaw in Wormhole\'s smart contract and the unusual $10M bug bounty offer.', 'operation-wormhole-bridge', 1),
(96, 'Operation Poly Network', 'Unknown (White Hat?)', 'Analyze a $610 million DeFi hack with an unknown attacker who returned the funds, highlighting cross-chain vulnerabilities.', 'In a baffling twist of finance and ethics, a mysterious attacker siphoned off $610 million from a leading DeFi platform, only to return the funds days later. This advanced training scenario dives into the complexities of cross-chain vulnerabilities, exploring the enigmatic dialogue between the hacker and the victim platform. Trainees will step into the shoes of cybersecurity investigators tasked with dissecting this unprecedented event.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"DeFi hack\\\",\\\"cross-chain vulnerability\\\",\\\"cybersecurity training\\\",\\\"crypto investigation\\\",\\\"ethical hacking\\\"]\"', '', 6, '2026-01-17 03:46:27', 'The $610 Million DeFi Mystery: Unraveling the Cross-Chain Exploit', 'Analyze a $610 million DeFi hack with an unknown attacker who returned the funds, highlighting cross-chain vulnerabilities.', 'operation-poly-network', 1),
(97, 'T-Mobile Breach', 'John Binns (Individual)', 'Investigate the T-Mobile breach by John Binns exposing 54M records via router exploitation.', 'In 2021, a lone threat actor known as John Binns breached T-Mobile\'s defenses, exposing the data of 54 million customers. This training scenario challenges participants to dissect the breach, unravel the attacker\'s methods, and understand the intricate dance between exploitation and data exfiltration. Participants will navigate through public taunts and data sales in the shadowy corners of the internet.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"T-Mobile breach\\\",\\\"cybersecurity training\\\",\\\"John Binns\\\",\\\"data exfiltration\\\",\\\"APT investigation\\\"]\"', '', 5, '2026-01-17 03:47:33', 'John Binns\' T-Mobile Breach Investigation Training', 'Investigate the T-Mobile breach by John Binns exposing 54M records via router exploitation.', 't-mobile-breach', 1);
INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(98, 'Operation Yahoo Breach', 'FSB Officers / Criminal Hackers', 'Analyze the techniques behind the Yahoo breach affecting 3 billion accounts, focusing on forged cookies and state-sponsored threats.', 'In 2013, Yahoo experienced a massive data breach, compromising 3 billion accounts. This operation delves into the sophisticated tactics used by FSB officers and criminal hackers. Participants will investigate the creation of forged cookies that bypass passwords and the strategic targeting of journalists, unraveling the layers of one of history\'s largest cyber-attacks.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Yahoo breach\\\",\\\"forged cookies\\\",\\\"state-sponsored hacking\\\",\\\"FSB\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-17 03:49:21', 'Unraveling the Yahoo Data Breach: A Deep Dive', 'Analyze the techniques behind the Yahoo breach affecting 3 billion accounts, focusing on forged cookies and state-sponsored threats.', 'operation-yahoo-breach', 1),
(99, 'Operation LinkedIn Scrape', 'Data Brokers', 'Learn to analyze API abuse in a scenario where 700 million LinkedIn profiles were scraped by the Data Brokers APT group.', 'In this training scenario, participants will dive into the world of cyber threats targeting social media platforms. The Data Brokers, a notorious APT group, have executed a massive scraping operation, collecting 700 million LinkedIn profiles. Trainees will explore API abuse, differentiate between data scraping and breaches, and understand the risks associated with aggregating public data.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"API abuse\\\",\\\"Data scraping\\\",\\\"LinkedIn breach\\\",\\\"Data aggregation\\\",\\\"Cybersecurity training\\\"]\"', '', 5, '2026-01-17 03:49:46', 'Investigating LinkedIn Profile Scraping by Data Brokers', 'Learn to analyze API abuse in a scenario where 700 million LinkedIn profiles were scraped by the Data Brokers APT group.', 'operation-linkedin-scrape', 1),
(104, 'Operation GoDaddy Breach', 'Unknown (Social Engineering)', 'Explore the GoDaddy breach affecting 1.2M users via social engineering tactics and credential theft.', 'In a sprawling cyber operation, an unknown APT group has targeted GoDaddy\'s WordPress customers over several years. This training scenario delves into the tactics used, including social engineering, credential compromises, and sensitive data theft. Participants will uncover how attackers gained access, maintained their presence, and exfiltrated critical information.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"GoDaddy breach\\\",\\\"WordPress security\\\",\\\"cybersecurity training\\\",\\\"credential theft\\\",\\\"social engineering\\\"]\"', '', 5, '2026-01-24 00:36:52', 'Beginner Cybersecurity Training: GoDaddy WordPress Breach Investigation', 'Explore the GoDaddy breach affecting 1.2M users via social engineering tactics and credential theft.', 'operation-godaddy-breach', 1),
(102, 'Operation Facebook Leak', 'Unknown', 'Analyze the breach of 533 million Facebook users\' data via a long-exploited vulnerability.', 'In early 2021, security researchers uncovered a massive leak involving the personal data of 533 million Facebook users. The data, exposed through a vulnerability in Facebook\'s contact importer feature, had been accessible for years before it was publicly disclosed. In this advanced training scenario, you will investigate the exploitation of this vulnerability, piece together the timeline of events, and analyze the threat actor\'s techniques, tactics, and procedures.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Facebook data breach\\\",\\\"cybersecurity training\\\",\\\"contact importer vulnerability\\\",\\\"APT investigation\\\"]\"', '', 5, '2026-01-24 00:09:12', 'Investigating the Facebook Data Breach: Unveiling the Contact Importer Vulnerability', 'Analyze the breach of 533 million Facebook users\' data via a long-exploited vulnerability.', 'operation-facebook-leak', 1),
(103, 'Operation Twitch Leak', 'Anonymous (4chan)', 'Expert-level analysis of the Twitch leak by Anonymous (4chan), exploring server misconfiguration and competitive risks.', 'In a shocking cyber event, the complete Twitch source code, including sensitive streamer earnings data, has been leaked by Anonymous (4chan). This 125GB data dump, attributed to a misconfigured server exposure, poses severe competitive intelligence risks. As a senior analyst, your mission is to meticulously investigate this breach, identify the weak points, and provide insights into mitigating future threats.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Twitch leak\\\",\\\"Anonymous 4chan\\\",\\\"cybersecurity training\\\",\\\"APT investigation\\\",\\\"competitive intelligence\\\"]\"', '', 5, '2026-01-24 00:32:33', 'Advanced Investigation of Twitch Source Code and Earnings Breach', 'Expert-level analysis of the Twitch leak by Anonymous (4chan), exploring server misconfiguration and competitive risks.', 'operation-twitch-leak', 1),
(105, 'Operation Microsoft Email Servers', 'Hafnium (ProxyLogon)', 'Investigate Hafnium\'s mass exploitation of Exchange servers using ProxyLogon vulnerabilities.', 'In early 2021, the world faced a massive cyber onslaught as Hafnium, a sophisticated APT group, exploited a series of zero-day vulnerabilities in Microsoft Exchange servers. With over 250,000 instances affected globally, organizations scrambled to patch their systems before the access was weaponized by ransomware operators. Trainees will dive into the intricate attack chain, from initial access to potential data exfiltration, and develop skills to counter such threats.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Hafnium\\\",\\\"ProxyLogon\\\",\\\"Exchange Server\\\",\\\"Cybersecurity Training\\\",\\\"Zero-day Vulnerabilities\\\"]\"', '', 3, '2026-01-24 03:31:55', 'Hafnium ProxyLogon Exploit Response Training', 'Investigate Hafnium\'s mass exploitation of Exchange servers using ProxyLogon vulnerabilities.', 'operation-microsoft-email-servers', 1),
(106, 'Operation Pegasus', 'NSO Group (Commercial Spyware)', 'Learn how to detect Pegasus spyware using zero-click iMessage exploits targeting journalists and more.', 'In this training scenario, you will dive into a complex investigation involving the notorious Pegasus spyware. Developed by the NSO Group, this commercial spyware has been used to target journalists, activists, and even heads of state. Your mission is to follow the trail of zero-click iMessage exploits, understand the FORCEDENTRY vulnerability, and identify forensic indicators on infected iOS devices. As a beginner, you\'ll explore each step of the attack chain, gaining valuable skills in identifying and mitigating these sophisticated threats.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Pegasus Spyware\\\",\\\"NSO Group\\\",\\\"iMessage Exploit\\\",\\\"FORCEDENTRY\\\",\\\"Cybersecurity Training\\\"]\"', '', 4, '2026-01-24 03:32:31', 'Beginner\'s Guide to Identifying Pegasus Spyware Activites', 'Learn how to detect Pegasus spyware using zero-click iMessage exploits targeting journalists and more.', 'operation-pegasus', 1),
(107, 'Operation APT1 Mandiant', 'APT1 (PLA Unit 61398)', 'Investigate APT1\'s cyber espionage tactics, analyzing their Shanghai-based operations and theft from over 141 organizations.', 'In a groundbreaking investigation, cybersecurity experts have traced a series of sophisticated cyber espionage activities back to APT1, a notorious Chinese military hacking group. Known for their relentless targeting of intellectual property across diverse industries, this operation unveils the intricate tactics of the \'Comment Crew\' and their Shanghai-based digital infrastructure. Trainees must navigate through the cyber labyrinth to understand and counteract the threat posed by these skilled adversaries.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"APT1\\\",\\\"cyber espionage\\\",\\\"Comment Crew\\\",\\\"intellectual property theft\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-24 03:34:20', 'Operation Comment Crew: Unmasking APT1\'s Cyber Espionage', 'Investigate APT1\'s cyber espionage tactics, analyzing their Shanghai-based operations and theft from over 141 organizations.', 'operation-apt1-mandiant', 1),
(108, 'Operation Regin', 'Five Eyes (GCHQ/NSA)', 'Uncover the intricate layers of a sophisticated modular malware used by Five Eyes APT for intelligence gathering.', 'In the heart of an international cyber espionage campaign, operatives from Five Eyes have deployed a modular malware platform targeting GSM base stations. This operation calls for a deep investigation into its encrypted virtual file system and multi-stage loading architecture. Analysts must unravel the complexity of this threat to protect critical communications infrastructure.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Five Eyes APT\\\",\\\"modular malware\\\",\\\"GSM targeting\\\",\\\"cyber espionage\\\",\\\"threat analysis\\\"]\"', '', 5, '2026-01-24 03:34:45', 'Five Eyes Modular Malware Investigation', 'Uncover the intricate layers of a sophisticated modular malware used by Five Eyes APT for intelligence gathering.', 'operation-regin', 1),
(109, 'Operation Duqu', 'Equation Group (Tilded Platform)', 'Analyze Stuxnet-related malware targeting ICS vendors, focusing on code lineage and intelligence gathering.', 'In this advanced training scenario, participants will delve into the intricate world of cyber espionage orchestrated by the notorious Equation Group. The mission involves dissecting a sophisticated reconnaissance malware linked to Stuxnet, targeting industrial control system vendors. As the team investigates, they will uncover shared code lineage, strategic intelligence gathering, and potential preparation for future attacks. The operation challenges participants to think like advanced threat actors and build a robust defense strategy.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Equation Group\\\",\\\"Stuxnet\\\",\\\"Industrial Control Systems\\\",\\\"Cyber Espionage\\\",\\\"Advanced Threats\\\"]\"', '', 5, '2026-01-24 03:35:12', 'Advanced Reconnaissance with Equation Group Tactics', 'Analyze Stuxnet-related malware targeting ICS vendors, focusing on code lineage and intelligence gathering.', 'operation-duqu', 1),
(110, 'Operation Careto', 'The Mask (Spanish-speaking APT)', 'Investigate The Mask\'s espionage targeting governments with Careto malware intercepting communications.', 'In a world where information is power, The Mask, a Spanish-speaking APT group, has launched a sophisticated espionage campaign. Their custom malware, Careto, is designed to intercept and manipulate communication channels within government institutions, diplomatic entities, and energy companies. As a senior analyst, you are tasked with uncovering their tactics, techniques, and procedures to protect critical infrastructures.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"The Mask APT\\\",\\\"Careto malware\\\",\\\"cyber espionage\\\",\\\"government security\\\",\\\"APT attack\\\"]\"', '', 5, '2026-01-24 03:39:29', 'Expert Espionage Analysis: Uncover The Mask\'s Careto Campaign', 'Investigate The Mask\'s espionage targeting governments with Careto malware intercepting communications.', 'operation-careto', 1),
(111, 'Operation Machete', 'Machete (Latin American APT)', 'Investigate Machete\'s espionage campaign targeting military and government in Venezuela, Ecuador, Colombia.', 'In recent months, the Machete APT group has been orchestrating a sophisticated espionage campaign targeted at military and government entities across Venezuela, Ecuador, and Colombia. Leveraging social engineering techniques, they deploy custom Python-based Remote Access Trojans (RATs) to infiltrate sensitive networks. Your task is to analyze their tactics and understand how these attacks unfold, from initial access to data exfiltration.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Machete APT\\\",\\\"Espionage\\\",\\\"Cybersecurity Training\\\",\\\"Latin America\\\",\\\"Python RATs\\\"]\"', '', 5, '2026-01-24 03:39:54', 'Operation Machete: Espionage in Latin America', 'Investigate Machete\'s espionage campaign targeting military and government in Venezuela, Ecuador, Colombia.', 'operation-machete', 1),
(112, 'Operation Poseidon', 'Poseidon Group', 'Explore Poseidon Group\'s tactics in extortion-driven attacks on banks, focusing on data leaks.', 'Welcome to the Poseidon Group threat simulation. In this scenario, you\'ll dive into the shadowy operations of a Brazilian-Portuguese speaking cybermercenary group targeting financial institutions. As a novice analyst, you will unravel their tactics, techniques, and procedures, tracing their path from initial breach to the brink of data extortion. Your mission is to thwart their plans and safeguard sensitive financial data.', 'novice', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Poseidon Group\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"financial institutions\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"data extortion\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 3, '2026-01-25 19:59:15', 'Poseidon Group Threat Simulation: Financial Institution Breach', 'Explore Poseidon Group\'s tactics in extortion-driven attacks on banks, focusing on data leaks.', 'operation-poseidon', 1),
(113, 'Operation Carbanak 2.0', 'FIN7 (Carbanak)', 'Uncover FIN7\'s shift from bank theft to point-of-sale system attacks using legitimate tools.', 'In the evolving landscape of cyber threats, the notorious APT group FIN7, also known as Carbanak, has adapted its tactics. Previously infamous for direct bank heists, FIN7 is now targeting point-of-sale (POS) systems across retail sectors. Leveraging legitimate penetration testing tools for illicit purposes, this operation requires analysts to trace the evolution of the malware and adapt their defensive strategies. Participants will investigate a series of alerts that reveal FIN7\'s cunning shift in tactics.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"FIN7\\\",\\\"Carbanak\\\",\\\"bank malware\\\",\\\"point-of-sale\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-28 00:03:11', 'FIN7\'s New Threat: From Banks to Point-of-Sale Systems', 'Uncover FIN7\'s shift from bank theft to point-of-sale system attacks using legitimate tools.', 'operation-carbanak-2-0', 1),
(114, 'Operation Silence', 'Silence Group', 'Investigate and neutralize Silence Group\'s ATM malware targeting Eastern European banks.', 'In the heart of Eastern Europe, a notorious Russian-speaking APT group, known as Silence Group, has been meticulously planning its next strike against financial institutions. Their objective: to compromise bank networks and gain control over ATMs. Your mission is to unravel their tactics, techniques, and procedures, focusing on their sophisticated reconnaissance and malware deployment phases.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Silence Group\\\",\\\"ATM malware\\\",\\\"Eastern Europe banks\\\",\\\"cybersecurity training\\\",\\\"APT threats\\\"]\"', '', 5, '2026-01-28 00:06:40', 'Advanced Threat Detection: Silence Group\'s ATM Malware Attack', 'Investigate and neutralize Silence Group\'s ATM malware targeting Eastern European banks.', 'operation-silence', 1),
(115, 'Operation Cobalt Gypsy', 'APT35 (Cobalt Gypsy)', 'Investigate APT35\'s cybersecurity operations targeting aerospace and telecom with Magic Hound malware.', 'In a climate of escalating international tensions, your cybersecurity team is tasked to investigate a sophisticated Iranian cyber-espionage campaign led by the notorious APT35 group, also known as Cobalt Gypsy. The operation focuses on their use of the \'Magic Hound\' malware, leveraging legitimate cloud services for command and control to infiltrate and extract sensitive data from aerospace and telecommunications sectors. Engage in this high-stakes scenario where expert skills are needed to unravel their methods and thwart their objectives.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"APT35\\\",\\\"Magic Hound\\\",\\\"cyber-espionage\\\",\\\"aerospace security\\\",\\\"telecommunications threat\\\"]\"', '', 5, '2026-01-28 00:07:19', 'Advanced Iranian Cyber-Espionage Simulation: APT35\'s Magic Hound Tactics', 'Investigate APT35\'s cybersecurity operations targeting aerospace and telecom with Magic Hound malware.', 'operation-cobalt-gypsy', 1),
(116, 'Operation Leafminer', 'Leafminer (Iranian APT)', 'Investigate Leafminer\'s espionage activities in the Middle East using Dropbox C2 and Total Commander RAT.', 'In the ever-evolving landscape of cyber threats, the Leafminer APT group has emerged as a formidable adversary. This Iranian group has launched a sophisticated espionage campaign targeting government and business entities across the Middle East. Leveraging Dropbox-based command and control (C2) infrastructure and exploiting the Total Commander remote access tool, Leafminer aims to infiltrate, persist, and exfiltrate sensitive information. Your mission is to unravel their tactics and mitigate the threat.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Leafminer APT\\\",\\\"Dropbox C2\\\",\\\"Total Commander RAT\\\",\\\"Middle East Espionage\\\",\\\"Cybersecurity Training\\\"]\"', '', 5, '2026-02-01 13:56:00', 'Leafminer Espionage Investigation: Dropbox C2 and Remote Access Exploitation', 'Investigate Leafminer\'s espionage activities in the Middle East using Dropbox C2 and Total Commander RAT.', 'operation-leafminer', 1),
(117, 'Operation Thamar Reservoir', 'APT35 (Charming Kitten)', 'Investigate APT35\'s targeted campaign against Israeli academics using fake conference lures for credential harvesting.', 'In this training scenario, you will step into the shoes of a cybersecurity analyst tasked with investigating a sophisticated spear-phishing campaign orchestrated by APT35, also known as Charming Kitten. This Iranian-linked group has launched a deceptive operation targeting Israeli academics and defense officials. Utilizing fake conference invitations, they aim to harvest credentials and infiltrate sensitive networks. Your mission is to unravel the layers of this operation and protect critical assets from being compromised.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT35\\\",\\\"Charming Kitten\\\",\\\"Credential Harvesting\\\",\\\"Cyber Threat Intelligence\\\",\\\"Cybersecurity Training\\\"]\"', '', 4, '2026-02-01 13:56:29', 'Charming Kitten\'s Deceptive Invitations: A Cyber Threat Analysis', 'Investigate APT35\'s targeted campaign against Israeli academics using fake conference lures for credential harvesting.', 'operation-thamar-reservoir', 1),
(118, 'Operation Spy Banker', 'RTM Group', 'Investigate RTM Group\'s banking trojan and its impact on Russian financial institutions.', 'In the bustling financial district of Moscow, a silent menace lurks in the shadows. The RTM Group, a notorious cybercrime syndicate, has launched a new wave of attacks targeting Russian banks. Their weapon of choice: a sophisticated banking trojan that disguises itself within legitimate software, silently monitoring the activities of unsuspecting accountants. As a novice cyber intelligence analyst, you are tasked with unraveling this cyber conundrum, tracing the trojan\'s path, and thwarting the RTM Group\'s malicious objectives.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"RTM Group\\\",\\\"banking trojan\\\",\\\"Russian financial institutions\\\",\\\"cybersecurity training\\\",\\\"cyber threat intelligence\\\"]\"', '', 3, '2026-02-01 13:56:59', 'RTM Group Trojan Analysis in Russian Banking', 'Investigate RTM Group\'s banking trojan and its impact on Russian financial institutions.', 'operation-spy-banker', 1),
(119, 'Operation TA505', 'TA505', 'Investigate TA505\'s transition from Dridex to Clop ransomware in this advanced cybersecurity operation.', 'In the high-stakes world of cyber warfare, TA505 stands out as a formidable adversary. Known for its financial motivation, this threat group has evolved its arsenal from distributing Dridex to unleashing the devastating Locky and Clop ransomware. As a senior analyst, your mission is to dissect their tactics, techniques, and procedures (TTPs) through a series of alerts that uncover their sophisticated attack chain. Each alert will challenge your skills in threat detection and incident response, leading you through the complex layers of a multi-stage attack.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"TA505\\\",\\\"cybersecurity operation\\\",\\\"Dridex\\\",\\\"Locky ransomware\\\",\\\"Clop ransomware\\\"]\"', '', 5, '2026-02-01 13:57:39', 'Advanced Threat Hunting: Unraveling TA505\'s Ransomware Evolution', 'Investigate TA505\'s transition from Dridex to Clop ransomware in this advanced cybersecurity operation.', 'operation-ta505', 1),
(120, 'Operation Winnti Evolution', 'Winnti Group', 'Investigate Winnti Group\'s code-signing certificate theft and supply chain attacks against game distributors.', 'In the heart of the gaming industry, a silent predator lurks. The notorious Winnti Group, known for its sophisticated supply chain attacks, has once again set its sights on the gaming sector. This operation delves into how this APT group orchestrates code-signing certificate thefts and manipulates game distribution networks to execute broader attacks. Trainees will navigate through a complex web of espionage and financial motives, tracing the group\'s footprints and countering their every move.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Winnti Group\\\",\\\"Supply Chain Attack\\\",\\\"Gaming Industry Espionage\\\",\\\"Cyber Defense Training\\\",\\\"APT41\\\"]\"', '', 5, '2026-02-01 14:00:16', 'Winnti Group Espionage in the Gaming Sector: A Cyber Defense Simulation', 'Investigate Winnti Group\'s code-signing certificate theft and supply chain attacks against game distributors.', 'operation-winnti-evolution', 1),
(121, 'Operation Tick', 'Tick (Bronze Butler)', 'Analyze Tick APT\'s use of the Daserf backdoor in targeting Japan\'s defense and aerospace sectors.', 'In this training scenario, participants will dive into the operations of the notorious Tick APT group, also known as Bronze Butler. Known for its espionage activities focused on Japan\'s defense, aerospace, and satellite technology sectors, Tick APT employs the Daserf backdoor to infiltrate and exfiltrate sensitive information. As a beginner analyst, you will learn to identify and respond to these sophisticated threats through a series of alerts that simulate a real-world attack.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Tick APT\\\",\\\"Daserf backdoor\\\",\\\"cyber espionage\\\",\\\"Japan defense\\\",\\\"aerospace security\\\"]\"', '', 5, '2026-02-01 14:00:41', 'Tick APT: Uncovering Espionage with Daserf', 'Analyze Tick APT\'s use of the Daserf backdoor in targeting Japan\'s defense and aerospace sectors.', 'operation-tick', 1),
(122, 'Operation Blackgear', 'Blackgear (Topgear)', 'Engage in an advanced cyber operation to dissect Blackgear\'s Taiwan-focused espionage, analyzing blog-based C2 and Protux backdoor.', 'In the high-stakes world of cyber espionage, nations constantly battle unseen adversaries. Taiwan, with its pivotal geopolitical status, has become a prime target for the notorious APT group Blackgear. This operation invites you to step into the shoes of a senior analyst, tasked with dissecting Blackgear\'s intricate espionage campaign. Your mission is to unravel their blog-based C2 infrastructure and the deployment of the Protux backdoor, targeting critical government and telecommunications sectors. Prepare for an immersive experience that challenges your investigative skills and strategic thinking.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Blackgear\\\",\\\"espionage\\\",\\\"Taiwan\\\",\\\"blog-based C2\\\",\\\"Protux backdoor\\\"]\"', '', 5, '2026-02-01 14:01:01', 'Advanced Blackgear Espionage Simulation: Unraveling Taiwan\'s Threat Landscape', 'Engage in an advanced cyber operation to dissect Blackgear\'s Taiwan-focused espionage, analyzing blog-based C2 and Protux backdoor.', 'operation-blackgear', 1),
(123, 'Operation Patchwork', 'Patchwork (Dropping Elephant)', 'Investigate Patchwork\'s code recycling tactics targeting Pakistan\'s military using borrowed malware techniques.', 'In the complex realm of cyber espionage, the South Asian group known as Patchwork, or Dropping Elephant, has made its mark through a unique approach: code recycling. By borrowing code snippets from a variety of malware families, they craft sophisticated attacks aimed at Pakistani military and diplomatic entities. As a cybersecurity defender, your mission is to delve into these recycled code techniques and uncover the group\'s strategies before they succeed in their espionage objectives.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Patchwork APT\\\",\\\"cyber espionage\\\",\\\"code recycling\\\",\\\"South Asian threat\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-02-01 14:01:23', 'Operation Recycled Code: Unmasking Patchwork\'s Espionage Tactics', 'Investigate Patchwork\'s code recycling tactics targeting Pakistan\'s military using borrowed malware techniques.', 'operation-patchwork', 1),
(124, 'Operation Sidewinder', 'Sidewinder (Rattlesnake)', 'Explore Sidewinder APT\'s tactics against military and government sectors in Pakistan and China.', 'In this training scenario, participants will delve into the activities of the Sidewinder APT, also known as Rattlesnake, a group notorious for its aggressive targeting of military and governmental entities in South Asia. Trainees will be tasked with investigating how this threat actor rapidly exploits newly disclosed vulnerabilities to infiltrate systems, aiming to gather intelligence and disrupt operations within Pakistan and China. The scenario will unfold through a series of alerts, simulating the APT\'s attack chain, challenging participants to identify and mitigate these threats effectively.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Sidewinder APT\\\",\\\"cybersecurity training\\\",\\\"South Asia threat\\\",\\\"vulnerability exploitation\\\",\\\"APT investigation\\\"]\"', '', 3, '2026-02-07 21:11:35', 'Sidewinder APT: Investigating Military Targeting in South Asia', 'Explore Sidewinder APT\'s tactics against military and government sectors in Pakistan and China.', 'operation-sidewinder', 1),
(125, 'Operation Transparent Tribe', 'APT36 (Transparent Tribe)', 'Investigate APT36\'s targeting of Indian military with Crimson RAT malware and fake personas.', 'In this training scenario, participants will delve into the tactics of APT36, also known as Transparent Tribe, an advanced persistent threat group with a focus on India. Trainees will explore how this Pakistani group employs the Crimson RAT malware and sophisticated social engineering techniques using fake personas. The mission is to follow the digital breadcrumbs, understand the kill chain, and develop skills to counteract these tactics.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT36\\\",\\\"Crimson RAT\\\",\\\"cybersecurity training\\\",\\\"honeytrap\\\",\\\"social engineering\\\"]\"', '', 5, '2026-02-07 21:12:40', 'Beginner Training: Analyzing APT36\'s Crimson RAT and Honeytrap Tactics', 'Investigate APT36\'s targeting of Indian military with Crimson RAT malware and fake personas.', 'operation-transparent-tribe', 1),
(126, 'Operation Donot Team', 'Donot Team (APT-C-35)', 'Investigate Donot Team\'s espionage on South Asian governments using Android malware and multi-platform attacks.', 'The South Asian geopolitical landscape has become the battleground for a sophisticated cyber espionage campaign orchestrated by the notorious Donot Team (APT-C-35). This scenario challenges you to delve into their multi-platform capabilities, focusing on their Android malware strategies against government and military entities. As an advanced cyber threat analyst, your mission is to uncover, analyze, and mitigate the impact of these covert operations.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Donot Team\\\",\\\"espionage campaigns\\\",\\\"Android malware\\\",\\\"multi-platform attacks\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-02-07 21:12:40', 'Advanced Analysis of Donot Team\'s Espionage Campaigns', 'Investigate Donot Team\'s espionage on South Asian governments using Android malware and multi-platform attacks.', 'operation-donot-team', 1),
(127, 'Operation Bitter', 'Bitter (T-APT-17)', 'Investigate Bitter APT\'s exploitation of InPage vulnerabilities and ArtraDownloader malware in South Asia.', 'In this expert-level training scenario, participants will delve into the complex operations of Bitter APT (T-APT-17) targeting South Asian governments. This mission involves analyzing their exploitation of InPage vulnerabilities, specifically targeting Urdu-language users, and the deployment of the ArtraDownloader malware. Trainees will navigate through a series of alerts to uncover Bitter\'s sophisticated attack strategies and defend against their persistent threats.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Bitter APT\\\",\\\"InPage Exploit\\\",\\\"ArtraDownloader\\\",\\\"South Asian Cybersecurity\\\",\\\"APT Training\\\"]\"', '', 5, '2026-02-07 21:13:22', 'Advanced Threat Operation: Unmasking Bitter APT in South Asia', 'Investigate Bitter APT\'s exploitation of InPage vulnerabilities and ArtraDownloader malware in South Asia.', 'operation-bitter', 1),
(128, 'Operation Spring Dragon', 'Lotus Blossom (Spring Dragon)', 'Investigate Lotus Blossom\'s espionage targeting ASEAN military and government sectors using the Elise backdoor.', 'In this intermediate-level training scenario, participants will delve into the sophisticated operations of the Lotus Blossom APT group, notorious for its decade-long espionage campaign against ASEAN countries. Trainees will analyze the deployment of the \'Elise\' backdoor, a tool that has facilitated the group\'s persistent infiltration into government and military networks. As the investigation unfolds, participants will uncover the nuances of this operation, enhancing their threat intelligence and response capabilities.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Lotus Blossom APT\\\",\\\"Elise backdoor\\\",\\\"ASEAN espionage\\\",\\\"cyber threat intelligence\\\",\\\"government cyber attack\\\"]\"', '', 5, '2026-02-07 21:20:05', 'Lotus Blossom Espionage Campaign Training Exercise', 'Investigate Lotus Blossom\'s espionage targeting ASEAN military and government sectors using the Elise backdoor.', 'operation-spring-dragon', 1),
(129, 'Operation Keyboy  ', 'KeyBoy (APT23)', 'Investigate how KeyBoy (APT23) exploits Office vulnerabilities to target media and NGOs in Vietnam.', 'In recent months, the cyber landscape has been rattled by a series of sophisticated attacks targeting media organizations and NGOs in Vietnam. At the heart of these operations is KeyBoy, a notorious APT group known for its precision and stealth. Our mission is to unravel their espionage campaign, focusing on their exploitation of Microsoft Office vulnerabilities. As a beginner analyst, you\'ll decode their tactics and safeguard vital information.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"KeyBoy APT23\\\",\\\"Vietnam Espionage\\\",\\\"Microsoft Office Exploits\\\",\\\"Cybersecurity Training\\\",\\\"Media and NGO Targeting\\\"]\"', '', 5, '2026-02-07 21:20:25', 'KeyBoy APT23: Uncovering Vietnam-focused Espionage', 'Investigate how KeyBoy (APT23) exploits Office vulnerabilities to target media and NGOs in Vietnam.', 'operation-keyboy', 1),
(130, 'Operation Mustang Panda', 'Mustang Panda (TA416)', 'Investigate Mustang Panda\'s espionage activities using PlugX malware and COVID-19 lures against Mongolian and Southeast Asian targets.', 'In this training scenario, participants will delve into the activities of Mustang Panda, a notorious Chinese APT group known for targeting Mongolian and Southeast Asian entities. The mission focuses on their use of the PlugX malware, distributed through COVID-19 themed phishing lures. Analysts are tasked with identifying and analyzing the threat actors\' tactics, techniques, and procedures (TTPs) to understand their espionage objectives and methodologies.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Mustang Panda\\\",\\\"PlugX malware\\\",\\\"COVID-19 lures\\\",\\\"Chinese APT\\\",\\\"cyber espionage\\\"]\"', '', 3, '2026-02-07 21:20:43', 'Mustang Panda APT Operation: Analyzing PlugX Malware and COVID-19 Lures', 'Investigate Mustang Panda\'s espionage activities using PlugX malware and COVID-19 lures against Mongolian and Southeast Asian targets.', 'operation-mustang-panda', 1),
(131, 'Operation LuckyMouse', 'LuckyMouse (APT27)', 'Investigate LuckyMouse\'s espionage on government and telecoms via watering hole attacks and HyperBro malware.', 'In a high-stakes digital landscape, the Chinese espionage group known as LuckyMouse (APT27) has launched a sophisticated campaign targeting government and telecommunications sectors. Leveraging watering hole attacks and deploying the notorious HyperBro malware, this threat actor aims to infiltrate sensitive networks and extract valuable intelligence. Participants must dissect this operation, tracing the attack from initial access through to data exfiltration, all while navigating complex threat landscapes.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"APT27\\\",\\\"LuckyMouse\\\",\\\"cyber espionage\\\",\\\"watering hole attack\\\",\\\"HyperBro malware\\\"]\"', '', 5, '2026-02-07 21:21:04', 'Advanced Cyber Ops Training: Unraveling APT27\'s Espionage Tactics', 'Investigate LuckyMouse\'s espionage on government and telecoms via watering hole attacks and HyperBro malware.', 'operation-luckymouse', 1),
(132, 'Operation BlackTech', 'BlackTech (Palmerworm)', 'Investigate BlackTech\'s espionage in East Asia, focusing on router firmware tampering and TSCookie malware in Japan and Taiwan.', 'In a shadowy operation targeting the technological hubs of Japan and Taiwan, the notorious APT group BlackTech, also known as Palmerworm, has launched a sophisticated espionage campaign. Their methods include tampering with router firmware and deploying the elusive TSCookie malware family. As a senior cyber threat intelligence analyst, your mission is to unravel this web of deceit and protect critical East Asian infrastructures from further compromise.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"BlackTech\\\",\\\"APT\\\",\\\"Espionage\\\",\\\"TSCookie\\\",\\\"Router Firmware\\\"]\"', '', 5, '2026-02-07 21:21:22', 'BlackTech Espionage Campaign: Router Firmware Tampering & TSCookie Analysis', 'Investigate BlackTech\'s espionage in East Asia, focusing on router firmware tampering and TSCookie malware in Japan and Taiwan.', 'operation-blacktech', 1),
(133, 'Operation Calypso', 'Calypso APT', 'Investigate Calypso APT\'s espionage campaign using PlugX and ProxyLogon against Central Asian governments.', 'In the heart of Central Asia, government institutions are under siege by the notorious Calypso APT. Known for their sophisticated cyber espionage campaigns, Calypso has launched a new operation focusing on intelligence gathering. Leveraging the ProxyLogon vulnerabilities for initial access, they deploy PlugX variants to maintain a foothold and extract sensitive data. As senior cyber threat intelligence analysts, your mission is to dissect and counteract this advanced threat, piecing together the clues left by the adversaries.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Calypso APT\\\",\\\"PlugX malware\\\",\\\"ProxyLogon vulnerability\\\",\\\"cyber espionage\\\",\\\"Central Asia\\\"]\"', '', 5, '2026-02-07 21:22:15', 'Calypso APT: Unraveling Espionage in Central Asia', 'Investigate Calypso APT\'s espionage campaign using PlugX and ProxyLogon against Central Asian governments.', 'operation-calypso', 1),
(139, 'Operation Clandestine Fox', 'APT3 (UPS)', 'Uncover APT3\'s exploitation of CVE-2014-1776 and Pirpi backdoor in a beginner-friendly cybersecurity operation.', 'In a high-stakes scenario, defense contractors are under threat from a sophisticated attack by APT3. Utilizing a zero-day vulnerability in Internet Explorer, they aim to deploy the Pirpi backdoor. As a cybersecurity analyst, you are tasked with piecing together clues from five critical alerts to unravel their tactics and secure your organization.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT3\\\",\\\"zero-day\\\",\\\"Internet Explorer\\\",\\\"CVE-2014-1776\\\",\\\"Pirpi backdoor\\\"]\"', '', 5, '2026-02-07 21:27:34', 'Investigate APT3\'s Internet Explorer Zero-Day Attack on Defense Contractors', 'Uncover APT3\'s exploitation of CVE-2014-1776 and Pirpi backdoor in a beginner-friendly cybersecurity operation.', 'operation-clandestine-fox', 1),
(134, 'Operation Emissary Panda', 'APT27 (Emissary Panda)', 'Conduct an expert-level investigation into APT27\'s targeting of aerospace and defense sectors using the HyperBro backdoor.', 'In an era where technology defines military superiority, APT27, known as Emissary Panda, has set its sights on the aerospace and defense industries. Leveraging the sophisticated HyperBro backdoor, this Chinese threat actor group systematically infiltrates and exfiltrates sensitive military technology. Your mission is to piece together the attack chain, drawing insights from a series of five alerts, each revealing a critical step in their operations.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"APT27\\\",\\\"cybersecurity training\\\",\\\"aerospace defense\\\",\\\"HyperBro backdoor\\\",\\\"military technology theft\\\"]\"', '', 5, '2026-02-07 21:22:39', 'Operation Sky Shield: Unveiling APT27\'s Aerospace Infiltration', 'Conduct an expert-level investigation into APT27\'s targeting of aerospace and defense sectors using the HyperBro backdoor.', 'operation-emissary-panda', 1),
(135, 'Operation Axiom', 'Axiom (Group 72)', 'Uncover Axiom\'s covert cyber-espionage tactics targeting NGOs and activists using the Hikit rootkit.', 'In the shadows of global diplomacy, the Axiom group, also known as Group 72, launches a clandestine operation targeting NGOs, dissidents, and pro-democracy organizations. Their mission: silence those who speak out for human rights. As a novice analyst, your task is to uncover their tracks, analyze the deployment of the Hikit rootkit, and understand their focus on neutralizing human rights activists. Navigate through a series of alerts that reveal Axiom\'s cunning strategies and stop them before they can cause irreparable harm.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"APT Group Axiom\\\",\\\"cyber-espionage\\\",\\\"Hikit rootkit\\\",\\\"human rights\\\",\\\"NGO cybersecurity\\\"]\"', '', 3, '2026-02-07 21:22:56', 'Operation Silent Dove: Axiom\'s Espionage on NGOs', 'Uncover Axiom\'s covert cyber-espionage tactics targeting NGOs and activists using the Hikit rootkit.', 'operation-axiom', 1),
(136, 'Operation Aurora 2.0', 'APT17 (Aurora Panda)', 'Investigate APT17\'s evolving tactics since the Aurora campaign, focusing on tech and defense targets.', 'In the aftermath of the infamous Aurora campaign, APT17, also known as Aurora Panda, continues to refine its tactics. This training scenario invites you to step into the role of an investigator tasked with unraveling APT17\'s latest maneuvers targeting the technology and defense sectors. As you track their operations, you\'ll explore their advanced tactics, techniques, and procedures (TTPs) and the persistent threats they pose.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT17\\\",\\\"cyber espionage\\\",\\\"Aurora\\\",\\\"technology sector\\\",\\\"defense sector\\\"]\"', '', 5, '2026-02-07 21:23:17', 'APT17 Post-Aurora Operations: Evolution in Cyber Espionage', 'Investigate APT17\'s evolving tactics since the Aurora campaign, focusing on tech and defense targets.', 'operation-aurora-2-0', 1),
(137, 'Operation Deputy Dog', 'APT17 (Deputy Dog)', 'Uncover APT17\'s Internet Explorer zero-day campaign against Japan, focusing on CVE-2013-3893 and watering hole tactics.', 'In the heart of Japan\'s bustling business district, whispers of a looming cyber threat have reached the ears of a dedicated team of cybersecurity operatives. An elusive adversary, APT17, known as Deputy Dog, is orchestrating a sophisticated campaign leveraging a zero-day vulnerability in Internet Explorer. Their target: prominent Japanese organizations. Participants are tasked with dissecting this complex operation, tracking the adversary from initial access to the final data exfiltration, and fortifying defenses against future incursions.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"APT17\\\",\\\"Zero-Day\\\",\\\"CVE-2013-3893\\\",\\\"Watering Hole Attack\\\",\\\"Cybersecurity Training\\\"]\"', '', 5, '2026-02-07 21:23:36', 'APT17\'s Zero-Day Assault: Defending Japanese Enterprises', 'Uncover APT17\'s Internet Explorer zero-day campaign against Japan, focusing on CVE-2013-3893 and watering hole tactics.', 'operation-deputy-dog', 1),
(138, 'Operation Ephemeral Hydra', 'APT17', 'Engage in a complex investigation of APT17\'s strategic web compromise on policy think tanks using multi-staged JavaScript injection.', 'In a world where information is power, policy think tanks become prime targets for nation-state actors. As a senior cyber threat intelligence analyst, you are tasked with unraveling APT17\'s sophisticated strategic web compromise. Your mission: analyze the multi-staged JavaScript injection and determine how this threat actor selectively targets visitors to gain unauthorized access to sensitive information.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"APT17\\\",\\\"JavaScript Injection\\\",\\\"Cybersecurity Training\\\",\\\"Strategic Web Compromise\\\",\\\"Advanced Threats\\\"]\"', '', 5, '2026-02-07 21:24:05', 'Advanced APT17 Strategic Web Compromise Investigation', 'Engage in a complex investigation of APT17\'s strategic web compromise on policy think tanks using multi-staged JavaScript injection.', 'operation-ephemeral-hydra', 1),
(140, 'Operation Clandestine Wolf', 'APT3', 'Investigate APT3\'s exploitation of CVE-2015-3113 and its evolution to newer techniques.', 'In mid-2015, cyber defenders faced a sophisticated campaign leveraging a zero-day exploit in Adobe Flash, CVE-2015-3113, orchestrated by APT3. Known for their stealth and advanced tactics, APT3\'s campaign evolved over time, incorporating newer exploitation techniques. Trainees will dissect this operation, understanding the adversary\'s strategies and fortifying defenses against similar threats.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"APT3\\\",\\\"Adobe Flash\\\",\\\"CVE-2015-3113\\\",\\\"Zero-Day\\\",\\\"Cybersecurity Training\\\"]\"', '', 5, '2026-02-07 21:27:58', 'APT3: Analyzing the Adobe Flash Zero-Day Campaign', 'Investigate APT3\'s exploitation of CVE-2015-3113 and its evolution to newer techniques.', 'operation-clandestine-wolf', 1),
(141, 'Operation Double Tap', 'APT3', 'Uncover APT3\'s dual zero-day campaign exploiting Flash and Windows, focusing on vulnerability chaining and Pirpi malware.', 'In this intermediate training operation, participants will delve into a sophisticated attack orchestrated by APT3. The group has launched a dual zero-day campaign, exploiting vulnerabilities in both Flash and Windows systems. Trainees must analyze the intricacies of vulnerability chaining and follow the trail of Pirpi malware deployments. This scenario challenges participants to trace the attack from initial access to data exfiltration, employing analytical skills and APT3\'s known techniques.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"APT3\\\",\\\"zero-day\\\",\\\"Flash exploit\\\",\\\"Windows vulnerability\\\",\\\"Pirpi malware\\\"]\"', '', 5, '2026-02-07 21:28:20', 'APT3 Zero-Day Chain Investigation Training', 'Uncover APT3\'s dual zero-day campaign exploiting Flash and Windows, focusing on vulnerability chaining and Pirpi malware.', 'operation-double-tap', 1),
(142, 'Operation Lotus Blossom', 'Lotus Blossom (Elise)', 'Uncover Lotus Blossom\'s Southeast Asian espionage campaign against military targets using the Elise backdoor.', 'In the shadows of Southeast Asia, an advanced persistent threat looms over military and government networks. Known as Lotus Blossom, this APT group has launched a sophisticated espionage campaign, leveraging their custom Elise backdoor to infiltrate and extract sensitive information from the Philippine military. As a senior cyber threat analyst, it is your mission to dissect their tactics, techniques, and procedures, and to thwart their malicious endeavors.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Lotus Blossom\\\",\\\"Elise backdoor\\\",\\\"cyber espionage\\\",\\\"military targeting\\\",\\\"APT investigation\\\"]\"', '', 5, '2026-02-07 21:46:54', 'Advanced Investigation of Lotus Blossom\'s Espionage Tactics', 'Uncover Lotus Blossom\'s Southeast Asian espionage campaign against military targets using the Elise backdoor.', 'operation-lotus-blossom', 1),
(143, 'Operation Hellsing', 'Hellsing', 'Investigate the rare APT-on-APT attack as Hellsing targets Naikon in an espionage group conflict.', 'In an unprecedented clash, the Hellsing group has launched an attack on rival APT group Naikon. This expert-level scenario immerses you in the high-stakes world of cyber espionage, where one group of state-sponsored hackers targets another. Your mission is to unravel the mystery behind this unusual conflict and understand the motivations and tactics of both sides. Analyze the attack chain and determine the implications of this inter-APT rivalry.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"APT-on-APT attack\\\",\\\"cyber espionage\\\",\\\"Hellsing\\\",\\\"Naikon\\\",\\\"cyber threat analysis\\\"]\"', '', 5, '2026-02-07 21:47:13', 'Hellsing vs Naikon: APT-on-APT Conflict Investigation', 'Investigate the rare APT-on-APT attack as Hellsing targets Naikon in an espionage group conflict.', 'operation-hellsing', 1),
(144, 'Operation Tropic Trooper', 'Tropic Trooper (KeyBoy)', 'Train to investigate Tropic Trooper\'s espionage targeting Taiwan and Philippines, focusing on military and government sectors.', 'In this training scenario, participants will dive into the covert world of Tropic Trooper, also known as KeyBoy. This APT group is known for its strategic espionage campaigns targeting Taiwan and the Philippines, particularly focusing on military and government institutions. Using the Yahoyah malware family, Tropic Trooper aims to infiltrate, execute operations, and exfiltrate sensitive data. Your mission is to unravel their tactics and uncover their objectives through a series of alerts.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Tropic Trooper\\\",\\\"KeyBoy\\\",\\\"Yahoyah malware\\\",\\\"cyber espionage\\\",\\\"cybersecurity training\\\"]\"', '', 3, '2026-02-07 21:47:32', 'Tropic Trooper Espionage Campaign Investigation', 'Train to investigate Tropic Trooper\'s espionage targeting Taiwan and Philippines, focusing on military and government sectors.', 'operation-tropic-trooper', 1),
(145, 'Operation Earth Lusca', 'Earth Lusca', 'Investigate Earth Lusca\'s use of ShadowPad and Cobalt Strike targeting governmental entities. Beginner-friendly.', 'In a rapidly evolving cyber landscape, the Chinese threat actor Earth Lusca has set its sights on government and intergovernmental organizations. Your mission is to analyze how they deploy ShadowPad backdoors and establish Cobalt Strike infrastructure. As a cybersecurity analyst, you will unravel their tactics, techniques, and procedures, piecing together the puzzle of a sophisticated cyber operation.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Earth Lusca\\\",\\\"ShadowPad\\\",\\\"Cobalt Strike\\\",\\\"cybersecurity training\\\",\\\"APT\\\"]\"', '', 5, '2026-02-07 21:47:55', 'Earth Lusca Cybersecurity Training: ShadowPad and Cobalt Strike Analysis', 'Investigate Earth Lusca\'s use of ShadowPad and Cobalt Strike targeting governmental entities. Beginner-friendly.', 'operation-earth-lusca', 1),
(146, 'Operation Sharp Panda', 'Sharp Panda', 'Explore Sharp Panda\'s espionage targeting Southeast Asian governments using the Soul framework and RoyalRoad RTF.', 'In this training scenario, participants will step into the shoes of a cyber threat intelligence analyst tasked with uncovering Sharp Panda\'s espionage campaign against Southeast Asian government entities. Utilizing advanced tools such as the Soul framework and the RoyalRoad RTF weaponizer, the attackers aim to infiltrate and exfiltrate sensitive governmental data. Trainees will navigate through multiple alerts to piece together the attacker\'s tactics, techniques, and procedures.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Sharp Panda\\\",\\\"APT Espionage\\\",\\\"Cybersecurity Training\\\",\\\"Soul Framework\\\",\\\"RoyalRoad RTF\\\"]\"', '', 5, '2026-02-24 03:12:43', 'Sharp Panda Espionage Investigation Training', 'Explore Sharp Panda\'s espionage targeting Southeast Asian governments using the Soul framework and RoyalRoad RTF.', 'operation-sharp-panda', 1);
INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(147, 'Operation Scarlet Mimic', 'Scarlet Mimic', 'Investigate Scarlet Mimic\'s espionage campaign using FakeM malware against Uyghur and Tibetan activists.', 'In the shadows of the digital battlefield, Scarlet Mimic has launched a new espionage campaign targeting minority rights activists. Their tool of choice: FakeM malware, a sophisticated weapon aimed at the Uyghur and Tibetan communities. As a beginner analyst, your mission is to unravel this web of deceit, understand the unique targeting tactics, and protect the vulnerable.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Scarlet Mimic\\\",\\\"FakeM malware\\\",\\\"cyber espionage\\\",\\\"minority rights\\\",\\\"Uyghur Tibetan targeting\\\"]\"', '', 5, '2026-02-24 03:13:19', 'Operation Scarlet Sentinel: Unmasking Espionage Against Minority Rights Activists', 'Investigate Scarlet Mimic\'s espionage campaign using FakeM malware against Uyghur and Tibetan activists.', 'operation-scarlet-mimic', 1),
(148, 'Operation Groundbait', 'Groundbait (Prikormka)', 'Investigate Groundbait\'s 2014 Ukraine-focused espionage targeting activists and separatists.', 'In the tense prelude to the 2014 Ukraine conflict, the shadowy APT group known as Groundbait launched a covert espionage operation. Their targets were anti-government activists and separatists, aiming to gather intelligence and sow discord. As the cyber threat intelligence team, your mission is to dissect this campaign, tracing the steps of Groundbait through a series of alerts that reveal their tactics, techniques, and procedures.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Groundbait\\\",\\\"Ukraine Espionage\\\",\\\"Cybersecurity Training\\\",\\\"APT Group\\\",\\\"2014 Conflict\\\"]\"', '', 5, '2026-02-24 03:13:43', 'Groundbait Espionage Campaign: Ukraine 2014', 'Investigate Groundbait\'s 2014 Ukraine-focused espionage targeting activists and separatists.', 'operation-groundbait', 1),
(149, 'Operation BugDrop', 'Unknown (Ukraine-focused)', 'Investigate an APT\'s advanced surveillance targeting Ukrainian infrastructure via PC microphones and Dropbox exfiltration.', 'In the wake of escalating tensions, an unknown APT group has launched a sophisticated surveillance campaign against Ukrainian infrastructure organizations. Exploiting PC microphones for eavesdropping and using Dropbox for data exfiltration, this operation requires advanced investigative skills to uncover and mitigate the threat. Dive into the covert world of Operation Whisper and unravel the methods used by these elusive cyber adversaries.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"cybersecurity training\\\",\\\"APT surveillance\\\",\\\"Ukraine cyber threats\\\",\\\"Dropbox exfiltration\\\",\\\"advanced threat protection\\\"]\"', '', 5, '2026-02-24 03:14:08', 'Operation Whisper: Unmasking the Surveillance Threat', 'Investigate an APT\'s advanced surveillance targeting Ukrainian infrastructure via PC microphones and Dropbox exfiltration.', 'operation-bugdrop', 1),
(150, 'Operation Armageddon', 'Gamaredon', 'Investigate Gamaredon\'s high-volume targeting campaign in Ukraine, focusing on template injection and links to Russian security services.', 'In this expert-level training scenario, participants will delve into the intricacies of Gamaredon\'s recent surge in cyber operations targeting Ukraine. With a focus on understanding the sophisticated template injection techniques employed and scrutinizing potential connections to Russian security services, trainees will navigate through a series of alerts that reveal the attackers\' strategic objectives and methodologies.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Gamaredon\\\",\\\"Ukrainian cyber defense\\\",\\\"template injection\\\",\\\"Russian APT\\\",\\\"cybersecurity training\\\"]\"', '', 7, '2026-02-24 03:14:43', 'Expert Analysis of Gamaredon\'s Ukrainian Campaign', 'Investigate Gamaredon\'s high-volume targeting campaign in Ukraine, focusing on template injection and links to Russian security services.', 'operation-armageddon', 1),
(151, 'Operation IndigoZebra', 'IndigoZebra', 'Investigate IndigoZebra\'s Central Asian espionage, focusing on Dropbox API abuse and xCaon malware.', 'In the heart of Central Asia, government entities are under siege. The notorious APT group, IndigoZebra, has launched a sophisticated espionage campaign. Utilizing the Dropbox API for covert command and control, and deploying the elusive xCaon malware family, they aim to infiltrate, persist, and exfiltrate sensitive information. Your mission is to dismantle their operations and protect national security.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"IndigoZebra\\\",\\\"Central Asian espionage\\\",\\\"Dropbox API abuse\\\",\\\"xCaon malware\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-03-01 22:54:53', 'IndigoZebra: Unveiling the Central Asian Espionage Campaign', 'Investigate IndigoZebra\'s Central Asian espionage, focusing on Dropbox API abuse and xCaon malware.', 'operation-indigozebra', 1),
(152, 'Operation Moses Staff', 'Moses Staff (Iranian)', 'Explore the tactics of Moses Staff targeting Israeli organizations with DCSrv wiper and political data leaks.', 'In this hands-on training scenario, participants will step into the shoes of a cyber threat intelligence analyst tasked with investigating the notorious Iranian APT group, Moses Staff. Known for their politically-motivated cyber operations against Israeli organizations, this group employs sophisticated tactics to not only disrupt but also to make a political statement through data leaks. Trainees will delve into the analysis of the DCSrv wiper malware, uncovering the methods used by this APT to infiltrate and compromise targets. By following the trail of alerts, participants will learn to piece together a comprehensive picture of the attack, understanding the motivations and techniques of the adversary.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Moses Staff\\\",\\\"Iranian APT\\\",\\\"DCSrv Wiper\\\",\\\"Cybersecurity Training\\\",\\\"Data Leaks\\\"]\"', '', 3, '2026-03-01 22:55:17', 'Investigate Moses Staff: Unveiling Iranian Hacktivist Attacks on Israel', 'Explore the tactics of Moses Staff targeting Israeli organizations with DCSrv wiper and political data leaks.', 'operation-moses-staff', 1),
(153, 'Agrius (Iranian)', 'Agrius (Iranian)', 'Explore Agrius APT\'s tactics with Apostle wiper mimicking ransomware in attacks on Israeli targets.', 'In the world of cyber warfare, the Iranian APT group Agrius is notorious for its unique blend of espionage and destructive attacks. This operation takes you through a simulated investigation into their signature move: deploying the Apostle wiper disguised as ransomware, with a particular focus on Israeli targets. Your mission is to unravel the sequence of events and prevent a catastrophe.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Agrius APT\\\",\\\"Apostle wiper\\\",\\\"cyber espionage\\\",\\\"ransomware\\\",\\\"Israeli cybersecurity\\\"]\"', '', 5, '2026-03-01 22:55:41', 'Investigating Agrius APT: Espionage and Destruction with Apostle Wiper', 'Explore Agrius APT\'s tactics with Apostle wiper mimicking ransomware in attacks on Israeli targets.', 'agrius-iranian', 1),
(154, 'Operation MuddyC3', 'MuddyWater', 'Analyze MuddyWater\'s PowerShell backdoors targeting Middle Eastern telecoms in this advanced cybersecurity operation.', 'As a senior cyber threat intelligence analyst, you are tasked with delving into the complex and evolving tactics of MuddyWater, an APT group known for its sophisticated cyber operations. Recently, MuddyWater has been observed refining its custom Command and Control (C2) framework, leveraging PowerShell-based backdoors to infiltrate and exploit telecommunications companies in the Middle East. Your mission is to investigate these developments, understand their methodologies, and identify strategic vulnerabilities.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"MuddyWater\\\",\\\"PowerShell backdoors\\\",\\\"C2 framework\\\",\\\"Middle Eastern telecommunications\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-03-01 22:56:11', 'Advanced Investigation into MuddyWater\'s Evolving C2 Framework', 'Analyze MuddyWater\'s PowerShell backdoors targeting Middle Eastern telecoms in this advanced cybersecurity operation.', 'operation-muddyc3', 1),
(155, 'Operation Lyceum', 'Lyceum (Hexane)', 'Investigate Lyceum\'s sophisticated operations against oil, gas, and telecom sectors using DanBot malware for credential harvesting.', 'In the heat of geopolitical tensions, the infamous Iranian APT group, Lyceum, has initiated a campaign targeting the vital oil, gas, and telecommunications sectors in the Middle East. As cyber defenders, you\'re tasked with uncovering their covert operations, analyzing the DanBot malware, and thwarting their relentless attempts to compromise sensitive credentials. This expert-level scenario demands a keen eye and strategic thinking to connect the dots and mitigate the threat posed by this adept adversary.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Lyceum APT\\\",\\\"DanBot Malware\\\",\\\"Cyber Threat Intelligence\\\",\\\"Credential Harvesting\\\",\\\"Middle East Cybersecurity\\\"]\"', '', 6, '2026-03-01 22:56:37', 'Expert Analysis of Lyceum\'s Targeted Attacks in the Middle East', 'Investigate Lyceum\'s sophisticated operations against oil, gas, and telecom sectors using DanBot malware for credential harvesting.', 'operation-lyceum', 1),
(156, 'Operation Kimsuky Campaign', 'Kimsuky (Thallium)', 'Investigate Kimsuky espionage tactics using AppleSeed and phishing against South Korean entities in this novice-level scenario.', 'The infamous North Korean APT group Kimsuky is back on the radar. Known for its focus on intelligence gathering, the group is now targeting South Korea\'s government and Unification Ministry. Your mission is to delve into their operations, unravel the use of the AppleSeed backdoor, and dismantle their credential phishing infrastructure. As a novice analyst, you\'ll piece together clues from a series of alerts to protect critical national interests.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Kimsuky\\\",\\\"cyber espionage\\\",\\\"AppleSeed\\\",\\\"phishing\\\",\\\"APT\\\"]\"', '', 5, '2026-03-01 23:00:24', 'Kimsuky Espionage Simulation: Unmasking North Korean Threats', 'Investigate Kimsuky espionage tactics using AppleSeed and phishing against South Korean entities in this novice-level scenario.', 'operation-kimsuky-campaign', 1),
(157, 'Operation Andariel Heist', 'Andariel (Silent Chollima)', 'Investigate Andariel\'s ATM hacks and IP theft in South Korea\'s defense sector.', 'In the ever-evolving landscape of cyber warfare, the Andariel Group, a notorious North Korean APT, has set its sights on South Korea\'s financial and defense sectors. Trainees must unravel the group\'s tactics, from ATM heists to the theft of sensitive defense contractor data. This mission is critical to ensuring the security of national resources and infrastructures.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Andariel APT\\\",\\\"Cybersecurity Training\\\",\\\"South Korea Defense\\\",\\\"ATM Hacks\\\",\\\"Intellectual Property Theft\\\"]\"', '', 5, '2026-03-01 23:00:47', 'Andariel\'s Assault: Defense and Finance Under Siege', 'Investigate Andariel\'s ATM hacks and IP theft in South Korea\'s defense sector.', 'operation-andariel-heist', 1),
(158, 'Operation BlueNoroff', 'BlueNoroff (Lazarus Subgroup)', 'Investigate BlueNoroff\'s SnatchCrypto campaign using AppleJeus malware against cryptocurrency startups.', 'In the shadowy world of cryptocurrency, a formidable adversary lurks. BlueNoroff, a subgroup of the infamous Lazarus Group, has launched the SnatchCrypto campaign, targeting emerging cryptocurrency startups. Their weapon of choice? The insidious AppleJeus malware. As a senior cyber threat intelligence analyst, you must delve into the depths of this operation, piecing together clues to thwart this sophisticated attack. From initial access to exfiltration, every step holds the key to unraveling BlueNoroff\'s grand scheme.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"BlueNoroff\\\",\\\"SnatchCrypto\\\",\\\"AppleJeus\\\",\\\"cryptocurrency\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-03-01 23:01:11', 'BlueNoroff\'s SnatchCrypto: Analyzing AppleJeus in Crypto Startups', 'Investigate BlueNoroff\'s SnatchCrypto campaign using AppleJeus malware against cryptocurrency startups.', 'operation-bluenoroff', 1),
(159, 'Operation TraderTraitor', 'Lazarus Group', 'Investigate Lazarus Group\'s targeting of cryptocurrency traders using trojanized apps and social engineering of developers.', 'In recent months, a surge in attacks targeting cryptocurrency traders and investors has been attributed to the infamous Lazarus Group. Known for their financial theft and espionage capabilities, this North Korean APT is now employing trojanized trading applications and sophisticated social engineering tactics to infiltrate blockchain development communities. Participants will navigate through a series of alerts, unraveling a complex plot aimed at exfiltrating valuable cryptocurrency assets.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"cryptocurrency attack\\\",\\\"trojanized applications\\\",\\\"social engineering\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-03-01 23:01:32', 'Lazarus Group Cryptocurrency Heist Simulation', 'Investigate Lazarus Group\'s targeting of cryptocurrency traders using trojanized apps and social engineering of developers.', 'operation-tradertraitor', 1),
(160, 'Operation Dream Job', 'Lazarus Group', 'Investigate Lazarus Group\'s LinkedIn-based social engineering targeting aerospace engineers with fake job offers.', 'In a new wave of cyber espionage, the notorious Lazarus Group has launched a sophisticated campaign targeting aerospace and defense engineers via LinkedIn. Using fake job offers as lures, the group seeks to infiltrate secure networks, gather intelligence, and potentially disrupt operations. This operation requires expert-level analysis to unearth the connections, trace the origins, and dismantle the threat.', 'expert', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"LinkedIn Phishing\\\",\\\"Aerospace Cybersecurity\\\",\\\"APT Threats\\\",\\\"Cyber Espionage\\\"]\"', '', 6, '2026-03-01 23:02:16', 'Lazarus Group\'s Aerospace and Defense Job Lure Campaign', 'Investigate Lazarus Group\'s LinkedIn-based social engineering targeting aerospace engineers with fake job offers.', 'operation-dream-job', 1),
(161, 'Operation In(ter)ception', 'Lazarus Group', 'Join the investigation into Lazarus Group\'s aerospace campaign, analyzing Mac malware and social engineering tactics.', 'The Lazarus Group, notorious for its sophisticated cyber operations, has shifted its sights to the aerospace and military contractor sector. With a history of high-profile attacks, this North Korean APT group blends espionage with financial motives. Trainees will delve into a campaign involving custom Mac malware and intricate social engineering, unraveling the layers of a cyber operation designed to breach sensitive industry networks.', 'novice', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"cybersecurity training\\\",\\\"aerospace defense\\\",\\\"Mac malware\\\",\\\"social engineering\\\"]\"', '', 3, '2026-03-03 22:00:09', 'Lazarus Group: Unmasking the Aerospace Campaign', 'Join the investigation into Lazarus Group\'s aerospace campaign, analyzing Mac malware and social engineering tactics.', 'operation-in-ter-ception', 1),
(162, 'Operation AppleJeus', 'Lazarus Group', 'Beginner scenario exploring Lazarus Group\'s first macOS malware and crypto exchange targeting.', 'In early 2023, a surge of compromised cryptocurrency trading applications hit the market. These apps, seemingly legitimate, were secretly crafted by the Lazarus Group, notorious for blending espionage with financial theft. Analysts must now delve into the first known macOS malware by Lazarus, following the group\'s footprints as they target cryptocurrency exchanges.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"Lazarus Group\\\",\\\"macOS malware\\\",\\\"cryptocurrency\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-03-03 22:02:11', 'Investigating Lazarus Group\'s Trojanized Crypto Apps', 'Beginner scenario exploring Lazarus Group\'s first macOS malware and crypto exchange targeting.', 'operation-applejeus', 1),
(163, 'Operation CryptoCore', 'CryptoCore (Lazarus-linked)', 'Investigate CryptoCore\'s sophisticated spear-phishing and password manager exploitation targeting cryptocurrency exchanges.', 'In the heart of the digital currency revolution, a shadowy collective, CryptoCore, has unleashed a campaign targeting the lifeblood of cryptocurrency exchanges. With hundreds of millions at stake, their sophisticated spear-phishing tactics and cunning exploitation of password managers have propelled them into the limelight of global cyber investigations. As a senior analyst, your mission is to dismantle their operation, trace the digital breadcrumbs, and safeguard financial fortresses against impending threats.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"CryptoCore\\\",\\\"spear-phishing\\\",\\\"password manager\\\",\\\"cybersecurity\\\",\\\"cryptocurrency exchanges\\\"]\"', '', 5, '2026-03-07 00:49:22', 'Operation Crypto Heist: Unveiling CryptoCore\'s Deception', 'Investigate CryptoCore\'s sophisticated spear-phishing and password manager exploitation targeting cryptocurrency exchanges.', 'operation-cryptocore', 1),
(164, 'Operation FASTCash', 'APT38 (Lazarus)', 'Uncover APT38\'s ATM cash-out scheme manipulating transaction switches in Africa and Asia.', 'In the bustling financial districts of Africa and Asia, an elusive adversary lurks behind the shadows of digital transactions. Lazarus Group, North Korea\'s notorious cyber unit, has launched a sophisticated ATM cash-out scheme. Your mission is to delve into the depths of their operation, unravel the manipulation of transaction switches, and dismantle the coordinated mule networks threatening global financial stability. Prepare to face the advanced tactics of APT38 in this high-stakes cyber investigation.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"APT38\\\",\\\"Cybersecurity Training\\\",\\\"Financial Crime\\\",\\\"Lazarus Group\\\",\\\"ATM Cash-Out\\\"]\"', '', 5, '2026-03-07 00:49:55', 'Advanced Investigation: APT38 ATM Cash-Out in Africa and Asia', 'Uncover APT38\'s ATM cash-out scheme manipulating transaction switches in Africa and Asia.', 'operation-fastcash', 1),
(165, 'Operation Blockbuster- Sony Pictures', 'Lazarus Group', 'Engage in an in-depth analysis of the Sony Pictures cyber attack to uncover the role of Lazarus Group in this high-profile incident.', 'In 2014, Sony Pictures became the target of a notorious cyber attack, leading to the leak of sensitive data and a significant blow to the entertainment giant\'s operations. As an expert cyber threat intelligence analyst, your mission is to conduct a thorough investigation to attribute this attack to the infamous Lazarus Group. Analyze code similarities, infrastructure overlaps, and North Korean attribution indicators to piece together the puzzle of this complex cyber operation.', 'expert', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sony Pictures attack\\\\\\\",\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"Cybersecurity training\\\\\\\",\\\\\\\"APT analysis\\\\\\\",\\\\\\\"North Korean cyber threat\\\\\\\"]\\\"\"', '', 5, '2026-03-07 00:50:18', 'Expert Training: Unraveling the Sony Pictures Cyber Attack', 'Engage in an in-depth analysis of the Sony Pictures cyber attack to uncover the role of Lazarus Group in this high-profile incident.', 'operation-blockbuster-sony-pictures', 1),
(166, 'Operation Salt Typhoon', 'Salt Typhoon', 'Train against Salt Typhoon\'s breach of federal wiretap systems in 2026, a beginner-level cybersecurity operation.', 'In 2026, the world witnessed an unprecedented cyber event when Salt Typhoon, an APT group linked to Chinese state-sponsored actors, executed a massive breach of federal wiretap systems. This training scenario immerses participants in the unfolding crisis, challenging them to defend against the adversary\'s tactics and protect sensitive communications.', 'beginner', 0, 1, 0, 60, NULL, '\"\\\"[\\\\\\\"Salt Typhoon\\\\\\\",\\\\\\\"APT Group\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\",\\\\\\\"Wiretap Breach\\\\\\\",\\\\\\\"Beginner\\\\\\\"]\\\"\"', '', 5, '2026-03-10 17:42:53', 'Salt Typhoon: Federal Wiretap Breach Training', 'Train against Salt Typhoon\'s breach of federal wiretap systems in 2026, a beginner-level cybersecurity operation.', 'operation-salt-typhoon', 1),
(167, 'Hidden Cobra\'s Cyber Strikes on Critical Infrastructure and Entertainment', 'Hidden Cobra (Lazarus)', 'Analyze Hidden Cobra\'s cyber operations targeting critical infrastructure and entertainment sectors with Destover and reconnaissance on Turkish financial systems.', 'In an era where cyber warfare shapes geopolitical landscapes, the notorious Lazarus Group—also known as Hidden Cobra—sets its sights on global critical infrastructure and entertainment sectors. As a senior cyber threat intelligence analyst, your mission is to dissect the group\'s latest incursions, focusing on the deployment of Destover wiper variants and subtle reconnaissance activities against Turkish financial systems. Unravel their tactics and protect vital assets from being caught in the crossfire of cyber espionage.', 'intermediate', 0, 1, 1, 60, NULL, '[\"Hidden Cobra\",\"cybersecurity training\",\"critical infrastructure\",\"Destover wiper\",\"Lazarus Group\"]', NULL, 5, '2026-03-15 19:05:48', 'Hidden Cobra\'s Cyber Strikes on Critical Infrastructure and Entertainment', 'Analyze Hidden Cobra\'s cyber operations targeting critical infrastructure and entertainment sectors with Destover and reconnaissance on Turkish financial systems.', 'operation-ghost-secret', 1),
(168, 'Lazarus Group: Advanced Threat Analysis Training', 'Lazarus Group', 'Investigate Lazarus Group\'s Rising Sun implant targeting defense, nuclear, and energy sectors.', 'In a world where national security is paramount, the Lazarus Group, North Korea\'s notorious cyber operations unit, has set its sights on the global defense, nuclear, and energy sectors. Using sophisticated tactics such as the Rising Sun implant and deceptive job recruitment lures, they aim to infiltrate and exploit critical infrastructure. This scenario challenges participants to unravel the complex web of cyber espionage and financial theft orchestrated by this infamous APT group.', 'advanced', 0, 1, 1, 60, NULL, '[\"Lazarus Group\",\"cybersecurity training\",\"advanced threat\",\"APT analysis\",\"Rising Sun implant\"]', NULL, 5, '2026-03-15 19:06:11', 'Lazarus Group: Advanced Threat Analysis Training', 'Investigate Lazarus Group\'s Rising Sun implant targeting defense, nuclear, and energy sectors.', 'operation-sharpshooter', 1),
(169, 'Defending Against Kimsuky: Protecting South Korean Think Tanks', 'Kimsuky', 'Investigate Kimsuky\'s targeting of South Korean think tanks using GoldDragon malware and Hangul Word Processor exploits.', 'In the shadowy world of cyber espionage, Kimsuky is known for its relentless pursuit of sensitive information. Recently, South Korean think tanks and North Korea watchers have become prime targets. This operation focuses on understanding and mitigating the threats posed by the GoldDragon malware family and the exploitation of the Hangul Word Processor (HWP), aiming to arm cybersecurity professionals with the knowledge to defend against such sophisticated attacks.', 'expert', 0, 1, 1, 60, NULL, '[\"Kimsuky\",\"GoldDragon malware\",\"Hangul Word Processor\",\"cyber espionage\",\"APT threat\"]', NULL, 6, '2026-03-15 19:06:32', 'Defending Against Kimsuky: Protecting South Korean Think Tanks', 'Investigate Kimsuky\'s targeting of South Korean think tanks using GoldDragon malware and Hangul Word Processor exploits.', 'operation-golddragon', 1),
(170, 'Kimsuky Cyber Espionage: A Novice Investigation into Interview Bait and Data Theft', 'Kimsuky', 'Explore Kimsuky\'s tactics involving fake interviews to infiltrate journalists and academics, leading to Chrome extension-based email theft.', 'In the heart of a bustling newsroom, journalists find themselves targeted by the notorious Kimsuky group. Known for their sophisticated social engineering techniques, they employ fake interview requests to gain initial access. As tension mounts, the story unfolds with Chrome extensions silently siphoning off sensitive email data. Are you ready to uncover the truth behind the deception?', 'novice', 0, 1, 1, 60, NULL, '[\"Kimsuky\",\"cyber espionage\",\"fake interview\",\"Chrome extension\",\"email theft\"]', NULL, 5, '2026-03-15 19:06:57', 'Kimsuky Cyber Espionage: A Novice Investigation into Interview Bait and Data Theft', 'Explore Kimsuky\'s tactics involving fake interviews to infiltrate journalists and academics, leading to Chrome extension-based email theft.', 'operation-smoke-screen', 1),
(171, 'APT41 Healthcare Data Breach Investigation', 'APT41 (Black Vine)', 'Explore APT41\'s Mivast backdoor in a healthcare data theft scenario, focusing on health insurance info.', 'In an unprecedented breach, a renowned healthcare facility has fallen victim to APT41, a notorious cyber espionage group. Known for their dual motives, APT41 has deployed the Mivast backdoor to infiltrate systems and exfiltrate sensitive patient data, with a unique focus on health insurance information. Your task is to follow their trail, understand their tactics, and mitigate further damage.', 'beginner', 0, 1, 1, 60, NULL, '[\"APT41\",\"Healthcare Cybersecurity\",\"Mivast Backdoor\",\"Patient Data Breach\",\"Cyber Threat Intelligence\"]', NULL, 5, '2026-03-15 19:07:18', 'APT41 Healthcare Data Breach Investigation', 'Explore APT41\'s Mivast backdoor in a healthcare data theft scenario, focusing on health insurance info.', 'operation-black-vine', 1),
(172, 'Investigating APT41\'s ASUS Supply Chain Attack', 'APT41 (Barium)', 'Understand APT41\'s ASUS supply chain attack targeting 600 specific MAC addresses amidst millions, enhancing your threat hunting skills.', 'In 2019, the world witnessed a sophisticated supply chain attack orchestrated by APT41, a notorious Chinese threat group. This operation compromised ASUS software updates, affecting millions of users. However, hidden within this mass distribution was a surgical strike aimed at 600 specific MAC addresses. As part of a cybersecurity operation team, your mission is to dissect this attack, uncover the methods used, and identify the targeted victims. This scenario will test your threat hunting and analytical skills in a real-world context.', 'intermediate', 0, 1, 1, 60, NULL, '[\"APT41\",\"Supply Chain Attack\",\"ASUS\",\"Cybersecurity Training\",\"Threat Intelligence\"]', NULL, 5, '2026-03-15 19:07:43', 'Investigating APT41\'s ASUS Supply Chain Attack', 'Understand APT41\'s ASUS supply chain attack targeting 600 specific MAC addresses amidst millions, enhancing your threat hunting skills.', 'operation-shadowhammer', 1),
(173, 'Advanced Investigation: Unraveling NetTraveler\'s Decade-Long Espionage', 'NetTraveler', 'Investigate NetTraveler\'s espionage campaign targeting government and diplomatic entities with a focus on Tibetan activists.', 'In this advanced training scenario, participants will delve into the ten-year espionage campaign orchestrated by the notorious APT group, NetTraveler. Known for their strategic targeting of government and diplomatic entities, this operation will challenge trainees to dissect the group\'s use of a simple yet effective Remote Access Trojan (RAT) and understand their specific focus on Tibetan activists. Trainees will navigate through a series of alerts that reflect real-world intelligence gathered from this persistent threat, honing their skills in identifying and mitigating advanced cyber threats.', 'advanced', 0, 1, 1, 60, NULL, '[\"NetTraveler\",\"espionage campaign\",\"cybersecurity training\",\"RAT\",\"Tibetan activists\"]', NULL, 5, '2026-03-15 19:08:07', 'Advanced Investigation: Unraveling NetTraveler\'s Decade-Long Espionage', 'Investigate NetTraveler\'s espionage campaign targeting government and diplomatic entities with a focus on Tibetan activists.', 'operation-nettraveler', 1),
(174, 'IceFog\'s Hit and Run Espionage: Defense Supply Chain Threat Analysis', 'IceFog', 'Investigate IceFog\'s \'hit and run\' espionage on Japan and South Korea\'s defense supply chains.', 'In this beginner-level training scenario, participants will step into the shoes of a cyber threat intelligence analyst tasked with unraveling the mystery behind IceFog\'s \'hit and run\' espionage campaign. This APT group is known for its swift, surgical strikes on defense supply chains in Japan and South Korea. As you navigate through a series of alerts, you\'ll uncover the techniques employed by IceFog and learn to identify and mitigate such threats in real-time.', 'beginner', 0, 1, 1, 60, NULL, '[\"IceFog\",\"cyber espionage\",\"defense supply chain\",\"APT\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:08:26', 'IceFog\'s Hit and Run Espionage: Defense Supply Chain Threat Analysis', 'Investigate IceFog\'s \'hit and run\' espionage on Japan and South Korea\'s defense supply chains.', 'operation-icefog', 1),
(175, 'Operation Counter-Hack: Unveiling the Hacking Team Breach', 'Unknown (Counter-Hack)', 'Advanced investigation into the Hacking Team breach, revealing zero-days and industry impacts.', 'In a shocking turn of events, the Italian surveillance vendor Hacking Team has been compromised, exposing critical zero-day vulnerabilities and a controversial customer list. As a seasoned analyst, your task is to unravel the mystery behind this breach, assess the damage, and understand its implications on the global surveillance industry.', 'advanced', 0, 1, 1, 60, NULL, '[\"cybersecurity training\",\"Hacking Team breach\",\"zero-day vulnerabilities\",\"surveillance industry\"]', NULL, 5, '2026-03-15 19:08:48', 'Operation Counter-Hack: Unveiling the Hacking Team Breach', 'Advanced investigation into the Hacking Team breach, revealing zero-days and industry impacts.', 'operation-hacking-team', 1),
(176, 'Investigating Gamma Group\'s Surveillance Software Deployments', 'Commercial Spyware (Gamma Group)', 'Expert analysis of Gamma Group\'s spyware tactics, focusing on infection vectors, mobile device targeting, and human rights impacts.', 'In the digital shadows, the Gamma Group\'s commercial spyware has sparked global controversy. Tasked with unraveling the threads of their operations, your mission is to dive deep into the heart of their surveillance software deployments. As you navigate through sophisticated infection vectors and mobile device targeting, you\'ll uncover the stark human rights implications at play. This operation demands precision, expertise, and an unwavering commitment to justice.', 'expert', 0, 1, 1, 60, NULL, '[\"Gamma Group\",\"spyware\",\"surveillance\",\"cybersecurity\",\"human rights\"]', NULL, 7, '2026-03-15 19:09:14', 'Investigating Gamma Group\'s Surveillance Software Deployments', 'Expert analysis of Gamma Group\'s spyware tactics, focusing on infection vectors, mobile device targeting, and human rights impacts.', 'operation-finspy', 1),
(177, 'Cytrox Predator Spyware Investigation Training', 'Cytrox (Commercial Spyware)', 'Learn to investigate Cytrox Predator deployments and zero-click exploits targeting opposition politicians.', 'In this training scenario, participants will step into the shoes of a cyber threat investigator. An authoritarian government has been suspected of deploying Cytrox\'s Predator spyware to surveil opposition politicians. Your mission is to analyze the deployment methods, particularly focusing on zero-click exploits, and uncover the full extent of this cyber espionage operation. Will you be able to connect the dots and expose the threat?', 'novice', 0, 1, 1, 60, NULL, '[\"Cytrox\",\"Predator spyware\",\"zero-click exploits\",\"cyber threat intelligence\",\"authoritarian surveillance\"]', NULL, 4, '2026-03-15 19:09:35', 'Cytrox Predator Spyware Investigation Training', 'Learn to investigate Cytrox Predator deployments and zero-click exploits targeting opposition politicians.', 'operation-predator', 1),
(178, 'Candiru Spyware Threat Investigation Training', 'Candiru (Commercial Spyware)', 'Explore Candiru\'s spyware operations targeting activists and journalists through Windows browser exploits.', 'In this training scenario, participants will delve into the clandestine world of Candiru, an Israeli spyware vendor notorious for deploying sophisticated Windows browser exploits. As a cyber investigator, you will track the trail of digital breadcrumbs left by this APT group as they target activists and journalists across multiple countries. Your mission is to uncover their tactics, techniques, and procedures to thwart their malicious objectives.', 'beginner', 0, 1, 1, 60, NULL, '[\"Candiru\",\"spyware\",\"Windows exploits\",\"activists\",\"journalists\"]', NULL, 4, '2026-03-15 19:09:58', 'Candiru Spyware Threat Investigation Training', 'Explore Candiru\'s spyware operations targeting activists and journalists through Windows browser exploits.', 'operation-candiru', 1),
(179, 'Quadream REIGN Spyware Investigation Training', 'Quadream (Commercial Spyware)', 'Dive into the Quadream REIGN spyware, exploring zero-click iCloud exploits and sales to government clients.', 'In the shadowy world of commercial spyware, the Quadream group has devised a potent tool known as REIGN. Your task is to investigate a series of cyber incidents where REIGN has been deployed against iOS devices, utilizing sophisticated zero-click iCloud calendar exploits. As an intermediate analyst, you\'ll uncover the methods of operation, tracing the spyware\'s journey from initial access to data exfiltration, and unravel the web of government clients behind its deployment.', 'intermediate', 0, 1, 1, 60, NULL, '[\"Quadream\",\"REIGN spyware\",\"iOS exploits\",\"zero-click\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:10:22', 'Quadream REIGN Spyware Investigation Training', 'Dive into the Quadream REIGN spyware, exploring zero-click iCloud exploits and sales to government clients.', 'operation-quadream', 1),
(180, 'Advanced Threat Analysis: Unmasking Black Basta\'s Ransomware Ploys', 'Black Basta', 'Explore Black Basta\'s ransomware tactics, double extortion strategies, and QBot alliances in this advanced cybersecurity training.', 'In the shadowy world of cybercrime, Black Basta, a ransomware group believed to share roots with the notorious Conti gang, has rapidly ascended to infamy. Known for their sophisticated double extortion tactics and strategic partnerships with the QBot malware operators, Black Basta poses a formidable threat. Your mission is to investigate their operations, unravel their methods, and understand the rapid rise of this elusive group. Can your team uncover their secrets and thwart their next move?', 'advanced', 0, 1, 1, 60, NULL, '[\"Black Basta\",\"ransomware\",\"cybersecurity training\",\"APT groups\",\"QBot\"]', NULL, 5, '2026-03-15 19:10:54', 'Advanced Threat Analysis: Unmasking Black Basta\'s Ransomware Ploys', 'Explore Black Basta\'s ransomware tactics, double extortion strategies, and QBot alliances in this advanced cybersecurity training.', 'operation-black-basta', 1),
(181, 'Royal APT: Analyzing Ransomware Tactics on Critical Infrastructure', 'Royal', 'Explore Royal APT\'s ransomware tactics targeting critical infrastructure using callback phishing in this novice training scenario.', 'As a cyber threat analyst, you are tasked with investigating a series of sophisticated ransomware attacks perpetrated by the Royal APT group, a faction known for evolving from former Conti members. Your mission is to dissect their methodology, particularly focusing on their callback phishing tactics and the targeting of critical infrastructure entities. This operation will guide you through the various stages of their attack to enhance your understanding of their threat landscape.', 'novice', 0, 1, 1, 60, NULL, '[\"Royal APT\",\"ransomware\",\"callback phishing\",\"critical infrastructure\",\"Conti\"]', NULL, 5, '2026-03-15 19:11:15', 'Royal APT: Analyzing Ransomware Tactics on Critical Infrastructure', 'Explore Royal APT\'s ransomware tactics targeting critical infrastructure using callback phishing in this novice training scenario.', 'operation-royal-ransomware', 1),
(182, 'Play APT: Ransomware Threat Analysis in Latin America', 'Play', 'Investigate Play APT\'s ransomware attacks on Latin American entities, focusing on Exchange vulnerabilities and intermittent encryption tactics.', 'In recent months, the Play APT group has intensified their ransomware operations targeting key Latin American organizations. They\'ve been exploiting vulnerabilities in Microsoft Exchange servers and employing unique intermittent encryption techniques. As a beginner analyst, your mission is to unravel this complex web, understand their tactics, and help mitigate future threats.', 'beginner', 0, 1, 1, 60, NULL, '[\"Play APT\",\"ransomware\",\"Exchange vulnerabilities\",\"Latin America\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:11:37', 'Play APT: Ransomware Threat Analysis in Latin America', 'Investigate Play APT\'s ransomware attacks on Latin American entities, focusing on Exchange vulnerabilities and intermittent encryption tactics.', 'operation-play-ransomware', 1),
(183, 'Vice Society Ransomware: Education Sector Breach Simulation', 'Vice Society', 'Investigate Vice Society\'s ransomware attacks on school districts, focusing on student data privacy impacts.', 'In recent months, Vice Society, a notorious APT group, has set its sights on the education sector, launching a series of ransomware attacks targeting school districts. These attacks have not only disrupted educational services but have also raised significant concerns regarding the privacy and security of sensitive student data. As the lead analyst, you are tasked with piecing together the puzzle, identifying the breach points, and understanding the full impact of these malicious activities.', 'intermediate', 0, 1, 1, 60, NULL, '[\"Vice Society\",\"ransomware\",\"education sector\",\"student data privacy\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:11:57', 'Vice Society Ransomware: Education Sector Breach Simulation', 'Investigate Vice Society\'s ransomware attacks on school districts, focusing on student data privacy impacts.', 'operation-vice-society', 1),
(184, 'Hive Ransomware Takedown Simulation: FBI Infiltration & Decryption Key Analysis', 'Hive Ransomware', 'Investigate the FBI\'s infiltration of Hive ransomware to prevent $130M in ransoms and analyze decryption key distribution.', 'In an unprecedented cybersecurity operation, the FBI successfully infiltrated the Hive ransomware group\'s infrastructure. Participants will delve into the intricacies of this takedown, examining how law enforcement distributed decryption keys and thwarted over $130 million in potential ransom payments. This advanced scenario offers a deep dive into the strategies and techniques employed by both the attackers and defenders.', 'advanced', 0, 1, 1, 60, NULL, '[\"FBI infiltration\",\"Hive ransomware\",\"cybersecurity training\",\"decryption keys\",\"ransom prevention\"]', NULL, 5, '2026-03-15 19:12:18', 'Hive Ransomware Takedown Simulation: FBI Infiltration & Decryption Key Analysis', 'Investigate the FBI\'s infiltration of Hive ransomware to prevent $130M in ransoms and analyze decryption key distribution.', 'operation-hive-takedown', 1),
(185, 'Advanced Threat Response: ALPHV\'s Rust-Based Ransomware Unveiled', ' ALPHV (BlackCat)', 'Master the intricacies of ALPHV\'s Rust ransomware with a deep dive into its encryptor and data leak innovations.', 'In an era where cyber threats evolve at a rapid pace, ALPHV (BlackCat) has emerged as a formidable adversary, leveraging Rust-based ransomware to orchestrate sophisticated attacks. Participants will embark on an expert-level training operation to dissect ALPHV\'s tactics, techniques, and procedures. They will explore a real-world scenario that challenges them to unravel the complexities of a highly customizable encryptor and innovative data leak site, pushing the boundaries of their cyber defense skills.', 'expert', 0, 1, 1, 60, NULL, '[\"APTs\",\"Rust ransomware\",\"cybersecurity training\",\"ALPHV\",\"data leak\"]', NULL, 5, '2026-03-15 19:12:45', 'Advanced Threat Response: ALPHV\'s Rust-Based Ransomware Unveiled', 'Master the intricacies of ALPHV\'s Rust ransomware with a deep dive into its encryptor and data leak innovations.', 'operation-alphv-blackcat', 1),
(186, 'LockBit Ransomware: Unveiling the Affiliate Program and Public Persona', 'LockBit', 'Explore LockBit\'s notorious ransomware operations and analyze their affiliate program and public strategies.', 'In this training scenario, participants will delve into the operations of LockBit, a notorious ransomware group. Known for their audacious tactics and a sophisticated affiliate program, LockBit has become a formidable adversary in the cybersecurity landscape. Trainees will investigate the group\'s bug bounty offerings for vulnerabilities and their bold public persona, providing a comprehensive understanding of their modus operandi.', 'beginner', 0, 1, 1, 60, NULL, '[\"LockBit\",\"ransomware\",\"cybersecurity training\",\"affiliate program\",\"bug bounty\"]', NULL, 5, '2026-03-15 19:14:23', 'LockBit Ransomware: Unveiling the Affiliate Program and Public Persona', 'Explore LockBit\'s notorious ransomware operations and analyze their affiliate program and public strategies.', 'operation-lockbit-empire', 1),
(187, 'Advanced Ransomware Investigation: Akira\'s Tactics and Techniques', 'Akira', 'Analyze Akira\'s ransomware operations: retro leak site, Cisco VPN targeting, and VMware ESXi attacks.', 'Welcome to an advanced cybersecurity operation scenario where you\'ll dive deep into the malicious world of Akira, a sophisticated APT group. Your mission is to investigate their potential links with Conti, unravel their retro-styled leak site, and understand their strategic targeting of Cisco VPN and VMware ESXi systems. In this scenario, you\'ll follow a trail of five key alerts that will test your skills in identifying and neutralizing threats as you unfold a complex narrative of cyber espionage.', 'advanced', 0, 1, 1, 60, NULL, '[\"Akira ransomware\",\"Conti links\",\"Cisco VPN attacks\",\"VMware ESXi\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:14:47', 'Advanced Ransomware Investigation: Akira\'s Tactics and Techniques', 'Analyze Akira\'s ransomware operations: retro leak site, Cisco VPN targeting, and VMware ESXi attacks.', 'operation-akira', 1),
(188, 'NoEscape Ransomware: Healthcare Sector Intrusion Analysis', 'NoEscape (Avaddon reboot)', 'Investigate NoEscape\'s ransomware operation evolution targeting healthcare systems.', 'In an era of increasing cyber threats, the healthcare sector faces a sophisticated adversary: NoEscape, an evolved form of the notorious Avaddon ransomware. As an expert analyst, you are tasked with dissecting their ransomware-as-a-service operation. Your mission is to track how this APT group has refined its tactics, techniques, and procedures to infiltrate and exploit vulnerable healthcare networks. Brace yourself for a deep dive into a complex world of cyber espionage and critical data compromises.', 'expert', 0, 1, 1, 60, NULL, '[\"ransomware\",\"healthcare cybersecurity\",\"APT analysis\",\"NoEscape\",\"cyber threat intelligence\"]', NULL, 5, '2026-03-15 19:15:04', 'NoEscape Ransomware: Healthcare Sector Intrusion Analysis', 'Investigate NoEscape\'s ransomware operation evolution targeting healthcare systems.', 'operation-noescape', 1),
(189, 'Ragnar Locker\'s VM Evasion: Gaming Industry Under Siege', ' Ragnar Locker', 'Investigate Ragnar Locker\'s ransomware tactics using virtual machines to target the gaming industry.', 'In the world of cybercrime, Ragnar Locker has set its sights on the lucrative gaming industry. Their unique tactic of deploying ransomware within virtual machines to evade detection poses a novel challenge for cybersecurity defenders. As a novice analyst, you are tasked with unraveling this complex operation and protecting valuable gaming assets.', 'novice', 0, 1, 1, 60, NULL, '[\"Ragnar Locker\",\"ransomware\",\"virtual machine\",\"gaming industry\",\"cybersecurity training\"]', NULL, 5, '2026-03-15 19:15:22', 'Ragnar Locker\'s VM Evasion: Gaming Industry Under Siege', 'Investigate Ragnar Locker\'s ransomware tactics using virtual machines to target the gaming industry.', 'operation-ragnar-locker', 1),
(190, 'Analyzing Mount Locker Ransomware: Corporate Negotiations & Builder Insights', 'Mount Locker (AstroLocker)', 'Dive into Mount Locker ransomware operations with a focus on negotiations and builder analysis.', 'In the world of cyber threats, Mount Locker, also known as AstroLocker, has made waves with its sophisticated ransomware operations. Your task is to delve into their methods, focusing on corporate-style negotiations and the intricacies of their builder and affiliate program. This investigation will unravel the complexities of how they gain initial access, execute their payloads, and maintain persistence. Can you piece together the clues and understand their modus operandi?', 'beginner', 0, 1, 1, 60, NULL, '[\"Mount Locker ransomware\",\"cybersecurity training\",\"APT analysis\",\"ransomware negotiation\",\"cyber threat intelligence\"]', NULL, 4, '2026-03-15 19:15:43', 'Analyzing Mount Locker Ransomware: Corporate Negotiations & Builder Insights', 'Dive into Mount Locker ransomware operations with a focus on negotiations and builder analysis.', 'operation-mount-locker', 1),
(191, 'Maze Ransomware: Double Extortion and Collaborative Threats', 'Maze', 'Investigate Maze\'s double extortion tactics and their collaboration with other ransomware groups.', 'In recent times, the Maze ransomware group has emerged as a formidable threat actor, known for pioneering the \'double extortion\' technique. This training scenario immerses participants in a complex investigation of Maze\'s tactics, including their notorious data leak site innovation and strategic alliances with other ransomware groups. As cyber defenders, you will navigate a series of alerts that unravel Maze\'s sophisticated attack chain.', 'intermediate', 0, 1, 1, 60, NULL, '[\"Maze ransomware\",\"double extortion\",\"data leak site\",\"cybersecurity training\",\"APT group\"]', NULL, 5, '2026-03-15 19:16:01', 'Maze Ransomware: Double Extortion and Collaborative Threats', 'Investigate Maze\'s double extortion tactics and their collaboration with other ransomware groups.', 'operation-maze-cartel', 1),
(192, 'Egregor Ransomware: Unraveling its Maze Lineage and Retail Impact', 'Egregor', 'Dive deep into Egregor\'s ransomware tactics, retail sector assaults, and the law enforcement crackdown.', 'In a world where digital threats lurk around every corner, the Egregor ransomware group emerged as a formidable adversary. Emerging from the shadows of the notorious Maze group, Egregor quickly made a name for itself by targeting the retail sector with swift and devastating attacks. As law enforcement agencies rallied to dismantle this cybercrime syndicate, a gripping tale of cat-and-mouse unfolded. This advanced training scenario will immerse you in the investigation of Egregor\'s short-lived yet impactful operation, exploring the intricate web of their tactics, techniques, and procedures (TTPs).', 'advanced', 0, 1, 1, 60, NULL, '[\"Egregor ransomware\",\"Maze group\",\"cyber threat intelligence\",\"law enforcement takedown\",\"retail cybersecurity\"]', NULL, 5, '2026-03-15 19:16:19', 'Egregor Ransomware: Unraveling its Maze Lineage and Retail Impact', 'Dive deep into Egregor\'s ransomware tactics, retail sector assaults, and the law enforcement crackdown.', 'operation-egregor', 1),
(193, 'Advanced Fileless Ransomware Investigation: NetWalker in Healthcare & Education', 'NetWalker (Mailto)', 'Engage in an advanced analysis of NetWalker\'s fileless ransomware tactics targeting healthcare and education sectors.', 'In this advanced training scenario, participants will delve into the sophisticated world of NetWalker, a notorious APT group known for its ransomware-as-a-service model. This operation focuses on their recent campaigns targeting vulnerable healthcare and education institutions. Trainees will investigate the PowerShell-based fileless execution techniques used by NetWalker affiliates to infiltrate and disrupt critical operations. As the scenario unfolds, participants must navigate through a series of alerts, each revealing a piece of the puzzle that ultimately leads to a comprehensive understanding of NetWalker’s attack strategies.', 'advanced', 0, 1, 1, 60, NULL, '[\"NetWalker\",\"ransomware investigation\",\"fileless execution\",\"healthcare cybersecurity\",\"educational institutions security\"]', NULL, 5, '2026-03-15 19:16:48', 'Advanced Fileless Ransomware Investigation: NetWalker in Healthcare & Education', 'Engage in an advanced analysis of NetWalker\'s fileless ransomware tactics targeting healthcare and education sectors.', 'operation-netwalker', 1);
INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(194, 'DoppelPaymer Ransomware: Critical Infrastructure Under Siege', 'DoppelPaymer (Grief)', 'Investigate DoppelPaymer\'s ransomware attacks on infrastructure, analyzing BitPaymer\'s evolution and the NRA incident.', 'In the heart of a bustling city, a sudden ransomware attack cripples essential services, leaving citizens in chaos. DoppelPaymer, an infamous APT group, has evolved its tactics, leveraging its BitPaymer variant to target municipalities and critical infrastructures. As the senior analyst, your mission is to dissect their attack strategy, focusing on the notorious NRA incident, and devise a defense plan to thwart their advances.', 'expert', 0, 1, 1, 60, NULL, '[\"DoppelPaymer ransomware\",\"BitPaymer evolution\",\"cyber attack analysis\",\"APT threats\",\"critical infrastructure security\"]', NULL, 6, '2026-03-15 19:17:12', 'DoppelPaymer Ransomware: Critical Infrastructure Under Siege', 'Investigate DoppelPaymer\'s ransomware attacks on infrastructure, analyzing BitPaymer\'s evolution and the NRA incident.', 'operation-doppelpaymer', 1),
(195, 'Ragnar Locker Ransomware Attack Simulation on Capcom', 'Ragnar Locker', 'Investigate Ragnar Locker\'s ransomware attack on Capcom, revealing 1TB of game data and an $11M ransom demand.', 'In November 2020, Capcom, a prominent video game developer, faced a catastrophic ransomware attack by the notorious Ragnar Locker APT group. The hackers successfully infiltrated Capcom\'s network, exfiltrating 1TB of sensitive data, including unreleased game information, and demanded an $11 million ransom. This scenario immerses trainees in the investigation, challenging them to uncover how the attackers gained access, moved laterally, and executed their malicious plan.', 'novice', 0, 1, 0, 60, NULL, '[\"Ragnar Locker\",\"ransomware attack\",\"Capcom data breach\",\"cybersecurity training\",\"APT group tactics\"]', NULL, 4, '2026-03-15 19:17:39', 'Ragnar Locker Ransomware Attack Simulation on Capcom', 'Investigate Ragnar Locker\'s ransomware attack on Capcom, revealing 1TB of game data and an $11M ransom demand.', 'operation-ragnarlocker', 1);

-- --------------------------------------------------------

--
-- Table structure for table `operation_alerts`
--

CREATE TABLE `operation_alerts` (
  `id` int(11) NOT NULL,
  `operation_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `sequence_order` int(11) NOT NULL,
  `intel_report_title` varchar(255) DEFAULT NULL,
  `intel_report_content` text DEFAULT NULL,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `operation_alerts`
--

INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(1, 1, 268, 1, 'Investigative Report: Phishing Email Analysis', '### Overview\nThe initial alert in Operation Dark Current has detected a phishing email targeting employees at the power facility. The email contained a malicious attachment disguised as a routine internal document.\n\n### Findings\n- **Sender:** The email originated from a compromised external account known for past association with the Sandworm APT group.\n- **Attachment:** An Excel file with embedded macros designed to execute upon opening.\n- **Targets:** Key personnel within the corporate IT network.\n\n### Next Steps\nThis incident indicates the potential for malware deployment. Increased scrutiny on email attachments and network traffic is advised as the next phase of the attack may involve malware execution.', '2025-12-31 13:10:04'),
(2, 1, 269, 2, 'Malware Analysis: BlackEnergy Deployment', '### Overview\nFollowing the phishing incident, BlackEnergy malware has been executed within the corporate IT network. Analysis of this malware is crucial to understanding the attack vector and preventing further incidents.\n\n### Findings\n- **Functionality:** BlackEnergy is a versatile malware capable of launching DDoS attacks, stealing credentials, and deploying additional payloads.\n- **Indicators of Compromise:** Network traffic to known malicious IPs and unusual process creation on infected systems.\n\n### Next Steps\nDetection of persistence mechanisms is critical. Efforts should be focused on identifying registry changes or scheduled tasks that suggest the establishment of persistence within the network.', '2025-12-31 13:10:04'),
(3, 1, 270, 3, 'Persistence Mechanism Identified', '### Overview\nInvestigation reveals that the attackers have established persistence within the corporate IT environment, allowing them to maintain access even after system reboots.\n\n### Findings\n- **Techniques Used:** Modification of startup scripts and registry keys; scheduled tasks pointing to malicious scripts.\n- **Affected Systems:** Several key servers and workstations exhibit signs of compromise.\n\n### Next Steps\nAttention should now shift towards detecting and preventing lateral movement towards the Operational Technology (OT) network, as this is a likely next step for the attackers.', '2025-12-31 13:10:04'),
(4, 1, 271, 4, 'Lateral Movement Detected: OT Network Breach', '### Overview\nThe attackers have successfully moved laterally from the corporate IT network into the OT network, a critical phase in compromising the power grid\'s infrastructure.\n\n### Findings\n- **Methods:** Use of stolen credentials and exploitation of trusted connections between IT and OT networks.\n- **Compromised Components:** Initial access to the OT network has been confirmed on systems managing SCADA operations.\n\n### Next Steps\nImmediate action is required to contain and mitigate any potential SCADA system compromise. Focus should be on isolating affected systems and monitoring for execution attempts within the SCADA environment.', '2025-12-31 13:10:04'),
(5, 1, 272, 5, NULL, NULL, '2025-12-31 13:10:04'),
(6, 2, 274, 1, NULL, NULL, '2025-12-31 13:43:07'),
(7, 2, 275, 2, 'Analysis of Malicious Code Execution on Developer Systems', '# Malicious Code Execution on Developer Systems\n\n## Context\nFollowing the phishing attempts through weaponized job offers, the adversary has successfully executed malicious code on the targeted developer systems. This report analyzes the initial compromise and provides insights into the malware tactics used.\n\n## Key Findings\n- **Delivery Method**: The phishing emails contained attachments disguised as job descriptions, which, once opened, executed a macro to download a secondary payload.\n- **Payload Details**: The malware used is a variant of the Lazarus Group’s known toolkit, designed to evade traditional antivirus solutions and persist within compromised systems.\n- **Immediate Impact**: Initial indicators suggest that the malware is harvesting credentials and establishing communication with command-and-control (C2) servers.\n\n## Recommendations\n- **Immediate Actions**: Isolate affected systems and perform a full forensic analysis to identify all compromised endpoints.\n- **Preventive Measures**: Conduct security awareness training focusing on phishing detection and enforce strict email attachment policies.', '2025-12-31 13:43:07'),
(8, 2, 276, 3, 'Establishing Persistence and Lateral Movement within the Network', '# Establishing Persistence and Lateral Movement\n\n## Context\nPost-malicious code execution, the adversary is moving laterally within the network, aiming to establish persistence across multiple systems. This report delves into the techniques used by the Lazarus Group for lateral movement and persistence.\n\n## Key Findings\n- **Techniques Used**: The attackers are leveraging compromised credentials and exploiting existing vulnerabilities to move laterally within the organization’s network.\n- **Persistence Mechanisms**: The group is using scheduled tasks and registry modifications to maintain access to compromised systems.\n- **Targeted Assets**: Key systems identified include cryptocurrency wallets and financial transaction servers.\n\n## Recommendations\n- **Network Segmentation**: Strengthen network segmentation to limit lateral movement.\n- **Monitoring and Detection**: Implement enhanced monitoring for unusual login activities and unauthorized access attempts.', '2025-12-31 13:43:07'),
(9, 2, 277, 4, 'Cryptocurrency Exfiltration Tactics and Laundering Channels', '# Cryptocurrency Exfiltration and Laundering\n\n## Context\nWith persistence established, the Lazarus Group is actively exfiltrating cryptocurrency assets, utilizing complex laundering channels to obfuscate the funds\' origins. This report provides insights into the exfiltration processes and laundering mechanisms employed.\n\n## Key Findings\n- **Exfiltration Process**: The attackers are using custom scripts to automate the transfer of cryptocurrency from compromised wallets to intermediary accounts.\n- **Laundering Channels**: Funds are being funneled through a series of mixer services and exchanged across multiple cryptocurrency platforms to obscure the trail.\n- **Evasion Tactics**: The group employs rapid transfer sequences and leverages decentralized exchanges to minimize traceability.\n\n## Recommendations\n- **Transaction Monitoring**: Enhance transaction monitoring to identify unusual patterns and large transfers out of normal business hours.\n- **Collaboration with Exchanges**: Work closely with cryptocurrency exchanges and financial institutions to flag and freeze suspicious transactions.', '2025-12-31 13:43:07'),
(10, 3, 278, 1, 'Analysis of Malicious Code Execution', '### Background\nFollowing the detection of a compromised update package, forensic analysis has confirmed the execution of malicious code on affected systems. This report delves into the mechanisms employed by APT41 to activate their payload upon deployment of the infected update.\n\n### Key Findings\n- **Initial Execution**: The malicious DLL is designed to execute upon the initialization of the server management software.\n- **Obfuscation Techniques**: APT41 has employed advanced obfuscation techniques to avoid detection by traditional antivirus software.\n- **Payload Functionality**: The primary functions include system reconnaissance and the establishment of backdoor access for further exploitation.\n\n### Next Steps\nMitigation should focus on the identification and isolation of compromised hosts. Enhanced monitoring for unusual system activity is recommended to detect further malicious behavior.', '2025-12-31 13:45:44'),
(11, 3, 279, 2, 'Persistence Mechanisms and Countermeasures', '### Overview\nAPT41 has been observed establishing persistence on compromised systems following the execution of their payload. This report outlines the persistence techniques used and suggests countermeasures to neutralize this threat.\n\n### Persistence Techniques\n- **Registry Modifications**: Alterations to the Windows Registry to ensure the malware runs on system startup.\n- **Scheduled Tasks**: Creation of scheduled tasks to execute malware at specified intervals.\n\n### Recommended Countermeasures\n- **Registry Auditing**: Regular audits of the registry for unauthorized changes.\n- **Task Scheduler Monitoring**: Implement alerts for the creation of new scheduled tasks.\n\n### Conclusion\nNeutralizing persistence is critical to prevent further exploitation and lateral movement within the network.', '2025-12-31 13:45:44'),
(12, 3, 280, 3, 'Lateral Movement and Data Exfiltration Insights', '### Incident Summary\nPost-establishment of persistence, APT41 has initiated lateral movement to expand its foothold within the network and commenced data exfiltration activities. This report provides insights into these operations and their implications.\n\n### Lateral Movement Tactics\n- **Credential Dumping**: Use of tools to extract login credentials from compromised systems.\n- **Remote Services**: Exploitation of remote desktop and SMB services for network traversal.\n\n### Data Exfiltration\n- **Command and Control (C2) Channels**: Data is being exfiltrated using encrypted C2 channels to evade detection.\n- **Volume and Target Data**: Focus on intellectual property and financial records.\n\n### Recommendations\n- **Network Segmentation**: Implement stringent network segmentation to contain the spread.\n- **Data Loss Prevention (DLP)**: Deploy DLP solutions to monitor and block unauthorized data transfers.\n\n### Conclusion\nProactive measures are essential to detect and thwart further lateral movement and data theft by the adversary.', '2025-12-31 13:45:44'),
(13, 3, 281, 4, NULL, NULL, '2025-12-31 13:45:44'),
(14, 4, 285, 1, 'Analysis of Malicious Domain Infrastructure', '### Overview\nFollowing the detection of a spear-phishing email campaign targeting political organizations, further analysis has led to the identification of a network of malicious domains. These domains are linked to APT28\'s credential harvesting activities.\n\n### Findings\n- **Domain Patterns:** The domains employ similar naming conventions, often mimicking legitimate services to deceive targets.\n- **Hosting and IP Details:** The infrastructure is hosted across several countries, complicating attribution and takedown efforts.\n- **SSL/TLS Certificates:** Many domains utilize Let\'s Encrypt certificates, providing a false sense of security.\n\n### Recommendations\n- **Monitoring and Blocking:** Implement domain monitoring for known malicious patterns and block identified domains at the network level.\n- **User Education:** Enhance awareness training focused on recognizing phishing attempts related to these domains.', '2025-12-31 15:17:10'),
(15, 4, 286, 2, 'Investigation into OAuth Token Abuse', '### Overview\nSubsequent to the discovery of malicious domains, evidence of OAuth token abuse has been detected. This technique is being used to maintain persistent access to compromised accounts within targeted organizations.\n\n### Findings\n- **Scope of Abuse:** Multiple accounts within political organizations have been accessed using OAuth tokens, bypassing traditional authentication.\n- **Attack Vectors:** Tokens are likely being obtained through previously identified spear-phishing campaigns.\n- **Impact:** Abused tokens allow threat actors to conduct operations with legitimate access, making detection difficult.\n\n### Recommendations\n- **Token Revocation:** Immediate revocation of suspicious OAuth tokens is critical.\n- **Enhanced Monitoring:** Deploy advanced monitoring to detect anomalous token usage patterns.\n- **User Awareness:** Educate users on the risks of OAuth token misuse and encourage cautious application authorization.', '2025-12-31 15:17:10'),
(16, 4, 287, 3, 'Disinformation Campaign Planning Insights', '### Overview\nIntelligence has surfaced regarding the planning of a disinformation campaign by APT28, aimed at influencing public perception during the national election period.\n\n### Findings\n- **Tactics and Channels:** The campaign plans to utilize social media platforms and fake news websites to disseminate false narratives.\n- **Target Audience:** Efforts are focused on swaying undecided voters and amplifying societal divisions.\n- **Coordination:** Activities appear to be coordinated with other malicious operations, potentially leveraging stolen credentials and OAuth access.\n\n### Recommendations\n- **Collaboration:** Work with social media companies to identify and remove fake accounts and content.\n- **Public Awareness:** Launch public awareness initiatives to educate voters on identifying disinformation.\n- **Intel Sharing:** Foster information sharing among national and international partners to enhance detection and response efforts.', '2025-12-31 15:17:10'),
(17, 4, 288, 4, NULL, NULL, '2025-12-31 15:17:10'),
(18, 5, 289, 1, 'Analysis of Phishing Email Attack Vector', '### Overview\nThe phishing email was identified as the initial attack vector used by the Wizard Spider APT group. The email, disguised as an urgent communication from a trusted medical supplier, contained a malicious link to a counterfeit login page.\n\n### Technical Details\n- **Sender Email Address**: spoofed@trustedmedical.com\n- **Subject Line**: \'Immediate Action Required: Update Your Credentials\'\n- **Date/Time Detected**: 2023-10-15 09:45 UTC\n- **Malicious URL**: hxxp://update-credentials[.]secure-med[.]com\n\n### Next Steps\nThe detection of this phishing email suggests the potential for further malicious activity. Vigilance is advised for indicators of TrickBot malware, commonly used by Wizard Spider after initial entry.', '2025-12-31 15:22:50'),
(19, 5, 290, 2, 'TrickBot Malware Execution Analysis', '### Overview\nTrickBot malware was executed following the successful phishing attack, marking the transition from initial access to establishing a foothold within the hospital network.\n\n### Technical Details\n- **Malware Type**: TrickBot variant\n- **Execution Path**: C:\\\\Users\\\\Public\\\\updater.exe\n- **Date/Time Detected**: 2023-10-15 10:15 UTC\n- **Command and Control (C2) Server**: 192.168.1.100\n\n### Persistence Mechanisms\nThe malware is known to deploy persistence mechanisms to maintain access. Monitoring for scheduled tasks or registry changes is crucial as we anticipate these activities to follow.', '2025-12-31 15:22:50'),
(20, 5, 291, 3, 'Persistence Mechanism Identification', '### Overview\nPersistence mechanisms were identified, confirming the adversary\'s intent to maintain long-term access to the hospital\'s network.\n\n### Technical Details\n- **Registry Key Modification**: HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\n- **Scheduled Task Created**: \'SystemUpdater\' running updater.exe\n- **Date/Time Detected**: 2023-10-15 11:00 UTC\n\n### Indicator of Lateral Movement\nThe presence of persistence mechanisms suggests the next likely phase is lateral movement. Cobalt Strike, a common tool for such activities, should be anticipated.', '2025-12-31 15:22:50'),
(21, 5, 292, 4, 'Cobalt Strike Beacon Detection', '### Overview\nA Cobalt Strike beacon was detected, indicating the adversary\'s progression to lateral movement within the network.\n\n### Technical Details\n- **Beacon IP Address**: 192.168.1.101\n- **Beacon Port**: 4444\n- **Date/Time Detected**: 2023-10-15 11:45 UTC\n- **Communication Method**: HTTPS\n\n### Implications\nThis activity signifies an imminent threat of ransomware deployment. Immediate action is required to isolate affected systems and prevent the final stage of ransomware encryption.', '2025-12-31 15:22:50'),
(22, 5, 293, 5, NULL, NULL, '2025-12-31 15:22:50'),
(23, 6, 294, 1, 'Report: Analysis of Initial Access via Spear Phishing Campaign', '### Overview\nThe spear phishing campaign executed by the Carbanak/FIN7 group was highly targeted, focusing on banking personnel with access to critical systems. The phishing emails were crafted to appear as legitimate internal communications, increasing the probability of successful compromise.\n\n### Key Indicators\n- **Email Subject:** \'Urgent Security Update Required\'\n- **Sender Domain:** spoofed from `security-update@bankinginternal.com`\n- **Attachment:** Malicious XLS file named `Security_Update.xls`\n\n### Next Steps\nThe next phase involves deploying malware to harvest credentials. It is critical to monitor for anomalies in user behavior and system access patterns to mitigate further compromise.', '2025-12-31 15:23:56'),
(24, 6, 295, 2, 'Report: Malware Execution and Credential Harvesting Analysis', '### Overview\nFollowing the initial spear phishing attack, the Carbanak/FIN7 group deployed a sophisticated malware payload. This malware is designed to execute stealthily and harvest credentials from compromised systems.\n\n### Malware Characteristics\n- **Type:** Remote Access Trojan (RAT)\n- **Capabilities:** Keylogging, screen capture, credential dumping\n- **Persistence Mechanism:** Scheduled Tasks and Registry modifications\n\n### Next Steps\nAttention should be directed towards detecting and isolating instances of lateral movement within the network. Implement robust network segmentation and monitor for unauthorized access attempts to critical systems.', '2025-12-31 15:23:56'),
(25, 6, 296, 3, 'Report: Lateral Movement and Network Exploitation Techniques', '### Overview\nCarbanak/FIN7 have initiated lateral movement across the network, leveraging harvested credentials to escalate privileges and access sensitive systems.\n\n### Techniques Observed\n- **Credential Reuse:** Exploiting weak password policies\n- **Pass-the-Hash:** Utilizing NTLM hashes to authenticate\n- **Exploitation of Vulnerable Services:** Targeting unpatched systems for entry\n\n### Next Steps\nThe final stage involves manipulation of ATM withdrawal limits and exploitation of SWIFT gateways. Enhance monitoring of financial transaction systems and initiate real-time alerts for unusual transaction patterns.', '2025-12-31 15:23:56'),
(26, 6, 297, 4, NULL, NULL, '2025-12-31 15:23:56'),
(27, 7, 304, 1, 'Analysis of Spear Phishing Email Detected', '## Overview\nThe initial spear phishing email was detected targeting key personnel within the IT department of the multinational energy corporation. The email contained a malicious attachment disguised as a financial report.\n\n## Details\n- **Sender**: An email address mimicking a known supplier.\n- **Subject Line**: \'Urgent: Q3 Financial Summary Required\'\n- **Attachment**: A macro-enabled Excel file designed to execute a PowerShell script upon opening.\n\n## Next Steps\nMonitoring for any execution of scripts related to this email is crucial to prevent further compromise. Pay special attention to any PowerShell activities that may be triggered as a result of this email.', '2026-01-02 04:27:59'),
(28, 7, 305, 2, 'Investigation into Suspicious PowerShell Execution', '## Overview\nFollowing the detection of the spear phishing email, a suspicious PowerShell script execution was identified on the workstation of a targeted employee.\n\n## Details\n- **Script Purpose**: The PowerShell script was designed to establish a remote connection with command-and-control (C2) servers operated by APT34.\n- **Indicators**: Execution logs show obfuscation techniques to evade detection.\n\n## Insights\nThis execution suggests the attackers are attempting to gain a foothold within the network. Immediate measures should be taken to isolate the affected system and prevent the establishment of persistence mechanisms.', '2026-01-02 04:27:59'),
(29, 7, 306, 3, 'Identification of Persistence Mechanism Established', '## Overview\nAPT34 has successfully established a persistence mechanism within the compromised systems, leveraging scheduled tasks for recurring execution of malicious scripts.\n\n## Details\n- **Technique**: Creation of scheduled tasks to execute scripts at regular intervals.\n- **Tools Used**: Commonly used Windows utilities to create and modify tasks.\n\n## Strategic Implications\nThe persistence indicates a strategic intention to maintain long-term access. This necessitates a thorough review of scheduled tasks across all systems to pinpoint and neutralize unauthorized entries.', '2026-01-02 04:27:59'),
(30, 7, 307, 4, 'Detection of Unauthorized Lateral Movement', '## Overview\nAnomalous activity indicating unauthorized lateral movement within the corporate network was detected, suggesting the attackers are expanding their access.\n\n## Details\n- **Method**: Use of stolen credentials to access additional systems.\n- **Targets**: Systems containing sensitive geological data.\n\n## Recommendations\nStrengthen monitoring of privileged accounts and implement network segmentation to hinder further lateral movement. It\'s critical to review access logs to understand the attack path and prevent data exfiltration attempts.', '2026-01-02 04:27:59'),
(31, 7, 308, 5, NULL, NULL, '2026-01-02 04:27:59'),
(32, 8, 319, 1, 'Phishing Email Analysis', '### Overview\nThe initial alert identified a **suspicious email** likely associated with a phishing attempt. This is often the first step in APT10\'s strategy to deliver malicious payloads.\n\n### Detailed Analysis\n- **Sender\'s Email:** The email originated from a domain resembling a known vendor, indicating a possible **spear-phishing** attempt.\n- **Content:** The email contained a link to a compromised website designed to harvest credentials.\n- **Attachment:** A malicious document file was attached, likely containing a macro to execute malware upon opening.\n\n### Next Steps\n- **Containment:** Block the sender\'s domain and similar variants.\n- **Awareness:** Educate employees on identifying phishing attempts.\n- **Monitoring:** Increase surveillance on network activities for any unauthorized application executions, which could indicate successful malware deployment.', '2026-01-02 20:23:41'),
(33, 8, 320, 2, 'Malware Execution Insight', '### Overview\nFollowing the phishing incident, an alert was triggered for **unauthorized application execution**. This suggests that the malware embedded in the phishing email has been activated.\n\n### Detailed Analysis\n- **Execution Path:** The malware was executed from a temporary directory, consistent with initial payload delivery tactics.\n- **Detection:** Antivirus logs show the execution of a file named `loader.exe`, indicative of a dropper or loader.\n- **Behavior:** The malware attempts to establish a connection with a known C2 server used by APT10.\n\n### Next Steps\n- **Containment:** Isolate the affected system to prevent further spread.\n- **Forensics:** Capture memory and disk images for analysis.\n- **Monitoring:** Watch for attempts to establish persistence mechanisms, which could solidify the presence of the threat.', '2026-01-02 20:23:41'),
(34, 8, 321, 3, 'Persistence Mechanism Investigation', '### Overview\nThe detection of a **persistence mechanism** indicates that the attackers are attempting to maintain access to the compromised system.\n\n### Detailed Analysis\n- **Registry Changes:** The malware modified registry keys to ensure execution upon startup.\n- **Scheduled Tasks:** A new scheduled task was created to execute the malware at regular intervals.\n- **Service Installation:** A new service, disguised as a legitimate application, was installed to run the malware.\n\n### Next Steps\n- **Containment:** Disable the scheduled tasks and services related to the malware.\n- **Forensics:** Analyze registry changes to understand the full scope.\n- **Monitoring:** Prepare for potential lateral movement attempts, as attackers may try to extend control over the network.', '2026-01-02 20:23:41'),
(35, 8, 322, 4, 'Lateral Movement Analysis', '### Overview\nThe alert for **lateral movement** suggests that APT10 is attempting to expand its foothold within the network.\n\n### Detailed Analysis\n- **Tools Used:** The attackers utilized tools such as `PsExec` and `WMI` to move laterally.\n- **Compromised Accounts:** Credentials from privileged accounts were used, indicating possible credential dumping.\n- **Targets:** Lateral movement attempts were detected towards servers hosting critical data.\n\n### Next Steps\n- **Containment:** Reset passwords for compromised accounts and enhance MFA enforcement.\n- **Forensics:** Conduct a thorough audit of account activities and access logs.\n- **Monitoring:** Be vigilant for data exfiltration attempts, as the attackers might next attempt to extract sensitive information.', '2026-01-02 20:23:41'),
(36, 8, 323, 5, NULL, NULL, '2026-01-02 20:23:41'),
(37, 9, 324, 1, NULL, NULL, '2026-01-02 20:29:44'),
(38, 9, 325, 2, 'Analysis of Malicious Firmware Update', '### Executive Summary\nAfter detecting suspicious network traffic suggesting initial access, a detailed analysis of the firmware update process revealed an unauthorized update to the firewall\'s SPI flash memory.\n\n### Technical Details\n- **Firmware Image**: The firmware image checksum did not match the expected value, indicating tampering.\n- **Analysis Tools**: Utilized Binwalk and Firmware Mod Kit to dissect the firmware.\n- **Findings**: Embedded payload designed for remote command execution.\n\n### Next Steps\nInvestigate persistence mechanisms that may have been established through this malicious firmware.', '2026-01-02 20:29:44'),
(39, 9, 326, 3, 'Investigation of Persistence Mechanism', '### Executive Summary\nA persistence mechanism was detected, ensuring the malicious firmware\'s survival across reboots.\n\n### Technical Details\n- **Method**: The implant modified bootloader scripts to reload the malicious payload.\n- **Detection Tools**: Compared bootloader script with known good configurations.\n\n### Next Steps\nMonitoring for signs of lateral movement within the network.', '2026-01-02 20:29:44'),
(40, 9, 327, 4, 'Signs of Lateral Movement within Network', '### Executive Summary\nThe compromised firewall is being used as a pivot point for lateral movement within the network.\n\n### Technical Details\n- **Indicators of Compromise (IoCs)**: Multiple unusual authentication attempts logged.\n- **Network Zones Affected**: Activity detected in the DMZ and internal subnet.\n\n### Next Steps\nEstablish containment measures to prevent further spread and identify C2 communication channels.', '2026-01-02 20:29:44'),
(41, 9, 328, 5, 'Command and Control Channel Analysis', '### Executive Summary\nA command and control channel has been established, facilitating remote administration of the compromised system.\n\n### Technical Details\n- **C2 Protocol**: Detected use of DNS tunneling for stealthy communication.\n- **Frequency**: Regular beaconing every 5 minutes.\n\n### Next Steps\nImplement measures to block C2 communication and monitor for data exfiltration attempts.', '2026-01-02 20:29:44'),
(42, 9, 329, 6, 'Detection of Data Exfiltration Attempt', '### Executive Summary\nA data exfiltration attempt was intercepted, aimed at extracting sensitive information from the network.\n\n### Technical Details\n- **Method**: Data packaged in compressed archives, sent over HTTPS.\n- **Volume**: Approximately 500MB of data targeted.\n\n### Next Steps\nInvestigate for signs of privilege escalation that may have facilitated the exfiltration.', '2026-01-02 20:29:44'),
(43, 9, 330, 7, 'Privilege Escalation Analysis', '### Executive Summary\nPrivilege escalation attempts have been detected, likely to gain higher-level access for further exploitation.\n\n### Technical Details\n- **Vector**: Exploitation of known vulnerability in outdated software.\n- **Detection**: Log analysis showed unauthorized changes to system files and configurations.\n\n### Next Steps\nExamine logs and configurations for attempts to cover tracks and evade defenses.', '2026-01-02 20:29:44'),
(44, 9, 331, 8, 'Defense Evasion Tactics Observed', '### Executive Summary\nAttempts to cover tracks and evade defense mechanisms were observed following privilege escalation.\n\n### Technical Details\n- **Tactics**: Deletion of log files, disabling of security tools.\n- **Detection Tools**: Anomaly detection in SIEM highlighted these activities.\n\n### Next Steps\nConduct internal reconnaissance to determine the target assets and finalize response strategies.', '2026-01-02 20:29:44'),
(45, 9, 332, 9, 'Internal Reconnaissance Activities', '### Executive Summary\nInternal reconnaissance activities have been detected, indicating preparation for final data extraction.\n\n### Technical Details\n- **Techniques Used**: Network scanning and mapping of critical systems.\n- **Tools Detected**: Use of custom scripts mimicking legitimate admin tools.\n\n### Next Steps\nPrepare for potential final data extraction and reinforce monitoring on critical assets.', '2026-01-02 20:29:44'),
(46, 9, 333, 10, 'Final Data Extraction Attempt Analysis', '### Executive Summary\nA final data extraction attempt was detected, marking the culmination of the attack chain.\n\n### Technical Details\n- **Targeted Data**: High-value intellectual property and customer data.\n- **Method**: Attempted exfiltration via cloud-based storage services.\n\n### Conclusion\nThe attack cycle is complete. Immediate containment and remediation actions should be prioritized to prevent future breaches.', '2026-01-02 20:29:44'),
(47, 10, 334, 1, 'Analysis of Obfuscated JavaScript Payload', '### Overview\nFollowing the detection of the compromised website, analysts have identified a suspicious JavaScript payload designed to execute upon a user\'s visit. This script is heavily obfuscated, suggesting advanced techniques employed by APT32 to avoid detection.\n\n### Observations\n- **Obfuscation Techniques:** The script uses multiple layers of encoding and dynamic code generation.\n- **Execution Trigger:** The payload is triggered when specific conditions are met, such as user agent matching and referrer checks.\n\n### Recommendations\n- **Immediate Action:** Set up sandbox environments to safely deobfuscate and analyze the script.\n- **Further Investigation:** Monitor network traffic for any anomalous patterns indicative of further payload execution.', '2026-01-02 20:31:37'),
(48, 10, 335, 2, 'Custom Backdoor Analysis', '### Overview\nUpon successful execution of the obfuscated JavaScript, a custom backdoor is installed on macOS systems. This backdoor is unique to APT32 and provides persistent access to infected devices.\n\n### Key Features\n- **Persistence Mechanism:** The backdoor uses Launch Daemons for persistence, ensuring it runs at startup.\n- **Capabilities:** Allows remote access, file manipulation, and execution of arbitrary commands.\n\n### Recommendations\n- **Detection:** Implement host-based rules to detect known persistence techniques used by this backdoor.\n- **Mitigation:** Advise users to update macOS and employ endpoint protection solutions.', '2026-01-02 20:31:37'),
(49, 10, 336, 3, 'Command and Control Communication Analysis', '### Overview\nThe custom backdoor begins communicating with a Command and Control (C2) server once installed. This stage marks the lateral movement phase, where the attacker maintains control over the compromised devices.\n\n### Observations\n- **C2 Channels:** Utilizes HTTPS for encrypted communication, making detection challenging.\n- **Behavioral Patterns:** Regular check-ins with the server and potential data upload activity.\n\n### Recommendations\n- **Network Monitoring:** Deploy advanced monitoring to identify atypical HTTPS traffic patterns.\n- **Threat Intelligence:** Leverage threat intelligence feeds to flag known APT32 infrastructure.', '2026-01-02 20:31:37'),
(50, 10, 337, 4, 'Data Exfiltration Attempt Detected', '### Overview\nThe final stage of the attack involves attempts to exfiltrate sensitive data from the compromised organization. This represents a significant threat to the confidentiality of human rights advocacy efforts.\n\n### Observations\n- **Exfiltration Tactics:** Use of compressed archives sent over encrypted channels.\n- **Data Types Targeted:** Email communications, internal documents, and contact databases.\n\n### Recommendations\n- **Data Loss Prevention (DLP):** Implement DLP solutions to monitor and block unauthorized data transfers.\n- **Incident Response:** Engage incident response teams to contain and mitigate the impact of exfiltration attempts.', '2026-01-02 20:31:37'),
(51, 10, 338, 5, NULL, NULL, '2026-01-02 20:31:37'),
(52, 11, 339, 1, 'Web Shell Deployment Detected', '### Overview\nFollowing the initial access via ProxyLogon Zero-Day exploit, our systems have identified the deployment of a web shell, specifically **China Chopper**.\n\n### Details\n- **Web Shell Name**: China Chopper\n- **Behavior**: Provides attackers with remote access and control over the compromised server.\n- **Indicators of Compromise (IoCs)**: Presence of unusual web application files.\n\n### Next Steps\nFocus on identifying the source of the web shell and potential attackers. Prepare for potential credential theft attempts, which are commonly executed following web shell deployment.', '2026-01-03 00:04:00'),
(53, 11, 340, 2, 'Credential Harvesting Detected', '### Overview\nAfter the deployment of China Chopper, there are signs of credential harvesting using **Mimikatz**.\n\n### Details\n- **Tool Used**: Mimikatz\n- **Purpose**: Extracting user credentials from the compromised system.\n- **Indicators**: Unauthorized access attempts, suspicious processes running on the server.\n\n### Next Steps\nMonitor for lateral movement attempts within the network, as attackers may use harvested credentials to propagate.', '2026-01-03 00:04:00'),
(54, 11, 341, 3, 'Lateral Movement Activity Observed', '### Overview\nCredential harvesting has led to lateral movement through SMB protocol, indicating an attempt to propagate within the network.\n\n### Details\n- **Protocol Used**: SMB (Server Message Block)\n- **Objective**: Gain access to additional systems using harvested credentials.\n- **Indicators**: Unusual login attempts across network nodes.\n\n### Next Steps\nPrepare for potential reconnaissance activities by the attackers, as they seek to map the network and identify valuable data.', '2026-01-03 00:04:00'),
(55, 11, 342, 4, 'Reconnaissance Activity Detected', '### Overview\nFollowing lateral movement, attackers are executing reconnaissance commands to gather information about the network.\n\n### Details\n- **Commands Used**: Network mapping tools, system enumeration commands.\n- **Purpose**: Identify critical systems and data of interest.\n- **Indicators**: Unusual network scans and command executions.\n\n### Next Steps\nAnticipate data collection attempts for exfiltration. Implement monitoring to detect unusual data access patterns.', '2026-01-03 00:04:00'),
(56, 11, 343, 5, 'Data Collection Identified', '### Overview\nReconnaissance has led to data collection activities, likely preparing for exfiltration.\n\n### Details\n- **Activity**: Access and aggregation of sensitive data.\n- **Objective**: Prepare data for exfiltration.\n- **Indicators**: Large data access events, unusual file movements.\n\n### Next Steps\nExpect attempts to exfiltrate data via HTTP POST or other channels. Enhance monitoring on outbound traffic.', '2026-01-03 00:04:00'),
(57, 11, 344, 6, 'Data Exfiltration Attempt Detected', '### Overview\nData exfiltration is underway, with attackers using HTTP POST requests to transmit collected data.\n\n### Details\n- **Method**: HTTP POST\n- **Target**: External servers\n- **Indicators**: Unusual outbound traffic patterns, large amounts of data being sent out.\n\n### Next Steps\nPrepare for potential cleanup operations by attackers. Strengthen defenses to prevent further exfiltration and identify any remaining web shells or backdoors.', '2026-01-03 00:04:00'),
(58, 11, 345, 7, 'Defense Evasion Activity Noted', '### Overview\nAttackers are attempting to clean up and remove indicators of their presence to evade detection.\n\n### Details\n- **Activities**: Deleting logs, removing malware traces, altering system settings.\n- **Objective**: Obfuscate attack traces and maintain persistence.\n- **Indicators**: Missing logs, altered system configurations.\n\n### Next Steps\nConduct a thorough forensic analysis to recover deleted logs and identify any remaining indicators. Implement stronger endpoint monitoring to detect future attempts.', '2026-01-03 00:04:00'),
(59, 11, 346, 8, NULL, NULL, '2026-01-03 00:04:00'),
(60, 12, 347, 1, 'Analysis of Initial Access via Spear Phishing', '# Initial Access via Spear Phishing\n\n## Summary\nFollowing the detection of spear phishing attempts, analysis of intercepted emails reveals the use of legitimate-looking diplomatic communications as a lure. The phishing emails were tailored to the targeted individuals using publicly available information.\n\n## Details\n- **Sender**: The emails appear to originate from trusted diplomatic entities.\n- **Payload**: The emails contain malicious attachments that exploit vulnerabilities in document readers.\n- **Target**: Individuals within diplomatic networks.\n\n## Next Steps\nThe successful spear phishing attack sets the stage for the execution of a Remote Access Tool (RAT), which is likely the next step in the adversary\'s playbook.\n\n## Recommendations\n- Increase awareness and training for diplomatic personnel regarding spear phishing tactics.\n- Implement email filtering and sandboxing solutions to detect and block malicious attachments.', '2026-01-03 00:37:55'),
(61, 12, 348, 2, 'Execution of Remote Access Tool (RAT) Analysis', '# Execution of Remote Access Tool\n\n## Summary\nAfter gaining initial access, the adversaries executed a Remote Access Tool (RAT) on compromised systems. This RAT allows them to remotely control the infected machines and facilitates further exploitation.\n\n## Details\n- **RAT Capabilities**: File transfer, command execution, and keylogging.\n- **Persistence**: The RAT is configured to start at system boot, ensuring continuous access.\n- **Communication**: The tool communicates with command and control (C2) servers using encrypted channels to evade detection.\n\n## Next Steps\nDeployment of a rootkit is anticipated to establish deeper persistence and stealth, likely the next phase in the attack.\n\n## Recommendations\n- Monitor network traffic for anomalous connections to known or suspected C2 domains.\n- Conduct thorough endpoint scans to identify and neutralize the RAT.', '2026-01-03 00:37:55'),
(62, 12, 349, 3, 'Rootkit Deployment and Persistence Mechanism', '# Rootkit Deployment for Persistence\n\n## Summary\nThe adversaries have deployed a sophisticated rootkit to ensure persistent access to compromised systems. This rootkit is designed to operate silently and evade detection by traditional security tools.\n\n## Details\n- **Rootkit Features**: Kernel-level access, anti-debugging techniques, and hidden file storage.\n- **Impact**: The rootkit grants long-term control over the system and masks malicious activities.\n- **Detection**: Difficult to detect without specialized tools due to its deep integration.\n\n## Next Steps\nWith rootkit persistence established, the attackers are likely to move laterally within the network, exploiting hijacked credentials to expand their reach.\n\n## Recommendations\n- Deploy advanced endpoint detection and response (EDR) solutions to identify unusual behavior.\n- Perform regular integrity checks of system files and settings.', '2026-01-03 00:37:55'),
(63, 12, 350, 4, 'Lateral Movement and Credential Access', '# Lateral Movement via Hijacked Credentials\n\n## Summary\nUtilizing hijacked credentials, the adversaries are expanding their presence across the network. This lateral movement allows them to access additional systems and data.\n\n## Details\n- **Credential Theft**: Credentials were harvested using keyloggers and memory scraping techniques.\n- **Access Points**: Compromised accounts are used to access shared drives, email servers, and other critical systems.\n- **Objective**: Broader network infiltration to locate valuable intelligence.\n\n## Next Steps\nThe adversaries will likely use hijacked satellite links to exfiltrate sensitive data, masking their C2 locations and avoiding detection.\n\n## Recommendations\n- Implement multi-factor authentication (MFA) to reduce the risk of credential misuse.\n- Monitor for unusual login patterns and access attempts to critical systems.', '2026-01-03 00:37:55'),
(64, 12, 351, 5, NULL, NULL, '2026-01-03 00:37:55'),
(65, 13, 352, 1, 'Analysis of Initial Network Breach', '### Summary\nFollowing the alert on suspicious access to the university network, further investigation has revealed that APT40 utilized spear-phishing emails to target university staff, leading to credential theft. These credentials were then used to access the university\'s internal network.\n\n### Detailed Findings\n- **Phishing Campaign**: APT40 crafted emails with attachments masquerading as legitimate maritime research documents, luring victims into opening them.\n- **Credential Harvesting**: Upon opening, malicious scripts captured login credentials, which were then used in lateral movement attempts.\n\n### Next Steps\nMonitor for signs of malware execution, as this is the typical progression post-initial access in APT40 operations.', '2026-01-03 00:42:39'),
(66, 13, 353, 2, 'Detection of Custom Malware Execution', '### Summary\nSubsequent to the initial breach, custom malware was detected executing within the compromised network. This malware is designed to blend with legitimate maritime research applications, making detection challenging.\n\n### Malware Profile\n- **Custom Build**: The malware shows characteristics unique to APT40, including obfuscated code and modular functionality.\n- **Capabilities**: It can execute commands, capture keystrokes, and exfiltrate data.\n\n### Recommendations\n- **Increased Monitoring**: Implement advanced monitoring for web shell installations as APT40 typically progresses to establishing persistence following malware execution.', '2026-01-03 00:42:39'),
(67, 13, 354, 3, 'Establishing Persistence via Web Shell', '### Summary\nAPT40 has been observed deploying web shells to maintain persistence within the compromised university network. These web shells provide ongoing access even if the initial breach is discovered and remediated.\n\n### Web Shell Indicators\n- **File Names and Locations**: Web shells are hidden within legitimate directories under misleading names.\n- **Command and Control**: Use of HTTP/S protocols to communicate with external servers.\n\n### Countermeasures\n- **File Integrity Monitoring**: Deploy monitoring solutions to detect unauthorized file changes or additions.\n- **Network Traffic Analysis**: Watch for anomalous outbound traffic indicative of data staging or exfiltration.', '2026-01-03 00:42:39'),
(68, 13, 355, 4, 'Lateral Movement to Secure Data Sources', '### Summary\nAPT40 has successfully moved laterally within the network, gaining access to secure data sources including databases containing sensitive maritime research.\n\n### Lateral Movement Tactics\n- **Credential Stuffing**: Utilization of harvested credentials to access different network segments.\n- **Remote Desktop Protocol (RDP)**: Exploiting RDP to move between systems and access secured data.\n\n### Next Steps\nPrepare for potential data exfiltration activities by analyzing network logs for large outbound data transfers, especially focusing on sonar technology schematics.', '2026-01-03 00:42:39'),
(69, 13, 356, 5, NULL, NULL, '2026-01-03 00:42:39'),
(70, 14, 357, 1, 'Analysis of Initial Compromise Vector', '### Overview\nFollowing the detection of suspicious web traffic attributed to a drive-by download, further analysis reveals the presence of a malicious downloader script embedded within a compromised website. This script is responsible for initiating the subsequent malicious activities.\n\n### Technical Details\n- **Infection Vector**: Compromised website hosting a malicious JavaScript file.\n- **Observed Behavior**: The script attempts to download and execute a secondary payload, likely a PowerShell script.\n\n### Next Steps\nMonitor for execution of PowerShell scripts, which may indicate the deployment of additional malware components or the initiation of further malicious actions.', '2026-01-03 00:50:36'),
(71, 14, 358, 2, 'PowerShell Script Analysis', '### Overview\nAfter the execution of a malicious PowerShell script, an in-depth investigation reveals its purpose in establishing persistence and facilitating further attacks.\n\n### Technical Details\n- **Script Functionality**: The script modifies registry keys to ensure the persistence of malware across system reboots.\n- **Indicators of Compromise**: Registry modifications detected in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`.\n\n### Next Steps\nMonitor registry activity for additional modifications and prepare for potential credential theft attempts.', '2026-01-03 00:50:36'),
(72, 14, 359, 3, 'Persistence Mechanism and Impact', '### Overview\nThe persistence mechanism has been successfully established via registry modifications, allowing the malicious payload to survive system restarts.\n\n### Technical Details\n- **Impact**: Ensures the continued operation of malicious processes.\n- **Associated Risks**: Increased likelihood of credential dumping tools being deployed to harvest sensitive information.\n\n### Next Steps\nInitiate enhanced monitoring for credential theft activities, such as the use of Mimikatz or similar tools.', '2026-01-03 00:50:36'),
(73, 14, 360, 4, 'Credential Dumping Detection and Mitigation', '### Overview\nThe detection of credential dumping attempts using Mimikatz indicates an escalation in the attack, with the adversary aiming to harvest user credentials.\n\n### Technical Details\n- **Detected Activity**: Execution of Mimikatz binary or similar tools.\n- **Potential Exposure**: Compromise of user and administrative credentials.\n\n### Mitigation Steps\nImmediately rotate all credentials identified as potentially compromised and enforce multi-factor authentication (MFA) across the network.', '2026-01-03 00:50:36'),
(74, 14, 361, 5, 'Suspicious File Transfer Analysis', '### Overview\nSuspicious file transfers over SMB traffic have been detected, potentially indicating lateral movement or exfiltration activities.\n\n### Technical Details\n- **Observed Traffic**: Unusual SMB connections and file transfer patterns.\n- **Potential Objectives**: Data staging for exfiltration or deployment of ransomware payloads.\n\n### Next Steps\nIsolate affected systems and review transferred files for signs of ransomware payloads or sensitive data.', '2026-01-03 00:50:36'),
(75, 14, 362, 6, 'Data Encryption Activity and Ransom Note', '### Overview\nActive ransomware encryption processes have been detected, indicating the adversary\'s final objective to encrypt and hold data for ransom.\n\n### Technical Details\n- **Encryption Process**: Rapid file encryption observed across multiple directories.\n- **Ransom Note**: A note demanding payment in cryptocurrency for decryption keys has been identified.\n\n### Response Actions\nInitiate incident response protocols to contain the spread of encryption, engage in negotiation simulations, and explore decryption options without payment.', '2026-01-03 00:50:36'),
(76, 14, 363, 7, NULL, NULL, '2026-01-03 00:50:36'),
(77, 15, 364, 1, 'Analysis of Anomalous PowerShell Activity', '### Overview\nFollowing the detection of a suspicious web shell on the IIS server, further investigation has revealed anomalous PowerShell activities. These activities indicate that the attacker may be attempting to execute scripts remotely to escalate their privileges or install additional payloads.\n\n### Key Indicators\n- **PowerShell Execution Logs**: Multiple instances of PowerShell command execution were logged, originating from the compromised server.\n- **Obfuscation Techniques**: The commands were heavily obfuscated, a common technique used to evade detection.\n\n### Recommendations\n- **Immediate Review**: Conduct a thorough review of PowerShell logs across all servers.\n- **Restrict PowerShell Usage**: Implement restrictive policies to limit PowerShell script execution to trusted users only.', '2026-01-03 00:54:31'),
(78, 15, 365, 2, 'Discovery of Hidden Scheduled Task', '### Overview\nAfter observing anomalous PowerShell activity, a hidden scheduled task was discovered on the compromised server. This task is likely set up to ensure the attacker maintains persistence within the network.\n\n### Details\n- **Task Name**: The task was found under a misleading name resembling a legitimate system update.\n- **Execution Timing**: Scheduled to execute during off-peak hours to avoid detection.\n\n### Recommendations\n- **Task Audit**: Conduct a comprehensive audit of scheduled tasks on all critical systems.\n- **Security Policies**: Strengthen policies to alert on the creation of new scheduled tasks without proper authorization.', '2026-01-03 00:54:31');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(79, 15, 366, 3, 'Unauthorized Network Map Access Detected', '### Overview\nThe creation of a hidden scheduled task led to an incident where unauthorized access to the telecom network map was detected. This access suggests the attacker is preparing for lateral movement within the network.\n\n### Indicators\n- **Access Logs**: The logs show access by an unauthorized user account, possibly compromised through credential theft.\n- **Network Map Utility**: The access was directed at a utility used specifically by network engineers.\n\n### Recommendations\n- **Account Review**: Immediately review access permissions and enforce multi-factor authentication for all sensitive accounts.\n- **Monitor Tools**: Increase monitoring on network management tools to detect unusual access patterns.', '2026-01-03 00:54:31'),
(80, 15, 367, 4, 'Exfiltration of Call Detail Records', '### Overview\nThe final stage of the intrusion was marked by the exfiltration of call detail records (CDRs), confirming the adversary\'s objective.\n\n### Exfiltration Details\n- **Data Transfer**: Significant outbound data transfers were recorded, consistent with the volume of CDRs.\n- **Destination IP**: Transfers were directed towards an external server that has been linked to previous Gallium APT activities.\n\n### Recommendations\n- **Data Loss Prevention**: Implement DLP solutions to monitor and block unauthorized data transfers.\n- **Incident Response**: Initiate a full incident response procedure to assess the extent of the breach and remediate affected systems.', '2026-01-03 00:54:31'),
(81, 15, 368, 5, NULL, NULL, '2026-01-03 00:54:31'),
(82, 16, 369, 1, NULL, NULL, '2026-01-03 23:52:02'),
(83, 16, 370, 2, 'Macro Execution Insight', '### Context:\nUpon the detection of a suspicious macro-enabled document, further investigation revealed that the document contained obfuscated macro code designed to execute a malicious script. This script initiates the download of additional payloads, leading to the execution phase.\n\n### Next Steps:\nMonitor for unusual script executions and network traffic indicative of further payload downloads.', '2026-01-03 23:52:02'),
(84, 16, 371, 3, 'POWERSTATS Backdoor Analysis', '### Context:\nThe malicious script executed by the macro has installed the POWERSTATS backdoor, which is known for persistence mechanisms that allow attackers to maintain access to the system. This backdoor is commonly used by MuddyWater for further command execution and data exfiltration.\n\n### Next Steps:\nEnsure endpoint detection systems are updated to identify and block POWERSTATS activity.', '2026-01-03 23:52:02'),
(85, 16, 372, 4, 'C2 Communication Detected', '### Context:\nEncrypted communications have been detected with a known MuddyWater command and control (C2) server. This indicates active C2 communication, allowing for remote control and data exfiltration.\n\n### Next Steps:\nIsolate the infected systems to prevent further C2 interactions and gather network traffic logs for analysis.', '2026-01-03 23:52:02'),
(86, 16, 373, 5, 'Lateral Movement Patterns', '### Context:\nThere has been an attempt to move laterally across the network, likely using compromised credentials and exploiting network shares. This movement aims to expand the attack footprint within the agency\'s infrastructure.\n\n### Next Steps:\nConduct a thorough investigation of access logs and isolate affected network segments to prevent further lateral movement.', '2026-01-03 23:52:02'),
(87, 16, 374, 6, 'Credential Dumping Tactics', '### Context:\nCredential dumping activities have been identified, suggesting the use of tools like Mimikatz. This is a precursor for lateral movement and privilege escalation within the network.\n\n### Next Steps:\nInitiate a password reset for potentially compromised accounts and enhance monitoring for atypical login attempts.', '2026-01-03 23:52:02'),
(88, 16, 375, 7, 'Exfiltration Activity Alert', '### Context:\nFile transfer activities to an external server have been detected, indicating potential data exfiltration efforts by the attackers. This is a critical phase of the attack lifecycle.\n\n### Next Steps:\nBlock outbound connections to the identified external IPs and assess the types of data potentially exfiltrated.', '2026-01-03 23:52:02'),
(89, 16, 376, 8, 'Wiper Logic Activation', '### Context:\nThe execution of wiper logic has been detected, signaling the attacker\'s intent to destroy data and disrupt operations under the guise of ransomware.\n\n### Next Steps:\nInitiate backup restoration procedures and ensure data integrity checks are performed to verify the completeness of recovered data.', '2026-01-03 23:52:02'),
(90, 16, 377, 9, 'Forensic Artifact Analysis', '### Context:\nForensic artifact recovery has begun to understand the attack vector and methods used by MuddyWater. This is crucial for identifying weaknesses and preventing future attacks.\n\n### Next Steps:\nCollaborate with forensic experts to analyze recovered artifacts and compile an incident report for strategic improvements.', '2026-01-03 23:52:02'),
(91, 16, 378, 10, 'Mitigation and Remediation Summary', '### Context:\nComprehensive mitigation and remediation measures have been implemented, focusing on patching vulnerabilities, enhancing monitoring, and reinforcing security protocols.\n\n### Next Steps:\nConduct a post-incident review to evaluate the effectiveness of response actions and update security policies accordingly.', '2026-01-03 23:52:02'),
(92, 17, 379, 1, 'Analysis of Malicious Payload Execution', '# Analysis of Malicious Payload Execution\n\nFollowing the detection of a phishing email, a detailed investigation has identified the execution of a malicious payload on the target system. This payload, typically a Remote Access Trojan (RAT), allows the attacker to gain control over the infected system.\n\n## Key Findings:\n- **Payload Type:** The executed payload is consistent with APT1\'s known use of RATs to establish remote access.\n- **Execution Method:** The payload was executed via a script embedded in a seemingly benign document delivered through the phishing email.\n- **Next Steps:** Close monitoring is required to detect any persistence mechanisms that may be established by the attacker to maintain access.', '2026-01-04 00:59:40'),
(93, 17, 380, 2, 'Insight into Persistence Mechanisms', '# Insight into Persistence Mechanisms\n\nAfter executing the malicious payload, the attacker has likely installed a persistence mechanism to ensure continued access to the compromised system.\n\n## Key Techniques:\n- **Registry Modifications:** Changes to the system registry to enable the payload to execute upon system startup.\n- **Scheduled Tasks:** Creation of scheduled tasks that regularly trigger the payload.\n- **Service Creation:** Establishment of new services that run the malicious code in the background.\n\n## Implications:\nThe presence of these mechanisms suggests a strategic attempt to maintain long-term access. Monitoring for credential dumping is advised as the next phase in the attack lifecycle.', '2026-01-04 00:59:40'),
(94, 17, 381, 3, 'Credential Dumping Activity Overview', '# Credential Dumping Activity Overview\n\nThe persistence mechanisms have paved the way for the attacker to perform credential dumping, a technique used to extract user credentials from the compromised system.\n\n## Techniques Observed:\n- **LSASS Memory Dumping:** Access to Local Security Authority Subsystem Service (LSASS) memory to extract credentials.\n- **SAM Database Extraction:** Copying the Security Account Manager (SAM) database for offline analysis.\n- **Tools Used:** Use of known tools like Mimikatz to facilitate credential dumping.\n\n## Recommendations:\nImmediate action is required to prevent lateral movement within the network. Look out for data exfiltration attempts as potential next steps.', '2026-01-04 00:59:40'),
(95, 17, 382, 4, 'Data Exfiltration Attempt Analysis', '# Data Exfiltration Attempt Analysis\n\nFollowing credential dumping, the attacker has attempted to exfiltrate data from the target network.\n\n## Exfiltration Methods:\n- **Encrypted Channels:** Use of encrypted channels (e.g., HTTPS, VPN) to hide data transfer.\n- **Cloud Services:** Leveraging cloud storage services to exfiltrate data without arousing suspicion.\n- **FTP/SFTP:** Use of file transfer protocols to move data out of the network.\n\n## Detected Indicators:\n- Sudden spikes in outbound traffic.\n- Unusual access to cloud storage services.\n\n## Conclusion:\nThe detected data exfiltration attempt underscores the need for enhanced monitoring and response protocols to mitigate data loss and further unauthorized access.', '2026-01-04 00:59:40'),
(96, 17, 383, 5, NULL, NULL, '2026-01-04 00:59:40'),
(97, 18, 384, 1, 'Investigation of Spear Phishing Email', '### Overview\nThe initial access vector was identified as a spear phishing email targeting key personnel within the organization. The email contained a seemingly legitimate attachment that, once opened, executed a hidden script.\n\n### Analysis\n- **Sender:** The email originated from a spoofed address resembling a trusted partner.\n- **Content:** The attachment was a weaponized document with macros that, when enabled, triggered the download of a malicious payload.\n\n### Next Steps\n- **Immediate Action:** Advise recipients of similar emails to report and delete them without opening.\n- **Preparation for Next Alert:** Monitor systems for signs of script execution and unusual network activity.', '2026-01-04 02:06:57'),
(98, 18, 385, 2, 'Detection of Malicious PowerShell Activity', '### Overview\nFollowing the execution of the spear phishing attack, a malicious PowerShell script was detected. This script is designed to further compromise the network.\n\n### Analysis\n- **Script Functionality:** The script attempts to download additional payloads and establish a connection back to the attacker\'s command and control server.\n- **Indicators of Compromise (IoCs):** Unusual PowerShell commands observed, including obfuscated and encoded scripts.\n\n### Next Steps\n- **Mitigation:** Disable PowerShell scripting for non-administrative users and review execution logs.\n- **Preparation for Next Alert:** Monitor registry changes as the attacker may attempt to establish persistence.', '2026-01-04 02:06:57'),
(99, 18, 386, 3, 'Detection of Registry Modifications', '### Overview\nThe attacker has modified the registry to maintain persistence on targeted systems. This tactic ensures the malicious presence is sustained even after a reboot.\n\n### Analysis\n- **Registry Changes:** Specific keys related to startup and session management have been altered, pointing to unauthorized scripts.\n- **Persistence Mechanism:** Use of Run and RunOnce registry keys to ensure the script executes at startup.\n\n### Next Steps\n- **Immediate Action:** Restore original registry settings and remove unauthorized entries.\n- **Preparation for Next Alert:** Monitor for credential access attempts, which may indicate lateral movement.', '2026-01-04 02:06:57'),
(100, 18, 387, 4, 'Credential Dumping Activity Detected', '### Overview\nThe attacker is attempting lateral movement through credential dumping techniques. This is a critical phase where compromised credentials could lead to further infiltration.\n\n### Analysis\n- **Techniques Used:** Tools like Mimikatz have been detected, indicating attempts to extract credentials from memory.\n- **Targets:** Domain controllers and high-value systems are primary targets for credential harvesting.\n\n### Next Steps\n- **Mitigation:** Isolate affected systems and change all credentials for compromised accounts.\n- **Preparation for Next Alert:** Monitor network for encrypted traffic patterns indicating data exfiltration.', '2026-01-04 02:06:57'),
(101, 18, 388, 5, NULL, NULL, '2026-01-04 02:06:57'),
(102, 19, 389, 1, 'Analysis of APT10\'s Initial Access Techniques', '### Overview\nFollowing the alert of initial access through compromised MSP credentials, further analysis reveals that APT10 leveraged a combination of social engineering and spear-phishing attacks to acquire the necessary credentials. \n\n### Detailed Findings\n- **Phishing Campaign**: Targeted emails were sent to MSP employees, masquerading as official communications.\n- **Credential Harvesting**: APT10 used fake login portals to capture login details.\n\n### Next Steps\nFocus shifts to potential execution methods, with particular attention to DLL side-loading techniques known to be favored by APT10.', '2026-01-04 02:14:19'),
(103, 19, 390, 2, 'APT10\'s Use of DLL Side-Loading for Execution', '### Overview\nPost-execution analysis indicates that APT10 utilized DLL side-loading to run malicious code within trusted applications, bypassing security protocols.\n\n### Detailed Findings\n- **Target Application**: A legitimate aerospace CAD application was identified as the host for the side-loaded DLL.\n- **Malware Characteristics**: The malicious DLL was designed to trigger upon application start-up, ensuring seamless execution.\n\n### Next Steps\nInvestigations will now focus on how persistence is established post-execution, particularly through backdoor implants.', '2026-01-04 02:14:19'),
(104, 19, 391, 3, 'Establishing Persistence: Backdoor Implant Tactics', '### Overview\nAPT10\'s strategy for persistence involves deploying a stealthy backdoor implant that ensures ongoing access to the compromised systems.\n\n### Detailed Findings\n- **Backdoor Implant**: The implant is disguised as a legitimate system process, making detection challenging.\n- **Communication Channels**: The implant communicates with C2 servers using encrypted channels to evade detection.\n\n### Next Steps\nFocus will shift to identifying APT10\'s lateral movement techniques to access critical design servers within the aerospace network.', '2026-01-04 02:14:19'),
(105, 19, 392, 4, 'Lateral Movement: Accessing Design Servers', '### Overview\nAPT10 has successfully moved laterally within the network, reaching sensitive design servers crucial to aerospace projects.\n\n### Detailed Findings\n- **Credential Reuse**: Stolen credentials were used to authenticate with minimal detection.\n- **Network Mapping**: APT10 employed advanced network discovery tools to map the internal network architecture.\n\n### Next Steps\nAttention will now focus on how APT10 collects data from CAD repositories, preparing for exfiltration.', '2026-01-04 02:14:19'),
(106, 19, 393, 5, 'Data Collection from CAD Repositories', '### Overview\nAPT10 has begun the systematic collection of sensitive data from CAD repositories, focusing on proprietary designs and technologies.\n\n### Detailed Findings\n- **Data Targets**: High-value CAD files related to aerospace technologies were prioritized.\n- **Automated Scripts**: Custom scripts were used to streamline the data collection process.\n\n### Next Steps\nThe operation will now monitor the methods APT10 uses to exfiltrate the collected data, emphasizing the use of encrypted channels.', '2026-01-04 02:14:19'),
(107, 19, 394, 6, 'Exfiltration via Encrypted Channels', '### Overview\nAPT10 is in the process of exfiltrating the collected CAD data using encrypted channels to avoid detection by standard security measures.\n\n### Detailed Findings\n- **Encryption Protocols**: Utilized strong encryption to secure data in transit.\n- **Exfiltration Paths**: Data is being sent to overseas servers known to be associated with APT10.\n\n### Next Steps\nThe final phase will assess APT10\'s efforts to clean up and cover their tracks, focusing on defensive evasion techniques.', '2026-01-04 02:14:19'),
(108, 19, 395, 7, NULL, NULL, '2026-01-04 02:14:19'),
(109, 20, 396, 1, 'Execution of Malicious Script - Unlocked', '### Overview\nFollowing the detection of suspicious network activity, further investigation has revealed the execution of a potentially malicious script on multiple network endpoints. The script appears to connect to external command and control (C2) servers, indicating the possibility of an advanced persistent threat (APT) operation.\n\n### Key Findings\n- **Script Origin**: The script was deployed from an external IP address linked to known malicious activity.\n- **C2 Communication**: Established connections with C2 servers observed in previous Whitefly APT campaigns.\n- **Potential Impact**: If left unchecked, the script could allow attackers to execute further malicious activities within the network.\n\n### Recommendations\n- Conduct endpoint analysis to identify all systems affected by the script.\n- Isolate compromised systems to prevent further execution and communication with C2 servers.', '2026-01-04 02:15:53'),
(110, 20, 397, 2, 'Vcrodat Malware Persistence Mechanism - Unlocked', '### Overview\nThe investigation has progressed to identifying the persistence mechanisms employed by the Vcrodat malware identified in the healthcare network. Persistence is a key tactic used by the malware to maintain unauthorized access over an extended period.\n\n### Key Findings\n- **Registry Alterations**: Changes in the system registry to ensure malware execution upon startup.\n- **Scheduled Tasks**: Creation of hidden scheduled tasks to trigger the malware at specific intervals.\n- **System Services**: Manipulation of existing services to load malicious components.\n\n### Recommendations\n- Review and audit system registry and scheduled tasks for unauthorized entries.\n- Implement monitoring of system services to detect anomalies related to persistence mechanisms.', '2026-01-04 02:15:53'),
(111, 20, 398, 3, 'Compromised Open-Source Tool Identified - Unlocked', '### Overview\nDuring the analysis of persistence mechanisms, it was discovered that Whitefly APT has compromised an open-source tool widely used within the organization. This tool has been modified to evade defense mechanisms and facilitate lateral movement.\n\n### Key Findings\n- **Tool Modification**: Alterations to the source code to include backdoor functionality.\n- **Evasion Techniques**: The tool appears benign but contains hidden capabilities to bypass detection.\n- **Impact on Infrastructure**: The tool is deployed across several critical systems, amplifying the threat landscape.\n\n### Recommendations\n- Perform a comprehensive audit of open-source tools and validate their integrity.\n- Educate users on potential risks associated with unverified open-source software.', '2026-01-04 02:15:53'),
(112, 20, 399, 4, 'Unauthorized Credentials Accessed - Unlocked', '### Overview\nThe compromised open-source tool has facilitated unauthorized access to sensitive credentials, enabling lateral movement within the network. This breach exposes critical systems to further exploitation.\n\n### Key Findings\n- **Credential Dumping**: Use of the tool to extract login credentials from memory and secured storage.\n- **Privileged Access**: Attacker gained administrative privileges on several key systems.\n- **Lateral Movement**: Access used to pivot across the network to other high-value targets.\n\n### Recommendations\n- Implement multi-factor authentication to mitigate unauthorized access.\n- Regularly update and change credentials, especially for privileged accounts.', '2026-01-04 02:15:53'),
(113, 20, 400, 5, 'Unusual Data Access Patterns Detected - Unlocked', '### Overview\nA pattern of unusual data access has been identified, indicating potential data collection activities by the threat actor. The access patterns suggest targeted extraction of sensitive information.\n\n### Key Findings\n- **Data Queries**: High-frequency access to patient records and financial data.\n- **Anomalous Behavior**: Access occurring outside normal operating hours and from unexpected locations.\n- **Data Volume**: Significant increase in data retrieval activities, consistent with data staging for exfiltration.\n\n### Recommendations\n- Enhance data access monitoring and alerting capabilities.\n- Conduct data integrity checks to ensure no unauthorized modifications have occurred.', '2026-01-04 02:15:53'),
(114, 20, 401, 6, 'Data Exfiltration Attempt Blocked - Unlocked', '### Overview\nA data exfiltration attempt has been detected and successfully blocked. The perpetrators attempted to transfer sensitive data to external locations using encrypted channels.\n\n### Key Findings\n- **Exfiltration Vector**: Attempts made through secure HTTP channels to obfuscate activities.\n- **Blocked Channels**: Network defenses successfully identified and halted suspicious data transfers.\n- **Threat Actor Tactics**: Use of encryption and compression to mask data exfiltration attempts.\n\n### Recommendations\n- Strengthen perimeter defenses and encryption detection mechanisms.\n- Conduct a full review of attempted exfiltration activities to identify any potential gaps in security.', '2026-01-04 02:15:53'),
(115, 20, 402, 7, NULL, NULL, '2026-01-04 02:15:53'),
(116, 21, 403, 1, 'Analysis of Suspicious Email Attachment', '### Context and Analysis\n\nAfter detecting a suspicious email attachment, it was identified as a malicious document containing macros designed to execute a remote script. This script aims to install a malicious browser extension, providing attackers with a foothold for further operations.\n\n### Recommendations\n- **Immediate Action:** Block and quarantine the email and any similar ones identified in the network.\n- **User Awareness:** Conduct an awareness campaign focusing on recognizing phishing emails and suspicious attachments.\n\n### Next Steps\nMonitoring network traffic for unusual patterns that may indicate the installation of unauthorized browser extensions.', '2026-01-04 02:18:47'),
(117, 21, 404, 2, 'Malicious Browser Extension Installation', '### Context and Analysis\n\nPost-installation of the malicious browser extension, communication with known command and control (C2) servers was observed. The extension is designed to capture user credentials and session cookies, feeding them back to the attackers.\n\n### Recommendations\n- **Immediate Action:** Remove any unauthorized extensions from all systems, and conduct a security review of all browser extensions.\n- **Network Defense:** Implement network monitoring to detect unusual data flows to external servers.\n\n### Next Steps\nInvestigate potential execution of additional payloads, such as BabyShark VBS scripts, from the compromised host.', '2026-01-04 02:18:47'),
(118, 21, 405, 3, 'Execution of BabyShark VBS Script', '### Context and Analysis\n\nThe BabyShark VBS script has been executed, establishing persistence on the compromised systems. This script allows for continuous monitoring and data collection without detection, targeting sensitive information related to nuclear policy.\n\n### Recommendations\n- **Immediate Action:** Isolate affected systems to prevent further spread.\n- **System Hardening:** Review and enhance endpoint security measures to detect VBS script execution.\n\n### Next Steps\nConduct a thorough investigation into unauthorized network access attempts, focusing on lateral movement across the internal network.', '2026-01-04 02:18:47'),
(119, 21, 406, 4, 'Detection of Unauthorized Network Access', '### Context and Analysis\n\nEvidence of lateral movement within the network has been detected. The adversaries are leveraging compromised credentials to access sensitive areas of the network, specifically targeting documents and communications related to nuclear policy.\n\n### Recommendations\n- **Immediate Action:** Revoke compromised credentials and enforce a network-wide password reset.\n- **Network Segmentation:** Implement tighter access controls and segment sensitive data to limit unauthorized access.\n\n### Next Steps\nPrepare for potential data exfiltration attempts by enhancing monitoring of outgoing traffic and securing data transfer protocols.', '2026-01-04 02:18:47'),
(120, 21, 407, 5, NULL, NULL, '2026-01-04 02:18:47'),
(121, 22, 408, 1, 'Analysis of Supply Chain Compromise', '### Overview\nAPT41 has initiated the operation with a sophisticated supply chain attack. This initial access highlights their capability to infiltrate trusted third-party vendors, leveraging them as conduits into the primary target infrastructure. \n\n### Key Indicators\n- **Compromised Vendor**: Evidence suggests a vulnerability in the vendor\'s software update mechanism was exploited.\n- **Payload Delivery**: Malicious payload embedded within legitimate updates.\n\n### Next Steps\nPrepare for potential **Malware Deployment** as the adversary typically uses the established foothold to inject backdoor malware into the compromised systems.', '2026-01-04 02:21:52'),
(122, 22, 409, 2, 'Backdoor Malware Deployment Detected', '### Overview\nFollowing the supply chain compromise, APT41 has deployed backdoor malware to maintain clandestine access to the systems. This malware is likely custom-built and designed to evade detection.\n\n### Malware Characteristics\n- **Type**: Custom backdoor with advanced evasion features.\n- **Command and Control**: Utilizes encrypted communications to a remote server.\n\n### Next Steps\nThe focus will likely shift to **Establishing Persistence**. Anticipate techniques such as rootkit deployment to ensure long-term access and stealth.', '2026-01-04 02:21:52'),
(123, 22, 410, 3, 'Persistence Mechanism through Rootkit Deployment', '### Overview\nAPT41 has successfully established persistence by installing a rootkit. This rootkit operates at a low level, providing the attackers with the ability to maintain access and conceal their activities effectively.\n\n### Rootkit Details\n- **Capabilities**: Hides files, processes, and network connections.\n- **Installation**: Likely implanted through escalated privileges gained via malware.\n\n### Next Steps\nPrepare for **Lateral Movement** as the attackers might attempt to access sensitive databases, including those containing Personally Identifiable Information (PII).', '2026-01-04 02:21:52'),
(124, 22, 411, 4, 'Lateral Movement Towards PII Databases', '### Overview\nAPT41 has progressed to lateral movement, targeting databases containing PII. This phase involves exploiting compromised credentials and leveraging them to navigate through the network.\n\n### Techniques Observed\n- **Credential Dumping**: Use of tools to extract credentials from memory.\n- **Network Scanning**: Mapping out network architecture to identify PII storage.\n\n### Next Steps\nExpect imminent **Data Exfiltration** of gaming source code and PII. Implement network monitoring and data leakage prevention measures immediately.', '2026-01-04 02:21:52'),
(125, 22, 412, 5, NULL, NULL, '2026-01-04 02:21:52'),
(126, 23, 413, 1, 'In-Depth Analysis: Supply Chain Compromise', '### Overview\nThe recent detection of a **Supply Chain Compromise** indicates a sophisticated attempt to infiltrate our network through third-party software or services. This method is commonly employed by APT41 to bypass traditional security measures by embedding malicious code within trusted updates or applications.\n\n### Indicators of Compromise (IoCs)\n- Newly introduced DLL files in application directories.\n- Unusual outbound traffic patterns from software update services.\n\n### Recommended Actions\n- Conduct a comprehensive review of all third-party software sources.\n- Isolate compromised systems and initiate a forensic investigation.\n- Enhance monitoring on network traffic associated with supply chain services.\n\n### Next Steps\nPrepare for potential **Suspicious Script Execution**, as attackers might leverage compromised software to execute malicious scripts.', '2026-01-04 04:11:48'),
(127, 23, 414, 2, 'Investigation: Suspicious Script Execution Patterns', '### Overview\nFollowing the supply chain compromise, a **Suspicious Script Execution** has been detected. APT41 often utilizes scripts to automate the deployment of their payloads and establish a foothold in the network.\n\n### Key Findings\n- Scripts attempting to execute PowerShell commands with obfuscation techniques.\n- Log entries indicating unauthorized script activity during off-peak hours.\n\n### Recommendations\n- Implement script-blocking policies at the endpoint level.\n- Increase audit logging of PowerShell and other script execution frameworks.\n- Conduct user awareness training on recognizing phishing attempts that may lead to script execution.\n\n### Next Steps\nRemain vigilant for **Persistence Mechanism Activation**, as attackers may seek to maintain access to the compromised systems.', '2026-01-04 04:11:48'),
(128, 23, 415, 3, 'Insight: Persistence Mechanism Activation', '### Overview\nThe detection of a **Persistence Mechanism Activation** suggests that attackers are attempting to maintain long-term access to the compromised environment. APT41 may use various methods such as registry modifications or scheduled tasks.\n\n### Key Indicators\n- Creation of new registry keys pointing to unknown executables.\n- Scheduled tasks set to execute at irregular intervals.\n\n### Mitigation Strategies\n- Audit and clean registry entries associated with unauthorized applications.\n- Review and disable suspicious scheduled tasks.\n- Deploy Endpoint Detection and Response (EDR) tools to monitor persistence techniques.\n\n### Next Steps\nPrepare to intercept **Lateral Movement**, as attackers may attempt to expand their access across the network.', '2026-01-04 04:11:48'),
(129, 23, 416, 4, 'Analysis: Lateral Movement Detected', '### Overview\n**Lateral Movement** has been detected, indicating that the attackers are attempting to spread their foothold within the network. APT41 often uses stolen credentials and exploits to navigate through systems.\n\n### Evidence Collected\n- Unauthorized access attempts on multiple networked devices.\n- Usage of compromised credentials to access sensitive systems.\n\n### Defensive Measures\n- Implement network segmentation to limit lateral movement capabilities.\n- Conduct a full credential reset, prioritizing high-privilege accounts.\n- Utilize honeypots to detect unauthorized movement attempts.\n\n### Next Steps\nFocus on preventing **Data Exfiltration Attempts**, as attackers may attempt to extract valuable data before detection.', '2026-01-04 04:11:48'),
(130, 23, 417, 5, NULL, NULL, '2026-01-04 04:11:48'),
(131, 24, 418, 1, 'Insight into Initial Access through Phishing', '### Overview\nThe phishing email detected in the initial alert utilized a well-crafted spear-phishing technique targeting employees with access to critical systems.\n\n### Details\n- **Sender:** masqueraded as a trusted vendor.\n- **Subject Line:** \"Urgent Invoice Request\"\n- **Payload:** Attachment containing a malicious macro.\n\n### Recommendations\n- Conduct an organization-wide phishing awareness training.\n- Implement an email filtering system to detect and quarantine suspicious emails.\n\n### Next Steps\nMonitor for any execution of malware associated with this phishing attempt.', '2026-01-04 04:13:57'),
(132, 24, 419, 2, 'Analysis of Malware Execution', '### Overview\nFollowing the phishing incident, malware execution was detected on the targeted employee\'s workstation.\n\n### Details\n- **Type of Malware:** Cobalt Strike\n- **Execution Method:** Macro within Excel document\n- **Impact:** Established a command and control (C2) channel.\n\n### Recommendations\n- Isolate the affected workstation immediately.\n- Deploy endpoint detection and response (EDR) solutions to prevent further spread.\n\n### Next Steps\nInvestigate persistence mechanisms that may have been employed by the malware.', '2026-01-04 04:13:57'),
(133, 24, 420, 3, 'Detection of Persistence Mechanisms', '### Overview\nThe malware has established persistence to survive system reboots and maintain access.\n\n### Details\n- **Persistence Technique:** Registry run keys\n- **Additional Observations:** Scheduled tasks were also modified.\n\n### Recommendations\n- Review and clean registry entries.\n- Analyze scheduled tasks for unauthorized modifications.\n\n### Next Steps\nMonitor for unusual administrative access that may indicate lateral movement within the network.', '2026-01-04 04:13:57'),
(134, 24, 421, 4, 'Unauthorized Admin Access Detected', '### Overview\nAnomalous administrative access was detected, indicating potential lateral movement by the threat actor.\n\n### Details\n- **Account Compromised:** Admin account \"sysadmin\"\n- **Access Point:** Remote desktop protocol (RDP)\n- **Time of Access:** 03:45 AM\n\n### Recommendations\n- Immediately reset credentials for all admin accounts.\n- Implement multi-factor authentication (MFA) for critical accounts.\n\n### Next Steps\nInvestigate and monitor for any signs of data exfiltration attempts.', '2026-01-04 04:13:57'),
(135, 24, 422, 5, NULL, NULL, '2026-01-04 04:13:57'),
(136, 25, 423, 1, 'Phishing Email Analysis', '### Initial Findings\n\nThe phishing email detected contained a malicious attachment disguised as an invoice. The email was sent from a seemingly legitimate domain but upon further inspection, the domain was registered only days prior to the attack. The email header analysis revealed multiple red flags including mismatched sender information and a peculiar routing path through compromised servers.\n\n### Next Steps\n\n1. **Immediate Action:** Isolate the user account that received and interacted with the email.\n2. **Investigation:** Conduct a deeper analysis of the attachment to determine the specific exploit used.\n3. **Preparation:** Anticipate potential execution attempts via scripts and monitor PowerShell activity closely.', '2026-01-04 04:25:30'),
(137, 25, 424, 2, 'PowerShell Script Execution Insights', '### Script Analysis\n\nThe suspicious PowerShell script executed on the compromised endpoint was obfuscated to evade detection. The script attempted to download additional payloads from a remote server using encoded commands. This behavior is consistent with the initial stages of malware deployment.\n\n### Mitigation Steps\n\n1. **Isolation:** Disconnect the affected machine from the network immediately.\n2. **Forensic Analysis:** Capture a memory dump for further investigation.\n3. **Monitoring:** Enhance monitoring on PowerShell logs and network traffic to detect other possible execution attempts.\n\n### Preparing for Persistence\n\nBe vigilant for signs of persistence mechanisms, such as unusual changes in registry keys or scheduled tasks.', '2026-01-04 04:25:33'),
(138, 25, 425, 3, 'Persistence Mechanism Investigation', '### Observations\n\nPersistence was established through registry modifications and the creation of hidden scheduled tasks. Additionally, the malware created a startup entry to ensure execution upon system reboot.\n\n### Countermeasures\n\n1. **Registry Audit:** Conduct a full audit of recent registry changes, focusing on keys related to startup programs.\n2. **Scheduled Task Review:** Identify and remove unauthorized tasks.\n3. **User Education:** Reinforce training on recognizing and reporting phishing attempts.\n\n### Preparing for Lateral Movement\n\nMonitor RDP connections and unusual authentication attempts across the network.', '2026-01-04 04:25:33'),
(139, 25, 426, 4, 'Lateral Movement and Exfiltration Threat Analysis', '### Lateral Movement Detection\n\nThe adversary utilized Remote Desktop Protocol (RDP) to move laterally within the network. This was facilitated by previously compromised credentials.\n\n### Immediate Actions\n\n1. **Credential Review:** Reset passwords for all affected accounts and enforce MFA.\n2. **RDP Restrictions:** Limit RDP access to only essential personnel and monitor for unauthorized attempts.\n\n### Preparing for Data Exfiltration\n\nAs exfiltration is likely the next stage, enhance monitoring of outbound network traffic and inspect large data transfers for legitimacy. Employ DLP solutions to prevent unauthorized data transfers.', '2026-01-04 04:25:33'),
(140, 25, 427, 5, NULL, NULL, '2026-01-04 04:25:33'),
(141, 26, 428, 1, 'Analysis of Initial Access Vector', '### Overview\nAfter detecting the spear phishing email, our analysis has identified key elements within the email structure that are consistent with Cl0p\'s tactics. The email contained a seemingly legitimate attachment designed to deceive the recipient into executing it.\n\n### Email Characteristics\n- **Sender Address:** Spoofed domain closely resembling a known partner.\n- **Subject Line:** Urgent action required to avoid account suspension.\n- **Attachment:** A compressed file containing a malicious script.\n\n### Next Steps\nThe focus will now shift to monitoring potential execution vectors, particularly any script execution resulting from this phishing attempt.', '2026-01-04 04:38:04'),
(142, 26, 429, 2, 'Malicious Script Execution Confirmed', '### Overview\nA malicious script linked to the previously detected spear phishing email was executed on the target system. This script has been identified as a custom PowerShell script, a common tool in Cl0p\'s arsenal.\n\n### Script Analysis\n- **Payload:** The script downloads and executes additional payloads.\n- **Obfuscation Techniques:** Heavy use of string obfuscation to evade detection.\n- **Target System Impact:** Initial dropper for further malware deployment.\n\n### Next Steps\nOur priority is to determine how the attacker is establishing persistence. Monitoring registry changes and other system modifications will be critical.', '2026-01-04 04:38:04'),
(143, 26, 430, 3, 'Persistence Mechanism Detected', '### Overview\nPersistence has been established via registry modification, a tactic often utilized by Cl0p to maintain access to compromised systems.\n\n### Details of Modification\n- **Registry Key Altered:** HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n- **Malware Executable:** Set to launch a secondary payload on system startup.\n\n### Implications\nThis persistence method suggests a long-term intent to maintain control over the system.\n\n### Next Steps\nFocus will now be on detecting lateral movement attempts, particularly through credential dumping activities that may follow.', '2026-01-04 04:38:04'),
(144, 26, 431, 4, 'Credential Dumping Detected', '### Overview\nCredential dumping activity has been identified, indicating an attempt to escalate privileges and move laterally within the network.\n\n### Tools and Techniques\n- **Tool Utilized:** Mimikatz, a known tool for credential extraction.\n- **Target:** Local Security Authority Subsystem Service (LSASS) process.\n\n### Security Implications\nCompromised credentials could allow access to critical systems and sensitive data.\n\n### Next Steps\nImmediate attention is required to monitor for data exfiltration attempts, especially through encrypted channels, a known Cl0p tactic.', '2026-01-04 04:38:04'),
(145, 26, 432, 5, NULL, NULL, '2026-01-04 04:38:04'),
(146, 27, 433, 1, 'Analysis of Suspicious Login Attempts', '## Context:\nFollowing the detection of suspicious login attempts indicating potential password spraying, further analysis is required to determine the risk level and potential targets.\n\n### Summary:\n- **Targets Identified:** Diplomatic personnel accounts.\n- **IP Patterns:** Multiple IP addresses originating from known threat landscapes.\n- **Recommendations:**\n  - Implement multi-factor authentication (MFA).\n  - Increase monitoring on login attempts from suspicious IPs.\n  - Educate users on recognizing phishing attempts.\n\n### Next Steps:\nMonitoring should continue to detect any unusual token usage, potentially indicating token theft.', '2026-01-04 23:55:22'),
(147, 27, 434, 2, 'Unusual Token Usage Analysis', '## Context:\nFollowing the detection of unusual token usage patterns, this report delves deeper into potential token theft activities.\n\n### Summary:\n- **Token Characteristics:**\n  - Tokens used outside of normal geographic locations.\n  - Access requests for sensitive diplomatic documents.\n- **Attack Vector:** Possible exploitation of application vulnerabilities.\n- **Mitigation Measures:**\n  - Revoke compromised tokens.\n  - Reset affected accounts.\n  - Strengthen token issuance policies.\n\n### Next Steps:\nVigilance is required for any unauthorized OAuth applications that may be created, leveraging stolen tokens.', '2026-01-04 23:55:22'),
(148, 27, 435, 3, 'Unauthorized OAuth Application Creation Alert', '## Context:\nDetection of unauthorized OAuth applications suggests potential abuse aimed at gaining persistent access to sensitive resources.\n\n### Summary:\n- **Applications Identified:** Several OAuth applications mimicking legitimate services.\n- **Impacted Resources:** Access to email, cloud storage, and internal communication tools.\n- **Countermeasures:**\n  - Immediate removal of unauthorized applications.\n  - Conduct a thorough review of existing OAuth permissions.\n  - Tighten OAuth application approval processes.\n\n### Next Steps:\nMonitor for signs of lateral movement within the cloud environment to preempt further exploitation.', '2026-01-04 23:55:22'),
(149, 27, 436, 4, 'Lateral Movement and Cloud Exploitation Insights', '## Context:\nDetection of lateral movement within the cloud environment indicates potential exploitation following OAuth abuse.\n\n### Summary:\n- **Patterns Observed:**\n  - Access to multiple cloud services using compromised identities.\n  - Unusual escalation of privileges within cloud platforms.\n- **Threat Actors:** Likely linked to known APT groups targeting diplomatic entities.\n- **Defensive Actions:**\n  - Audit and restrict permissions on sensitive resources.\n  - Employ behavior analytics to detect anomalies.\n\n### Next Steps:\nRemain vigilant for any signs of data exfiltration, which may be the next phase of the attack.', '2026-01-04 23:55:22'),
(150, 27, 437, 5, NULL, NULL, '2026-01-04 23:55:22'),
(151, 28, 438, 1, 'Analysis of PowerShell Execution Patterns', '### Context\nFollowing the detection of unusual PowerShell execution, a detailed analysis was conducted to understand the patterns and motives behind this activity.\n\n### Findings\n- **Command Execution**: The PowerShell script was executed with obfuscated commands, suggesting an attempt to evade detection.\n- **Objective**: Initial analysis indicates the possibility of reconnaissance activities, potentially setting up for persistence mechanisms.\n\n### Recommendations\n- **Monitoring**: Enhance logging of PowerShell activities and implement real-time alerts for suspicious command patterns.\n- **Mitigation**: Implement PowerShell script block logging and transcription to capture detailed execution data.\n\n### Next Steps\nPrepare for potential persistence mechanisms, as suggested by the nature of the PowerShell activity. Stay vigilant for suspicious WMI activity.', '2026-01-04 23:57:10'),
(152, 28, 439, 2, 'Investigation into Suspicious WMI Activity', '### Context\nPost detection of suspicious WMI activity, an investigation was launched to determine the scope and impact of this persistence strategy.\n\n### Findings\n- **WMI Usage**: The attacker leveraged WMI to establish persistence, likely by creating event subscriptions to execute malicious scripts upon specific triggers.\n- **Scope**: This activity is consistent with tactics used by Volt Typhoon, indicating a sophisticated threat actor.\n\n### Recommendations\n- **Hardening**: Disable unnecessary WMI services and restrict access to only authorized personnel.\n- **Detection**: Employ advanced monitoring to detect new WMI event subscriptions or alterations to existing ones.\n\n### Next Steps\nPrepare for potential lateral movement, as WMI activity often precedes such actions. Monitor for changes in network configurations or unusual remote access attempts.', '2026-01-04 23:57:10'),
(153, 28, 440, 3, 'Security Implications of Anomalous netsh Configuration', '### Context\nAnomalous changes in netsh configuration were observed, indicating potential lateral movement efforts by the threat actor.\n\n### Findings\n- **Configuration Changes**: The attacker appears to have modified firewall rules and network configurations to facilitate lateral movement within the infrastructure.\n- **Intent**: Such changes are typically employed to bypass network security controls or to establish covert communication channels.\n\n### Recommendations\n- **Review**: Conduct a comprehensive review of all recent netsh configuration changes and validate against security policies.\n- **Prevention**: Implement strict access controls and regular audits on network configuration tools.\n\n### Next Steps\nMonitor for unusual remote desktop protocol (RDP) sessions, which may be utilized for further lateral movement across the network.', '2026-01-04 23:57:10'),
(154, 28, 441, 4, 'Detection of Unusual RDP Sessions', '### Context\nThe detection of unexpected RDP sessions suggests an ongoing lateral movement effort by the attacker within the network.\n\n### Findings\n- **RDP Activity**: Multiple unauthorized RDP sessions were initiated, likely to access sensitive systems and further compromise the infrastructure.\n- **Patterns**: The sessions were conducted using compromised credentials, indicating the threat actor\'s success in credential theft.\n\n### Recommendations\n- **Access Controls**: Enhance RDP access controls and enforce multi-factor authentication for remote access.\n- **Surveillance**: Implement continuous monitoring of RDP sessions and alert on any deviations from normal patterns.\n\n### Next Steps\nRemain alert for potential exfiltration attempts, as attackers may leverage newly gained access to exfiltrate data through encrypted channels.', '2026-01-04 23:57:10'),
(155, 28, 442, 5, NULL, NULL, '2026-01-04 23:57:10'),
(156, 29, 443, 1, 'Analysis of Phishing Email Tactics', '## Overview\nThe phishing email detected appears to be part of a coordinated campaign by Charming Kitten, targeting journalists. The email contains a malicious link disguised as a legitimate news article.\n\n## Detailed Analysis\n- **Sender Details**: The email masquerades as coming from a known media organization, using a spoofed domain closely resembling the legitimate one.\n- **Content**: The email body uses urgent language to entice the recipient to click on the link, promising exclusive content.\n\n## Recommendations\n- **User Awareness**: Encourage recipients to verify the sender\'s email address.\n- **Security Measures**: Implement email filtering and flagging for known malicious domains.\n\n## Next Steps\nPrepare for potential follow-up attacks through other communication channels such as WhatsApp.', '2026-01-04 23:59:37'),
(157, 29, 444, 2, 'Malicious WhatsApp Message Dissection', '## Overview\nFollowing the phishing email, a malicious WhatsApp message was detected, indicating a multi-channel social engineering approach by Charming Kitten.\n\n## Detailed Analysis\n- **Message Content**: The message contains a shortened URL leading to a website hosting the DownPaper backdoor.\n- **Social Engineering Aspect**: The message pretends to be a continuation of the email conversation, increasing credibility.\n\n## Recommendations\n- **User Training**: Advise targets to verify unexpected messages, particularly those with links.\n- **Technical Measures**: Enhance monitoring on communication apps for known malicious URLs.\n\n## Next Steps\nAnticipate potential malware execution if the DownPaper payload is delivered successfully.', '2026-01-04 23:59:37'),
(158, 29, 445, 3, 'DownPaper Backdoor Execution Analysis', '## Overview\nThe DownPaper backdoor has been executed on a system, confirming the delivery method was successful through the malicious WhatsApp message.\n\n## Detailed Analysis\n- **Payload Functionality**: The backdoor establishes a connection to a command and control server, allowing remote access.\n- **Indicators of Compromise**: Look for unusual network traffic and processes related to DownPaper.\n\n## Recommendations\n- **Immediate Action**: Isolate the affected system to prevent further compromise.\n- **Detection Enhancement**: Update endpoint protection to identify DownPaper signatures.\n\n## Next Steps\nMonitor for lateral movement attempts within the network.', '2026-01-04 23:59:37'),
(159, 29, 446, 4, 'Lateral Movement and Data Exfiltration Readiness', '## Overview\nAfter executing the DownPaper backdoor, attempts to move laterally across the network have been detected.\n\n## Detailed Analysis\n- **Movement Techniques**: The attackers are exploiting known vulnerabilities in network protocols to move between systems.\n- **Target Identification**: Critical systems and databases appear to be the focus of these movements.\n\n## Recommendations\n- **Network Segmentation**: Implement stricter segmentation to limit lateral movement.\n- **Patch Management**: Ensure all systems are up-to-date with the latest security patches.\n\n## Next Steps\nPrepare for possible data exfiltration attempts by monitoring outgoing traffic for anomalies.', '2026-01-04 23:59:37'),
(160, 29, 447, 5, NULL, NULL, '2026-01-04 23:59:37'),
(161, 30, 448, 1, 'Initial Access Analysis: VPN Anomaly', '### VPN Login Anomaly\n\nAfter the detection of a suspicious VPN login from an unusual location, further investigation revealed that the credentials used were valid, suggesting potential credential compromise. The login originated from an IP address associated with known malicious activity. Analysts are advised to monitor for any further signs of unauthorized access.\n\n#### Recommendations\n- Immediately reset compromised credentials.\n- Implement geo-restriction policies on VPN access.\n- Increase logging and monitoring on VPN devices.', '2026-01-05 00:02:38');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(162, 30, 449, 2, 'Execution Tactics: Web Shell Deployment', '### Web Shell Detected on VPN Device\n\nA web shell has been detected on the compromised VPN device, indicating execution of potentially malicious code. The web shell allows remote execution of commands and could be used to further infiltrate the network.\n\n#### Recommendations\n- Isolate impacted VPN devices immediately.\n- Conduct a thorough inspection for additional web shells.\n- Patch any vulnerabilities in the VPN firmware.', '2026-01-05 00:02:38'),
(163, 30, 450, 3, 'Lateral Movement Insights: Network Traffic Anomalies', '### Unusual Network Traffic Patterns\n\nPost web shell deployment, there has been unusual network traffic from the VPN device to multiple internal servers. This traffic suggests lateral movement attempts within the network, potentially targeting critical systems or domain controllers.\n\n#### Recommendations\n- Capture and analyze network traffic logs.\n- Deploy network segmentation to limit lateral movement.\n- Increase IDS/IPS sensitivity to detect anomalous traffic.', '2026-01-05 00:02:38'),
(164, 30, 451, 4, 'Persistence Analysis: Domain Controller Access Attempt', '### Unauthorized Domain Controller Access\n\nAn unauthorized access attempt was detected on the domain controller, suggesting efforts to establish persistence. The attacker likely seeks to maintain long-term access to the network.\n\n#### Recommendations\n- Audit domain controller access logs for anomalies.\n- Implement two-factor authentication for sensitive systems.\n- Regularly review and harden domain controller configurations.', '2026-01-05 00:02:38'),
(165, 30, 452, 5, 'Credential Harvesting: Mimikatz Activity', '### Mimikatz Detected on Domain Controller\n\nMimikatz, a tool used for credential harvesting, was detected running on the domain controller. This indicates that the attacker is attempting to extract credentials to escalate privileges and expand access.\n\n#### Recommendations\n- Revoke and reset compromised credentials immediately.\n- Implement endpoint detection and response solutions.\n- Conduct a full security audit of domain controller systems.', '2026-01-05 00:02:38'),
(166, 30, 453, 6, 'Exfiltration Alert: Data Movement from Domain Controller', '### Data Exfiltration Detected\n\nSignificant data exfiltration activity has been detected from the domain controller. This suggests that sensitive information has been compromised and potentially transferred outside the network.\n\n#### Recommendations\n- Identify and secure the data exfiltration point.\n- Implement data loss prevention tools.\n- Notify relevant stakeholders and legal entities as per compliance requirements.', '2026-01-05 00:02:38'),
(167, 30, 454, 7, NULL, NULL, '2026-01-05 00:02:38'),
(168, 32, 455, 1, 'Post-Compromise Analysis: Third-Party Library Breach', '### Overview\nThe initial alert identified a compromise via a third-party library, suggesting a supply chain attack. This indicates a breach at the level of software dependencies, commonly exploited by Magecart groups.\n\n### Technical Details\n- **Vulnerable Library**: The breach originated from a popular JavaScript library commonly used for e-commerce platforms.\n- **Attack Vector**: The attackers injected malicious code into the library before distribution, affecting all sites utilizing the compromised version.\n\n### Recommendations\n- **Immediate Actions**: Remove the compromised library version from your systems and monitor for any unusual activity.\n- **Long-term Strategy**: Implement a robust dependency tracking system and regularly audit third-party code for vulnerabilities.\n\n### Next Steps\nPrepare for potential **Code Injection** activities, as malicious scripts are likely to be executed on compromised websites.', '2026-01-05 00:07:01'),
(169, 32, 456, 2, 'Execution of Obfuscated JavaScript: Code Injection Analysis', '### Overview\nFollowing the supply chain compromise, obfuscated JavaScript has been detected executing within the affected websites. This is a classic Magecart tactic aimed at capturing sensitive user data.\n\n### Technical Details\n- **Obfuscation Method**: The JavaScript code uses advanced obfuscation techniques to avoid detection by standard security tools.\n- **Functionality**: The script is designed to skim credit card information entered on checkout pages and store it temporarily before exfiltration.\n\n### Recommendations\n- **Immediate Actions**: Deploy advanced threat detection tools capable of de-obfuscating and analyzing JavaScript code in real-time.\n- **Mitigation Strategy**: Harden your Content Security Policy (CSP) to restrict unauthorized script execution.\n\n### Next Steps\nPrepare for **Data Exfiltration** as the attackers will attempt to transfer skimmed data to their drop servers. Monitor outgoing network traffic for anomalies.', '2026-01-05 00:07:01'),
(170, 32, 457, 3, NULL, NULL, '2026-01-05 00:07:01'),
(171, 33, 458, 1, 'Initial Access Analysis: Vendor Login Anomaly', '## Investigation Summary\nThe suspicious vendor login detected indicates potential unauthorized access to the retail network. The login was traced back to an IP address known for previous cyber activities linked to the FIN6 group.\n\n## Incident Details\n- **Date & Time**: [Timestamp]\n- **Source IP**: [Suspicious IP Address]\n- **Affected System**: Vendor portal\n\n## Recommendations\n- Immediately review access logs for the vendor portal.\n- Implement multi-factor authentication for vendor accounts.\n- Conduct a security audit of all vendor credentials.\n\n## Next Steps\nPrepare for potential escalation of activities, such as malware deployment, given historical patterns of FIN6 operations.', '2026-01-05 00:10:13'),
(172, 33, 459, 2, 'Trinity Malware Deployment on POS Systems', '## Incident Overview\nFollowing the initial access, Trinity malware has been deployed across multiple POS systems. This malware is engineered to scrape sensitive credit card data.\n\n## Key Indicators\n- **Malware Signature**: Trinity (v2.5)\n- **Affected Systems**: POS terminals at multiple retail locations\n- **Detection Method**: Anomalous network traffic and unusual process activity\n\n## Containment Measures\n- Isolate affected POS systems from the network.\n- Begin forensic imaging of compromised systems for deeper analysis.\n\n## Next Steps\nFocus on understanding the method of persistence that the attackers may employ to maintain access within the network.', '2026-01-05 00:10:13'),
(173, 33, 460, 3, 'Persistence Mechanisms: Ensuring Long-term Access', '## Persistence Tactics\nFollowing the Trinity malware deployment, evidence suggests the attackers are establishing persistence mechanisms to secure long-term access.\n\n## Observations\n- **Backdoor Installations**: Detected across several POS systems.\n- **Registry Alterations**: Unusual changes consistent with persistence techniques.\n- **Scheduled Tasks**: Newly created tasks that execute malicious scripts.\n\n## Recommendations\n- Perform a comprehensive review of system startup entries and scheduled tasks.\n- Remove unauthorized backdoors and restore registry settings to default.\n\n## Next Steps\nMonitor for lateral movement attempts as attackers may seek to expand their foothold within the network.', '2026-01-05 00:10:13'),
(174, 33, 461, 4, 'Lateral Movement Detected: Expanding Attack Surface', '## Movement Patterns\nUnauthorized lateral movement has been detected, suggesting an expansion of the attack surface by FIN6 operatives.\n\n## Indicators of Compromise\n- **Credential Harvesting**: Attempts to access additional systems using compromised credentials.\n- **Network Scanning**: Scans targeting lateral movement pathways.\n- **Unauthorized Access**: Attempts to access HR and financial systems.\n\n## Containment Strategies\n- Implement network segmentation to restrict unauthorized access.\n- Reset credentials for all potentially compromised accounts.\n\n## Next Steps\nPrepare for potential data exfiltration attempts, focusing particularly on sensitive financial data.', '2026-01-05 00:10:13'),
(175, 33, 462, 5, NULL, NULL, '2026-01-05 00:10:13'),
(176, 34, 463, 1, 'Execution of Embedded VBScript Backdoor Uncovered', '### Overview\nFollowing the initial access achieved through a weaponized Word document, further investigation has revealed the execution of an embedded VBScript backdoor. This backdoor is activated as soon as the document is opened by the target, exploiting vulnerabilities in VBScript execution.\n\n### Technical Details\nThe VBScript is designed to run in the background, establishing persistent access to the compromised system. It leverages Windows Management Instrumentation (WMI) to execute commands and maintain a foothold.\n\n### Indicators of Compromise (IOCs)\n- Unusual network traffic originating from the affected host.\n- Creation of scheduled tasks or registry entries linked to VBScript execution.\n\n### Recommendations\n- Implement strict email filtering to block potentially malicious attachments.\n- Educate personnel on recognizing phishing attempts and suspicious document behaviors.', '2026-01-05 02:59:34'),
(177, 34, 464, 2, 'Data Exfiltration via Encrypted Channels Identified', '### Overview\nThe previously identified VBScript backdoor has facilitated data exfiltration activities. Our analysis indicates that sensitive information is being transmitted through encrypted channels, making detection more challenging.\n\n### Technical Details\nThe data exfiltration process involves packaging sensitive files into encrypted archives, which are then transmitted to remote servers controlled by the threat actors. The use of HTTPS and other encrypted protocols obscures the content from standard monitoring tools.\n\n### Indicators of Compromise (IOCs)\n- Outbound connections to unfamiliar IP addresses using HTTPS.\n- Unusual data transfer volumes at odd hours.\n\n### Recommendations\n- Deploy network anomaly detection systems to identify unusual patterns in encrypted traffic.\n- Conduct regular audits of data access and transfer logs to spot unauthorized activities.\n- Strengthen endpoint security measures to detect and block unauthorized encryption tools.', '2026-01-05 02:59:34'),
(178, 34, 465, 3, NULL, NULL, '2026-01-05 02:59:34'),
(179, 35, 466, 1, 'Insight into Initial Access: Trojanized Software Update', '### Contextual Analysis\n\nFollowing the detection of the **trojanized software update**, our investigation reveals that the compromise occurred through a sophisticated supply chain attack. The malicious update originates from a compromised vendor responsible for developing ICS software used widely in the energy sector.\n\n### Key Observations:\n- **Vendor Breach**: Initial analysis suggests that the vendor\'s software distribution infrastructure was breached approximately 3 months ago.\n- **Malware Characteristics**: The trojanized update includes a payload designed to install a Remote Access Trojan (RAT) known as \'Havex\'.\n\n### Next Steps:\n- **Monitor for RAT Deployment**: Be vigilant for signs of \'Havex\' RAT installation and execution across affected systems.\n- **Vendor Communication**: Engage with the software vendor to confirm breach details and remediation plans.', '2026-01-05 03:02:42'),
(180, 35, 467, 2, 'Execution of \'Havex\' RAT: Command and Control Infrastructure', '### Incident Overview\n\nPost-deployment of the **\'Havex\' RAT**, communication with its command and control (C2) servers has been observed. This RAT allows adversaries remote control over infected machines, enabling further reconnaissance and exploitation.\n\n### Key Indicators:\n- **C2 Domains**: Infected systems connect to multiple C2 domains, some of which have been newly registered and others linked to known threat actor infrastructure.\n- **RAT Capabilities**: The \'Havex\' RAT is capable of gathering system information, executing commands, and facilitating lateral movement.\n\n### Actionable Intelligence:\n- **Registry Monitoring**: Prepare to detect persistence mechanisms, particularly involving registry modifications.\n- **Network Segmentation**: Implement stricter network segmentation to limit RAT communication and lateral movement.', '2026-01-05 03:02:42'),
(181, 35, 468, 3, 'Persistence Mechanism: Registry Modifications Detected', '### Persistence Analysis\n\nThe adversary has employed **registry modifications** to ensure the \'Havex\' RAT remains active. This persistence mechanism involves altering system configurations to execute the RAT upon system startup.\n\n### Technical Details:\n- **Registry Keys Altered**: Modifications have been observed in key areas responsible for startup execution, specifically within `HKEY_LOCAL_MACHINE` and `HKEY_CURRENT_USER` paths.\n- **Stealth Tactics**: The changes are subtle, designed to evade typical detection methods by mimicking legitimate entries.\n\n### Recommendations:\n- **Conduct Integrity Checks**: Regularly verify registry integrity against known good baselines.\n- **Prepare for Lateral Movement**: Anticipate network reconnaissance activities, specifically anomalies in SMB traffic.', '2026-01-05 03:02:42'),
(182, 35, 469, 4, 'Lateral Movement: SMB Traffic Anomaly and Network Reconnaissance', '### Network Activity Review\n\nUnusual **SMB traffic patterns** indicate ongoing **lateral movement** and reconnaissance activities. This phase involves mapping the network to identify high-value targets for data exfiltration.\n\n### Traffic Analysis:\n- **Suspicious Connections**: Multiple SMB connections initiated from compromised hosts targeting administrative shares.\n- **Reconnaissance Tools**: Use of known tools such as `PsExec` and `WMIC` to explore network topology and access additional systems.\n\n### Defensive Measures:\n- **Anomaly Detection**: Enhance monitoring for unusual SMB traffic and lateral movement activities.\n- **Data Exfiltration Monitoring**: Prepare to intercept unauthorized data transfers, particularly those involving sensitive operational data.', '2026-01-05 03:02:42'),
(183, 35, 470, 5, NULL, NULL, '2026-01-05 03:02:42'),
(184, 36, 471, 1, 'Unsigned Software Update Detected', '## Overview\nFollowing the detection of suspicious Wi-Fi network activity, a potential threat has been identified involving an unsigned software update. This update appears to be disguised as a legitimate system or application update targeting luxury hotel executives.\n\n## Details\n- **Type of Threat:** Tapaoux malware\n- **Method of Delivery:** Wi-Fi network masquerading as a trusted access point\n- **Target:** Executives of luxury hotels\n\n## Recommendations\n- **Network Monitoring:** Enhance monitoring of Wi-Fi networks for unauthorized access points.\n- **Software Verification:** Ensure all updates are signed and verified before installation.\n\n## Next Steps\nInvestigate the execution phase to determine if the malware has been successfully deployed onto target systems.', '2026-01-05 03:04:49'),
(185, 36, 472, 2, 'Tapaoux Malware Persistence Mechanism', '## Overview\nAfter identifying the unsigned software update, further investigation reveals the Tapaoux malware has established persistence mechanisms in the target systems.\n\n## Details\n- **Persistence Techniques:** The malware modifies startup scripts and registry keys to ensure it executes upon system reboot.\n- **Stealth Tactics:** It employs obfuscation techniques to evade detection by traditional antivirus solutions.\n\n## Recommendations\n- **System Hardening:** Regularly review and limit startup scripts and registry changes.\n- **Advanced Threat Protection:** Deploy solutions capable of detecting obfuscated code.\n\n## Next Steps\nExamine potential unauthorized credential access attempts as the malware may be moving laterally within the network.', '2026-01-05 03:04:49'),
(186, 36, 473, 3, 'Unauthorized Credential Access Attempt', '## Overview\nFollowing the establishment of persistence by Tapaoux malware, there have been attempts to access credentials within the compromised systems.\n\n## Details\n- **Credential Harvesting:** The malware attempts to extract cached credentials from browsers and network authentication processes.\n- **Potential Targets:** Emails, financial applications, and internal corporate networks.\n\n## Recommendations\n- **Credential Management:** Enforce multi-factor authentication and regular credential updates.\n- **Incident Response:** Conduct a thorough review of access logs to identify any anomalies.\n\n## Next Steps\nMonitor for potential exfiltration of sensitive data, which could indicate further stages of the attack.', '2026-01-05 03:04:49'),
(187, 36, 474, 4, 'Exfiltration of Sensitive Data', '## Overview\nAs anticipated, there is evidence of data exfiltration following the unauthorized credential access attempts. Sensitive information has been transferred out of the network.\n\n## Details\n- **Data Types:** Financial records, personal information of executives, and proprietary business data.\n- **Exfiltration Channels:** Utilization of encrypted channels and cloud services to circumvent detection.\n\n## Recommendations\n- **Data Loss Prevention:** Implement solutions to monitor and block unauthorized data transfers.\n- **Forensic Analysis:** Conduct a comprehensive forensic analysis to understand the scale and impact of the data breach.\n\n## Next Steps\nInitiate containment procedures to prevent further data loss and begin remediation efforts to secure the network.', '2026-01-05 03:04:49'),
(188, 36, 475, 5, NULL, NULL, '2026-01-05 03:04:49'),
(189, 37, 476, 1, 'Analysis of Malicious Payload Execution via RoyalRoad Exploit', '### Overview\nFollowing the detection of a suspicious email containing a malicious RTF attachment, further investigation reveals the exploitation of the RoyalRoad vulnerability. The RoyalRoad exploit has been utilized to execute a malicious payload on the target system.\n\n### Technical Details\n- **Exploit Method**: The RTF attachment leverages a known vulnerability in Microsoft Office to execute arbitrary code.\n- **Payload**: The payload includes scripts that prepare the environment for further exploitation.\n\n### Implications\nThe successful execution of this payload indicates a sophisticated attack vector likely aiming to establish deeper system access.\n\n### Next Steps\n- Monitor for any signs of persistence mechanisms being established.\n- Conduct a detailed forensic analysis of the affected systems.', '2026-01-05 03:08:29'),
(190, 37, 477, 2, 'Persistence Mechanism via Aria-body Backdoor', '### Overview\nFollowing the execution of the RoyalRoad exploit, analysis identifies the installation of the Aria-body backdoor. This backdoor is designed to maintain persistent access to the compromised systems.\n\n### Technical Details\n- **Backdoor Functionality**: The Aria-body backdoor allows the attacker to maintain a foothold in the network and execute commands remotely.\n- **Persistence Method**: The backdoor is embedded within legitimate system processes, making detection challenging.\n\n### Implications\nEstablishing persistence is a critical step for the attacker to facilitate further actions, including lateral movement.\n\n### Recommendations\n- Implement enhanced monitoring for unusual network activities.\n- Initiate a comprehensive review of system logs to identify any signs of lateral movement.', '2026-01-05 03:08:29'),
(191, 37, 478, 3, 'Lateral Movement Analysis Across Internal Network', '### Overview\nInvestigation into the Aria-body backdoor has unveiled signs of lateral movement within the internal network. The attacker appears to be exploring the network to identify valuable targets.\n\n### Technical Details\n- **Movement Techniques**: The attacker utilizes legitimate credentials and tools to access other systems within the network.\n- **Targets Identified**: Several high-value systems have been accessed, indicating a targeted approach.\n\n### Implications\nThe lateral movement poses a significant risk as it suggests the attacker is positioning themselves for data exfiltration.\n\n### Countermeasures\n- Conduct a thorough audit of user accounts and permissions.\n- Isolate affected systems to prevent further unauthorized access.', '2026-01-05 03:08:29'),
(192, 37, 479, 4, 'Data Exfiltration to Command and Control Server', '### Overview\nSubsequent to the lateral movement activities, evidence of data exfiltration has been detected. Data is being transmitted to an external Command and Control (C2) server.\n\n### Technical Details\n- **Exfiltration Method**: The data is being exfiltrated over encrypted channels to evade detection.\n- **Type of Data**: Preliminary analysis suggests sensitive organizational data is being targeted.\n\n### Implications\nData exfiltration represents a critical breach of security and potential disclosure of sensitive information.\n\n### Immediate Actions\n- Block known C2 server IPs and domains.\n- Initiate an incident response protocol to contain and mitigate the breach.\n- Notify relevant stakeholders and begin a post-incident analysis to prevent future occurrences.', '2026-01-05 03:08:29'),
(193, 37, 480, 5, NULL, NULL, '2026-01-05 03:08:29'),
(194, 39, 481, 1, 'Unauthorized CMS Article Publication: Initial Access and Indicators', '### Overview\nUpon detecting a suspicious login, further analysis revealed unauthorized activity within the CMS. This activity is characterized by the creation and publication of articles containing misleading information.\n\n### Details\n- **Entry Point**: Exploitation of CMS vulnerabilities allowing remote access.\n- **Indicators of Compromise (IoCs)**: Abnormal login times, unfamiliar IP addresses, and modifications to content templates.\n\n### Recommendations\n- Immediate review and audit of CMS access logs.\n- Implementation of multi-factor authentication for CMS access.\n- Increase monitoring of content changes and publication activities.', '2026-01-05 03:22:52'),
(195, 39, 482, 2, 'Backdoor Account Creation: Ensuring Persistence', '### Overview\nFollowing the unauthorized publication of articles, further investigation uncovered the creation of backdoor accounts within the CMS to maintain persistent access.\n\n### Details\n- **Objective**: Establish long-term access to manipulate media content.\n- **Method**: Accounts created using compromised credentials or exploiting CMS administrative functions.\n\n### Indicators\n- New accounts with administrative privileges created without authorization.\n- Unusual account activity patterns.\n\n### Recommendations\n- Conduct a thorough review of all CMS accounts and privileges.\n- Enforce stricter user access controls and regular audits.', '2026-01-05 03:22:52'),
(196, 39, 483, 3, 'Social Media Amplification Detected: Expanding Influence', '### Overview\nWith the establishment of persistence via backdoor accounts, the operation has moved to social media platforms to amplify misinformation.\n\n### Details\n- **Tactics**: Use of bot networks and sockpuppet accounts to spread content.\n- **Platforms Targeted**: Prominent social media platforms where misinformation can quickly gain traction.\n\n### Indicators\n- Spike in social media activity related to the published misinformation.\n- Rapid increase in shares and likes from newly created or suspicious accounts.\n\n### Recommendations\n- Collaborate with social media platforms to identify and suspend malicious accounts.\n- Deploy AI-based tools to detect and mitigate bot-driven amplification.', '2026-01-05 03:22:52'),
(197, 39, 484, 4, 'Data Exfiltration Attempt Detected: Protecting Sensitive Information', '### Overview\nFollowing the amplification of misinformation, attempts have been made to exfiltrate sensitive data, potentially to leverage for further influence operations or blackmail.\n\n### Details\n- **Objective**: Extract sensitive data from compromised systems.\n- **Methods**: Use of encrypted channels and covert data transfer techniques.\n\n### Indicators\n- Unusual outbound data traffic patterns detected.\n- Use of unapproved encryption tools and protocols.\n\n### Recommendations\n- Immediate lockdown of affected systems to prevent further data loss.\n- Conduct a comprehensive forensic analysis to understand the scope of the breach.\n- Enhance data loss prevention mechanisms and user training on data security.', '2026-01-05 03:22:52'),
(198, 39, 485, 5, NULL, NULL, '2026-01-05 03:22:52'),
(199, 40, 486, 1, 'Compromised Supplier Network: Initial Access Analysis', '### Background\n\nFollowing the initial alert of a **Supply Chain Compromise**, intelligence indicates that APT41 has infiltrated a key supplier network within the gaming industry. This breach was achieved through the exploitation of a vulnerable third-party software component.\n\n### Implications\n\n- **Potential Threat**: The compromised supplier can act as a distribution point for malicious payloads like ShadowPad.\n- **Scope of Access**: Initial entry points can provide adversaries with broad access to the target\'s supply chain, making subsequent attacks more stealthy and impactful.\n\n### Recommendations\n\n- **Immediate Action**: Initiate a full review of all supplier network access points and enhance monitoring for abnormal activity.\n- **Preventive Measures**: Strengthen supplier security standards and conduct regular security audits.', '2026-01-05 03:26:48'),
(200, 40, 487, 2, 'Code Injection Detection in Build Environment', '### Overview\n\nFollowing the **Code Injection** alert, it has been detected that APT41 executed malicious code within the build environment of a key gaming application.\n\n### Details of the Attack\n\n- **Vector**: The adversary leveraged the compromised supplier credentials to inject malicious scripts into the build server.\n- **Target**: This code aims to facilitate the deployment of ShadowPad, enabling further infiltration.\n\n### Impact\n\n- **Integrity Risk**: Code integrity is compromised, potentially affecting all downstream applications.\n- **Propagation**: The injected code can propagate malicious payloads to end-user devices.\n\n### Mitigation Steps\n\n- **Immediate Scrutiny**: Conduct a thorough audit of the build environment for unauthorized changes.\n- **Verification**: Validate integrity of application updates before deployment.', '2026-01-05 03:26:48'),
(201, 40, 488, 3, 'ShadowPad Backdoor Installation and Persistence', '### Situation Update\n\nPost the execution phase, APT41 has successfully established persistence through the installation of the **ShadowPad backdoor**.\n\n### Mechanism of Persistence\n\n- **Backdoor Features**: ShadowPad is known for its modular architecture, allowing dynamic loading of plugins for various malicious functions.\n- **Stealth Techniques**: Utilizes encrypted communication and masquerades as legitimate software processes.\n\n### Strategic Implications\n\n- **Long-Term Access**: Persistent access enables ongoing espionage and potential sabotage.\n- **Network Vulnerability**: Ongoing risk of lateral movement within the network.\n\n### Defensive Measures\n\n- **Enhanced Monitoring**: Deploy behavioral analytics to detect abnormal patterns indicative of backdoor activity.\n- **System Hardening**: Apply security patches and restrict administrative privileges.', '2026-01-05 03:26:48'),
(202, 40, 489, 4, 'Credential Dumping and Lateral Movement', '### Current Threat Landscape\n\nAs the operation progresses, APT41 has initiated **Lateral Movement** across the player networks by exploiting dumped credentials.\n\n### Attack Dynamics\n\n- **Credential Access**: Utilizing stolen credentials, adversaries gain access to additional systems within the network.\n- **Movement Strategy**: Focused on reaching high-value targets and exfiltrating sensitive data.\n\n### Consequences\n\n- **Increased Exposure**: Compromised credentials lead to expanded access and control over network resources.\n- **Data Breach Risk**: Heightened risk of sensitive player data being accessed and exfiltrated.\n\n### Countermeasures\n\n- **Credential Hygiene**: Enforce password complexity and regular changes.\n- **Access Controls**: Implement multi-factor authentication and continuous monitoring of user activities.', '2026-01-05 03:26:48'),
(203, 40, 490, 5, NULL, NULL, '2026-01-05 03:26:48'),
(204, 41, 491, 1, 'Follow-up on Suspicious Email Attachment', '## Overview\nUpon detection of a suspicious email attachment, further analysis revealed that the email originated from a compromised server known to be associated with the Lazarus Group. This server previously engaged in spear-phishing campaigns targeting defense contractors.\n\n## Key Findings\n- **Sender Information**: The email appeared to be sent from a legitimate contact within the organization, suggesting email spoofing techniques were employed.\n- **Attachment Details**: The attachment was a macro-enabled Excel document designed to execute a malicious payload upon opening.\n\n## Recommendations\n- **Immediate Action**: Instruct recipients to delete the email without opening the attachment.\n- **Preventive Measures**: Enhance email gateway security to filter out similar threats.', '2026-01-05 04:01:18'),
(205, 41, 492, 2, 'DTrack Payload Execution Analysis', '## Overview\nThe execution of the DTrack malware payload marks a significant escalation in the attack, indicating a shift from reconnaissance to active exploitation.\n\n## Key Findings\n- **Payload Behavior**: DTrack is known for its ability to perform file operations, execute commands, and communicate with command and control (C2) servers.\n- **C2 Communication**: Encrypted traffic was detected heading to known Lazarus Group-controlled IP addresses.\n\n## Recommendations\n- **Immediate Action**: Quarantine affected systems to prevent further spread.\n- **Forensic Analysis**: Conduct a detailed forensic analysis of infected machines to understand the extent of compromise.', '2026-01-05 04:01:18'),
(206, 41, 493, 3, 'Persistence Mechanism - DLL Hijacking', '## Overview\nThe attackers are leveraging DLL hijacking to maintain persistence on compromised systems, a technique commonly used by the Lazarus Group to ensure their presence remains undetected.\n\n## Key Findings\n- **DLL Injection**: Malicious DLLs are injected into commonly used applications, allowing them to execute under the guise of legitimate processes.\n- **Registry Modifications**: Changes in registry keys have been detected, redirecting legitimate application paths to malicious DLLs.\n\n## Recommendations\n- **Immediate Action**: Review and restore altered registry keys to their original state.\n- **Monitoring**: Implement enhanced monitoring of DLL loads across critical systems.', '2026-01-05 04:01:18'),
(207, 41, 494, 4, 'Lateral Movement via Pass-the-Hash', '## Overview\nThe attack has progressed to lateral movement within the network using Pass-the-Hash techniques, indicating a high level of sophistication and access.\n\n## Key Findings\n- **Credential Abuse**: Compromised credentials were used to authenticate across multiple systems without the need for password cracking.\n- **Targeted Systems**: High-value targets such as servers containing sensitive defense schematics have been identified as primary targets.\n\n## Recommendations\n- **Immediate Action**: Invalidate all compromised credentials and enforce password resets.\n- **Network Segmentation**: Implement network segmentation to limit lateral movement capabilities.', '2026-01-05 04:01:18'),
(208, 41, 495, 5, NULL, NULL, '2026-01-05 04:01:18'),
(209, 42, 496, 1, 'Analysis of Initial Access via Suspicious Domain', '### Context\nFollowing the detection of suspicious domain access, further investigation reveals that the domains in question are linked to a known CopyKittens infrastructure. These domains have been associated with phishing campaigns targeting government entities.\n\n### Findings\n- **Domain Characteristics**: The domains exhibit patterns typical of CopyKittens, such as misspelled names of legitimate organizations.\n- **Vector Analysis**: Initial access is likely achieved through spear-phishing emails containing malicious links or attachments.\n\n### Recommendations\n- Implement enhanced email filtering rules to detect and block phishing attempts.\n- Conduct employee training on recognizing phishing emails.', '2026-01-05 04:03:11'),
(210, 42, 497, 2, 'Matryoshka RAT Execution and Behavioral Indicators', '### Context\nAfter the execution of the Matryoshka RAT, telemetry data indicates the deployment of the RAT on compromised systems.\n\n### Findings\n- **Execution Patterns**: The RAT is executed using script-based loaders, often leveraging PowerShell or JavaScript.\n- **Persistence Mechanisms**: Scheduled tasks and registry modifications have been identified as methods to ensure persistence.\n\n### Recommendations\n- Conduct system-wide scans for registry anomalies and unauthorized scheduled tasks.\n- Implement application whitelisting to prevent the execution of unauthorized scripts.', '2026-01-05 04:03:13'),
(211, 42, 498, 3, 'DNS Tunneling Activity and Persistence Tactics', '### Context\nThe identification of DNS tunneling activity signifies an attempt by the attackers to maintain a covert communication channel with the compromised systems.\n\n### Findings\n- **Tunneling Details**: Encoded DNS queries and responses are used to bypass traditional network monitoring.\n- **Infrastructure**: Analysis shows multiple subdomains dynamically resolving to various IP addresses, indicating a sophisticated command and control (C2) setup.\n\n### Recommendations\n- Deploy DNS monitoring solutions to identify and block tunneling activities.\n- Implement strict outbound DNS policies to prevent unauthorized queries.', '2026-01-05 04:03:13'),
(212, 42, 499, 4, 'Lateral Movement Indicators and Network Traffic Analysis', '### Context\nUnusual network traffic patterns suggest lateral movement within the network as attackers attempt to access sensitive systems.\n\n### Findings\n- **Traffic Anomalies**: High-volume data transfers and unusual port activity have been observed.\n- **Compromised Credentials**: Evidence suggests the use of harvested credentials to access additional systems.\n\n### Recommendations\n- Enhance network segmentation to limit lateral movement potential.\n- Conduct a thorough audit of user accounts and implement multi-factor authentication (MFA).', '2026-01-05 04:03:13'),
(213, 42, 500, 5, NULL, NULL, '2026-01-05 04:03:13'),
(214, 43, 501, 1, 'Profile Analysis of Unverified Facebook Account', '### Overview\nThe suspicious Facebook profile involved in the initial alert appears to have been created recently, lacking personal details and typical user activity. This is indicative of a potential fake persona used for social engineering.\n\n### Details\n- **Profile Name:** John Doe\n- **Creation Date:** 2 weeks ago\n- **Mutual Connections:** 0\n- **Activity:** Minimal posts, all generic\n\n### Analysis\nThis profile likely serves as a vector for social engineering, aimed at establishing trust with targets within aerospace firms. Recommend monitoring for further interactions and cross-referencing with other suspicious profiles.', '2026-01-06 01:24:23'),
(215, 43, 502, 2, 'Phishing Attempt via Direct Message', '### Overview\nA phishing attempt was identified following the interaction with the suspicious Facebook profile. An employee received a direct message containing a malicious link, masquerading as an industry-related article.\n\n### Details\n- **Sender:** Unverified Facebook Profile\n- **Message Content:** \'Check out this article on latest aerospace innovations\' with a shortened link.\n- **Intended Target:** Senior Engineer in R&D\n\n### Recommendations\n- **Immediate Action:** Block sender and delete message.\n- **Awareness Training:** Reinforce phishing awareness among staff, emphasizing caution with unsolicited messages.', '2026-01-06 01:24:23'),
(216, 43, 503, 3, 'Detection of \'Gholee\' Malware Execution', '### Overview\nThe execution of the \'Gholee\' malware was detected on a compromised system within the aerospace firm\'s network. The malware was likely deployed following the successful phishing attempt.\n\n### Details\n- **Affected System:** Workstation of Senior Engineer\n- **Malware Characteristics:** Known for data harvesting and creating backdoors\n- **Detection Method:** Anomaly detection via endpoint security solution\n\n### Recommendations\n- **Containment:** Isolate affected systems immediately.\n- **Forensic Analysis:** Conduct a detailed analysis to understand entry points and potential data affected.', '2026-01-06 01:24:23'),
(217, 43, 504, 4, 'Persistence Mechanisms Established by \'Gholee\'', '### Overview\nFurther analysis revealed that \'Gholee\' malware has established persistence mechanisms, ensuring its survival through system reboots and security updates.\n\n### Details\n- **Persistence Techniques:** \n  - Registry key modifications\n  - Scheduled tasks creation\n  - DLL injection into legitimate processes\n\n### Countermeasures\n- **Immediate Actions:** Remove persistence mechanisms by restoring registry keys and disabling scheduled tasks.\n- **Monitoring:** Enhance system logging to detect future persistence attempts.', '2026-01-06 01:24:23'),
(218, 43, 505, 5, 'Lateral Movement Across Network', '### Overview\nFollowing the establishment of persistence, lateral movement was detected across the network, likely aimed at accessing sensitive data and escalating privileges.\n\n### Details\n- **Techniques Used:**\n  - Pass-the-Hash\n  - Remote Desktop Protocol exploitation\n- **Affected Systems:** Multiple workstations and servers in the R&D department\n\n### Recommendations\n- **Network Segmentation:** Implement stricter segmentation to limit lateral movement.\n- **Credential Management:** Enforce strong, unique passwords and regular changes.\n- **Incident Response:** Conduct a full network sweep to identify and neutralize further threats.', '2026-01-06 01:24:23'),
(219, 43, 506, 6, NULL, NULL, '2026-01-06 01:24:23'),
(220, 44, 507, 1, 'Analysis of Malicious Code Execution', '## Context\nAfter the initial breach detected via EternalBlue, the adversary has executed malicious code on the compromised system. This report delves into the observed remote code execution (RCE) activities.\n\n## Findings\n- **Payload Analyzed**: The executed payload is identified as a variant of the WannaCry ransomware, designed to encrypt files on the infected machines.\n- **Execution Method**: The payload is executed using the exploitation of the SMBv1 vulnerability, allowing for unauthenticated remote code execution.\n- **Immediate Actions**: Mitigation strategies should include disabling SMBv1 and ensuring robust network segmentation to limit the damage of any further RCE attempts.', '2026-01-06 01:34:24'),
(221, 44, 508, 2, 'Persistence Mechanisms in Place', '## Overview\nFollowing the execution of malicious code, the ransomware has established persistence to survive system reboots and maintain control over the infected systems.\n\n## Details\n- **Techniques Used**: The ransomware modifies registry keys and schedules tasks to trigger on startup, ensuring its presence on the system.\n- **Potential Countermeasures**: Immediate actions include reviewing and cleaning registry keys and scheduled tasks, and implementing endpoint detection and response (EDR) solutions to monitor for persistence attempts.', '2026-01-06 01:34:24'),
(222, 44, 509, 3, 'SMB Propagation Analysis', '## Introduction\nThe ransomware is now actively propagating through the network using SMB protocol vulnerabilities. This report outlines the observed lateral movement patterns.\n\n## Observations\n- **Propagation Method**: Utilizes the EternalBlue exploit to spread to other vulnerable machines within the network.\n- **Network Mapping**: The ransomware scans the network for other vulnerable hosts, exponentially increasing its reach.\n- **Recommendations**: Immediate patching of all systems against SMBv1 vulnerabilities and isolation of affected subnets are critical to contain the spread.', '2026-01-06 01:34:24'),
(223, 44, 510, 4, 'Kill-Switch Domain Investigation', '## Summary\nA potential kill-switch domain has been identified, which could deactivate the ransomware if successfully queried.\n\n## Investigation\n- **Domain Analysis**: The domain has been hardcoded into the malware as a potential stop mechanism.\n- **Actionable Steps**: Conduct DNS sinkholing experiments to assess the feasibility of activating the kill-switch. Consider collaborating with global ISPs for widespread DNS monitoring.', '2026-01-06 01:34:24'),
(224, 44, 511, 5, 'Encryption Logic Breakdown', '## Overview\nThe ransomware has begun encrypting files on compromised systems. This report provides an analysis of its encryption logic.\n\n## Technical Details\n- **Encryption Algorithm**: Utilizes a combination of RSA and AES to encrypt files, ensuring robustness and difficulty in decryption without the private key.\n- **File Types Targeted**: Focuses on commonly used document and multimedia file formats.\n- **Countermeasures**: Regular backups and data recovery plans are essential. Evaluate the feasibility of deploying decryption tools if available.', '2026-01-06 01:34:24'),
(225, 44, 512, 6, 'Data Exfiltration Attempt Analysis', '## Context\nAs the ransomware encrypts data, it is also attempting to exfiltrate sensitive information from the compromised systems.\n\n## Key Insights\n- **Exfiltration Channels**: Observed usage of non-standard ports and encrypted protocols for data exfiltration attempts.\n- **Data Types at Risk**: Includes personally identifiable information (PII) and corporate intellectual property.\n- **Defense Strategies**: Immediate network traffic analysis and blocking suspicious outbound connections can mitigate data loss. Implement data loss prevention (DLP) solutions to monitor sensitive data movement.', '2026-01-06 01:34:24'),
(226, 44, 513, 7, 'Ransom Note Deployment and Impact', '## Summary\nThe deployment of ransom notes signifies the completion of the ransomware\'s encryption cycle and the demand for payment.\n\n## Insights\n- **Demand Details**: The ransom note typically demands payment in cryptocurrency, providing instructions for victims.\n- **Psychological Impact**: The presence of the ransom note induces urgency and panic, often leading to hasty decision-making.\n- **Recommendations**: Encourage organizations to have a clear incident response plan and avoid paying the ransom. Leverage law enforcement and cybersecurity partnerships for support.', '2026-01-06 01:34:24'),
(227, 44, 514, 8, NULL, NULL, '2026-01-06 01:34:24'),
(228, 45, 515, 1, 'In-Depth Analysis of Supply Chain Compromise', '### Overview\nThe initial alert indicates a compromised software update, typical of a supply chain attack. This technique is often employed to distribute malicious payloads widely and stealthily.\n\n### Key Findings\n- **Vendor Involvement**: The compromised update originated from a trusted vendor, indicating possible unauthorized access to their infrastructure.\n- **Distribution Scope**: Initial analysis suggests a widespread distribution affecting multiple sectors.\n\n### Recommendations\n- **Immediate Patch Review**: Verify the integrity of all recent updates and patches from associated vendors.\n- **Network Segmentation**: Implement network segmentation to contain any potential spread of malicious activity.\n\n### Next Steps\nWe anticipate potential destructive activities following the introduction of malicious components. Monitor for unusual disk activity, which may indicate MBR overwriting.', '2026-01-06 01:37:06'),
(229, 45, 516, 2, 'MBR Overwriting Detected: Sandworm\'s Signature', '### Overview\nFollowing the compromised software update, we have observed Master Boot Record (MBR) overwriting activity. This is a destructive action characteristic of Sandworm\'s tactics.\n\n### Key Indicators\n- **MBR Modification**: Unauthorized changes to the MBR have been logged, leading to potential system boot failures.\n- **System Recovery**: Attempts to recover the MBR have been partially successful, but full restoration is uncertain.\n\n### Recommendations\n- **Immediate System Backups**: Ensure that all critical data is backed up and secure.\n- **Forensic Analysis**: Engage forensic teams to analyze the altered MBR and identify further threats.\n\n### Next Steps\nGiven past Sandworm operations, expect potential credential harvesting as the next phase of the attack. Monitor for suspicious credential access activities.', '2026-01-06 01:37:06'),
(230, 45, 517, 3, 'Credential Harvesting via Mimikatz: A Deeper Threat', '### Overview\nCredential harvesting has been detected utilizing Mimikatz, a known tool for extracting account credentials from compromised systems.\n\n### Key Indicators\n- **Unauthorized Access Attempts**: Multiple failed and successful login attempts from unusual locations.\n- **Privileged Account Targeting**: Specific focus on accounts with elevated privileges.\n\n### Recommendations\n- **Account Lockdowns**: Immediately lockdown and reset passwords for compromised accounts.\n- **Multi-Factor Authentication**: Implement MFA to secure access to critical systems.\n\n### Next Steps\nPrepare for potential lateral movement within the network as the attacker leverages harvested credentials to propagate. Enhance monitoring for unusual internal network activity.', '2026-01-06 01:37:06'),
(231, 45, 518, 4, 'Lateral Movement and Data Exfiltration: Identifying the Attack Progression', '### Overview\nRapid lateral movement within the network has been identified, coupled with attempts to exfiltrate data.\n\n### Key Indicators\n- **Unusual Traffic Patterns**: High volumes of data transfers to external IPs not previously associated with the organization.\n- **Network Scanning**: Evidence of network scanning activities to identify further targets.\n\n### Recommendations\n- **Network Isolation**: Isolate affected segments to prevent further spread.\n- **Data Loss Prevention**: Strengthen DLP solutions to monitor and block unauthorized data transfers.\n\n### Conclusion\nThe operation has reached a critical stage with the potential for significant data loss. Immediate containment and remediation efforts are essential to minimize impact.', '2026-01-06 01:37:06'),
(232, 45, 519, 5, NULL, NULL, '2026-01-06 01:37:06'),
(233, 46, 520, 1, 'Investigation into Suspicious Network Traffic', '### Summary\nFollowing the detection of suspicious network traffic linked to a potential drive-by download, our team has initiated a comprehensive analysis to identify the source and nature of the traffic.\n\n### Findings\n- **Traffic Source**: The suspicious traffic originated from IP addresses associated with compromised websites known to distribute fake Adobe Flash updates.\n- **Payload Analysis**: Initial investigations suggest the payload is part of a phishing campaign aimed at delivering ransomware.\n\n### Next Steps\nContinue monitoring for further network anomalies and prepare for potential execution of malicious software as indicated by the observed traffic patterns.', '2026-01-06 01:39:37'),
(234, 46, 521, 2, 'Analysis of Unverified Flash Update Execution', '### Summary\nAn unverified Adobe Flash update has been executed on several endpoints. This execution is suspected to be part of the Callisto Group\'s ransomware campaign.\n\n### Findings\n- **Execution Method**: The update bypassed standard security checks, indicating sophisticated evasion techniques.\n- **Code Review**: Preliminary code analysis shows similarities with known ransomware families, suggesting the dropper is used to deploy DiskCryptor.\n\n### Next Steps\nConduct a detailed reverse engineering of the executed file to confirm its capabilities and potential payloads. Prepare defenses against ransomware activation.', '2026-01-06 01:39:37'),
(235, 46, 522, 3, 'DiskCryptor Ransomware Persistence Strategy', '### Summary\nDiskCryptor ransomware has been detected, indicating the persistence phase of the attack.\n\n### Findings\n- **Ransomware Behavior**: The ransomware has encrypted local drives and is configured to activate upon system reboot.\n- **Persistence Mechanism**: Utilizes bootloader modification to ensure ransomware executes at system startup.\n\n### Next Steps\nIsolate infected systems to prevent further spread. Begin decryption efforts and analyze the persistence mechanisms to develop countermeasures.', '2026-01-06 01:39:37'),
(236, 46, 523, 4, 'Investigation into Unauthorized SMB Traffic', '### Summary\nUnauthorized SMB traffic has been observed, suggesting lateral movement within the network.\n\n### Findings\n- **Propagation Method**: Ransomware is leveraging SMB protocol to spread across network shares.\n- **Targeted Systems**: Systems with outdated SMB configurations are particularly vulnerable.\n\n### Next Steps\nImplement network segmentation to contain the spread. Initiate internal audits to identify and patch vulnerable systems. Prepare for potential data exfiltration attempts.', '2026-01-06 01:39:37'),
(237, 46, 524, 5, NULL, NULL, '2026-01-06 01:39:37'),
(238, 47, 525, 1, 'Unauthorized Network Access: Initial Analysis', '### Overview\nThe initial breach was detected at 03:45 UTC, involving unauthorized access to the network managing the Olympic ceremony systems. Our analysis indicates the use of stolen credentials to bypass security protocols.\n\n### Details\n- **Entry Point**: Compromised VPN credentials likely obtained through phishing.\n- **Affected Systems**: Early identification shows infiltration in user authentication servers.\n\n### Next Steps\nInvestigation will focus on identifying the origin of the breach and monitoring for any further unauthorized activities. Anticipate potential execution of malicious scripts as attackers establish foothold.', '2026-01-06 01:44:46');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(239, 47, 526, 2, 'Malicious Script Execution: Compromise Analysis', '### Overview\nFollowing the initial breach, malicious scripts were executed on ceremony systems, indicating an escalation in the attack. These scripts aim to disrupt key functionalities during the event.\n\n### Details\n- **Execution Method**: Scripts were deployed via PowerShell to modify system configurations.\n- **Impact**: Disruption in media streaming services and live event broadcasting.\n\n### Insights\nThe attackers are utilizing tools consistent with known Sandworm TTPs, suggesting a sophisticated operation. Next, we will analyze for signs of persistence mechanisms being established.', '2026-01-06 01:44:46'),
(240, 47, 527, 3, 'Persistence Mechanisms: Backdoor Installation', '### Overview\nThe attackers have installed multiple backdoors to ensure continued access and control over the compromised systems.\n\n### Details\n- **Backdoor Types**: Custom RATs detected, allowing remote command execution.\n- **Installation Method**: Leveraged administrative privileges obtained from initial breach.\n\n### Next Steps\nWith persistence achieved, the threat actors are expected to attempt lateral movement to spread through critical infrastructure. Monitoring lateral traffic and securing adjacent systems is crucial.', '2026-01-06 01:44:46'),
(241, 47, 528, 4, 'Lateral Movement: Internal Threat Expansion', '### Overview\nThe attackers are actively moving laterally within the network, targeting critical systems essential for ceremony operations.\n\n### Details\n- **Techniques Used**: SMB protocol exploitation and credential dumping observed.\n- **Targets**: Focus on database servers and event coordination systems.\n\n### Insights\nTheir movement patterns suggest a high level of network knowledge, potentially indicating insider collaboration. The next phase may involve data exfiltration, aiming at sensitive information related to event operations and personnel.', '2026-01-06 01:44:46'),
(242, 47, 529, 5, NULL, NULL, '2026-01-06 01:44:46'),
(243, 48, 530, 1, NULL, NULL, '2026-01-06 02:36:36'),
(244, 48, 531, 2, 'Malicious Payload Deployment Analysis', '## Malicious Payload Deployment Analysis\n\n**Overview:**\nFollowing the initial access via the ASUS Update Utility compromise, threat actors have successfully deployed a malicious payload across affected systems. This payload is designed to execute upon installation of the compromised update.\n\n**Key Findings:**\n- The payload targets systems immediately after the ASUS Live Update installation.\n- Analysis indicates the payload includes a dropper that installs additional malware components.\n- The dropper executes with administrative privileges, allowing it to bypass user account controls.\n\n**Recommendations:**\n- Conduct a thorough scan of all systems for known indicators of compromise.\n- Employ behavioral analysis to detect unusual process execution linked to the update utility.\n\n**Next Steps:**\nFocus on understanding the persistence mechanisms established post-payload execution to maintain threat actor presence.', '2026-01-06 02:36:36'),
(245, 48, 532, 3, 'Backdoor Access and Persistence', '## Backdoor Access and Persistence\n\n**Overview:**\nPost-execution, the threat actors have established backdoor access, ensuring persistent presence on compromised systems. This allows them to maintain control and facilitate further exploitation.\n\n**Key Findings:**\n- A new service is created to run at startup, linked to the malicious payload.\n- Registry modifications detected to ensure backdoor persistence.\n- Backdoor communications are encrypted, complicating detection efforts.\n\n**Recommendations:**\n- Monitor for creation of unauthorized services and registry changes.\n- Implement endpoint detection and response (EDR) solutions to track anomalous behaviors.\n\n**Next Steps:**\nInvestigate potential lateral movement patterns and credentials that may have been compromised.', '2026-01-06 02:36:36'),
(246, 48, 533, 4, 'Lateral Movement and Credential Dumping', '## Lateral Movement and Credential Dumping\n\n**Overview:**\nWith established persistence, the threat actors are moving laterally within the network, harvesting credentials to gain access to additional systems.\n\n**Key Findings:**\n- Use of legitimate tools like Mimikatz to dump credentials from memory.\n- Compromised accounts exhibit unusual login patterns and access attempts.\n- Network traffic analysis reveals attempts to authenticate across multiple systems.\n\n**Recommendations:**\n- Reset credentials for impacted accounts and enforce multi-factor authentication.\n- Deploy network segmentation to limit the spread of lateral movement.\n\n**Next Steps:**\nFocus on identifying and mitigating data exfiltration attempts as attackers access sensitive information.', '2026-01-06 02:36:36'),
(247, 48, 534, 5, 'Data Harvesting and Exfiltration', '## Data Harvesting and Exfiltration\n\n**Overview:**\nThreat actors are actively harvesting sensitive data from compromised systems, preparing for exfiltration to external servers.\n\n**Key Findings:**\n- Large volumes of data being compressed and staged for transfer.\n- Use of encrypted channels to conceal data movement from detection.\n- Targeted data includes intellectual property and user credentials.\n\n**Recommendations:**\n- Monitor outbound traffic for anomalies and block unauthorized data transfers.\n- Implement data loss prevention (DLP) solutions to identify and protect sensitive data.\n\n**Next Steps:**\nDetermine the specific targets based on MAC addresses to understand threat actor intentions.', '2026-01-06 02:36:36'),
(248, 48, 535, 6, 'Targeted MAC Address Identification', '## Targeted MAC Address Identification\n\n**Overview:**\nInvestigation reveals that threat actors are targeting systems with specific MAC addresses, indicating a highly selective attack strategy.\n\n**Key Findings:**\n- Analysis of compromised systems shows a pattern of MAC address targeting.\n- Threat actors appear to prioritize high-value targets within the network.\n- This targeted approach minimizes detection and maximizes impact on selected assets.\n\n**Recommendations:**\n- Identify and isolate systems with targeted MAC addresses to prevent further compromise.\n- Conduct a detailed audit of affected systems to understand the scope of the breach.\n\n**Next Steps:**\nExamine ongoing command and control communications to gain insight into threat actor objectives.', '2026-01-06 02:36:36'),
(249, 48, 536, 7, 'Command and Control Communication Analysis', '## Command and Control Communication Analysis\n\n**Overview:**\nThreat actors maintain command and control communications to coordinate their activities across compromised systems.\n\n**Key Findings:**\n- Use of custom C2 protocols to evade detection by standard network defenses.\n- Communication patterns indicate periodic updates and tasking from external servers.\n- C2 infrastructure is resilient, leveraging multiple domains and IPs for redundancy.\n\n**Recommendations:**\n- Block known C2 domains and IP addresses identified during the investigation.\n- Employ network intrusion detection systems (NIDS) to monitor for C2 communication patterns.\n\n**Next Steps:**\nInvestigate any anti-forensic techniques employed by threat actors to cover their tracks and hinder analysis.', '2026-01-06 02:36:36'),
(250, 48, 537, 8, 'Cleanup and Anti-Forensic Techniques', '## Cleanup and Anti-Forensic Techniques\n\n**Overview:**\nAfter completing their objectives, threat actors are employing anti-forensic techniques to erase evidence and hinder investigation efforts.\n\n**Key Findings:**\n- Use of secure delete utilities to remove traces of malware and logs.\n- Manipulation of timestamps and metadata to obscure activity timelines.\n- Disabling of logging and monitoring tools on compromised systems.\n\n**Recommendations:**\n- Recover deleted files using advanced forensic tools to piece together the attack timeline.\n- Strengthen logging and monitoring capabilities to detect future anti-forensic activities.\n\n**Conclusion:**\nConduct a post-incident review to enhance defenses and reduce the likelihood of similar attacks in the future.', '2026-01-06 02:36:36'),
(251, 49, 538, 1, 'Analysis of Suspicious Cloud Service Access Patterns', '### Overview\nFollowing the detection of suspicious cloud service access, further analysis has identified anomalous login patterns from IP addresses linked to known Inception APT activities.\n\n### Findings\n- **Unusual Login Times:** Access attempts were recorded during non-business hours, consistent with tactics used by Inception APT to remain undetected.\n- **Geolocation:** The IP addresses originate from regions with a known Inception APT presence, notably within Eastern European countries.\n- **Access Attempts:** Credentials appear to have been compromised, as multiple failed login attempts were observed before successful access.\n\n### Recommendations\n- **Immediate Response:** Enforce multi-factor authentication for all cloud service accounts.\n- **Monitoring:** Increase monitoring of access logs for unusual patterns, particularly IP addresses from suspicious regions.\n- **User Awareness Training:** Conduct a security awareness program focusing on phishing and credential security.', '2026-01-07 22:29:04'),
(252, 49, 539, 2, 'Detection and Mitigation of Cloud Atlas Malware Execution', '### Overview\nThe execution of the Cloud Atlas malware was confirmed, marking a critical phase in the attack lifecycle. The malware has been detected in the network environment of Eastern European diplomatic entities.\n\n### Technical Details\n- **Malware Characteristics:** The Cloud Atlas malware uses DLL side-loading techniques to evade detection by traditional antivirus solutions.\n- **Execution Path:** The malware was executed via a trojanized document file, likely delivered through spear-phishing emails targeting diplomatic personnel.\n- **Command and Control (C2):** Evidence of C2 communication attempts to external IP addresses associated with Inception APT infrastructure was identified.\n\n### Recommended Actions\n- **Containment:** Isolate affected systems immediately and conduct a thorough forensic analysis to determine the extent of the compromise.\n- **Malware Removal:** Deploy endpoint detection and response (EDR) tools specifically configured to detect and remove Cloud Atlas malware.\n- **Network Hardening:** Implement strict egress filtering to block unauthorized C2 communications and review firewall rules to prevent similar incidents.', '2026-01-07 22:29:04'),
(253, 49, 540, 3, NULL, NULL, '2026-01-07 22:29:04'),
(254, 50, 541, 1, 'Analysis of Initial Access: Unauthorized Entry', '### Unauthorized Access Detected\nAfter detecting initial unauthorized access to the systems, analysis reveals that attackers exploited a known vulnerability in the VPN software used by the target organization. This vulnerability allowed the attackers to bypass authentication mechanisms and gain entry into the network.\n\n#### Key Findings:\n- **Exploitation Method**: Use of a zero-day vulnerability in the VPN software.\n- **Tools Used**: Custom scripts to automate the exploitation process.\n- **Entry Point**: Compromised credentials were used in conjunction with the exploit.\n\n#### Next Steps:\nPrepare to monitor for any execution of malicious payloads as attackers establish foothold.', '2026-01-07 22:29:58'),
(255, 50, 542, 2, 'Decoding the Execution Phase: Malicious Payload Activation', '### Execution of Malicious Payload\nUpon unauthorized access, attackers proceeded to deploy a malicious payload designed to serve as an initial beacon back to their command and control (C2) servers.\n\n#### Key Findings:\n- **Payload Type**: Custom malware designed to evade detection by common antivirus solutions.\n- **Execution Method**: Utilizes PowerShell scripts embedded within legitimate software updates.\n- **Objective**: Ensure continued access and prepare for installation of a more permanent backdoor.\n\n#### Next Steps:\nFocus on identifying any backdoor mechanisms being established for persistence in the system.', '2026-01-07 22:29:58'),
(256, 50, 543, 3, 'Establishing Persistence: Backdoor Deployment', '### Establishing Backdoor for Persistence\nThe attackers have successfully deployed a backdoor within the target\'s network, ensuring their ability to maintain access over an extended period.\n\n#### Key Findings:\n- **Backdoor Type**: Custom-developed Trojan with rootkit capabilities.\n- **Persistence Mechanism**: Installation of services that auto-start with the system.\n- **Command and Control**: Encrypted communications with C2 servers to avoid detection.\n\n#### Next Steps:\nPrepare for potential lateral movement as attackers explore the network to identify valuable targets.', '2026-01-07 22:29:58'),
(257, 50, 544, 4, 'Stealthy Lateral Movement: Network Exploration', '### Stealthy Lateral Movement\nThe attackers have begun moving laterally within the network, utilizing compromised credentials obtained in earlier stages.\n\n#### Key Findings:\n- **Movement Techniques**: Use of compromised RDP sessions and pass-the-hash attacks.\n- **Target Exploration**: Scanning for sensitive data repositories and high-value systems.\n- **Evasion Tactics**: Use of legitimate administrative tools to mask activities.\n\n#### Next Steps:\nAnticipate and monitor for potential data exfiltration attempts as attackers aim to extract sensitive information.', '2026-01-07 22:29:58'),
(258, 50, 545, 5, NULL, NULL, '2026-01-07 22:29:58'),
(259, 51, 546, 1, 'Unauthorized Code Execution Detected: Analysis and Implications', '## Overview\nUpon receiving the alert for a suspicious email attachment, further investigation revealed unauthorized code execution on the target system. This suggests that the initial access was leveraged to deploy a malicious payload, likely part of the Equation Group\'s toolkit.\n\n## Technical Details\n- **Payload Analysis**: The attachment contained a heavily obfuscated script, which upon execution, triggered a series of PowerShell commands.\n- **MD5 Collisions**: The payload\'s hash matches known Equation Group signatures, indicating potential use of MD5 collision techniques to disguise malicious binaries.\n\n## Implications\nThe execution of this code marks the transition from initial access to active compromise, setting the stage for persistent foothold establishment.', '2026-01-07 22:33:18'),
(260, 51, 547, 2, 'Malware Persistence Mechanism Activated: Deep Dive', '## Overview\nFollowing the unauthorized code execution, a persistence mechanism was activated, ensuring the malware\'s continuity post-reboot.\n\n## Technical Details\n- **Registry Keys**: Modification of registry keys was detected, a common technique used by Equation Group to maintain persistence.\n- **Advanced Techniques**: The malware employs advanced tactics such as DLL injection and the creation of scheduled tasks.\n\n## Insights\nThis persistence ensures that even if the system is restarted or the initial payload is removed, the malware remains operational, allowing for continued espionage activities and data collection.', '2026-01-07 22:33:18'),
(261, 51, 548, 3, 'Lateral Movement: Anomalous Network Activity Analysis', '## Overview\nPost-persistence, anomalous network activity was detected, indicating lateral movement within the network, a hallmark of sophisticated cyber espionage operations.\n\n## Technical Details\n- **Credential Dumping**: Tools associated with the Equation Group were used to harvest credentials, facilitating movement between systems.\n- **Network Traffic Analysis**: Unusual patterns were observed, including SMB connections and RPC calls to multiple endpoints.\n\n## Implications\nThis lateral movement allows the attacker to expand their reach within the network, accessing additional resources and potentially compromising further systems.', '2026-01-07 22:33:18'),
(262, 51, 549, 4, 'Sensitive Data Exfiltration: Monitoring and Mitigation', '## Overview\nThe final stage observed was the exfiltration of sensitive data, a critical concern in espionage operations attributed to the Equation Group.\n\n## Technical Details\n- **Data Transfer Methods**: The exfiltration was conducted using encrypted channels, masking the data flow from standard monitoring tools.\n- **Targets Identified**: Files related to strategic communications and proprietary technologies were specifically targeted.\n\n## Recommendations\n- **Immediate Response**: Implement network segmentation and enhanced monitoring to mitigate further exfiltration.\n- **Long-term Strategy**: Develop and deploy advanced anomaly detection systems to identify potential threats earlier in the attack chain.', '2026-01-07 22:33:18'),
(263, 51, 550, 5, NULL, NULL, '2026-01-07 22:33:18'),
(264, 52, 551, 1, 'Analysis of Spear Phishing Attack Vector', '### Overview\nAfter detecting suspicious initial access via spear phishing, further analysis reveals that targeted emails contained malicious attachments designed to exploit vulnerabilities in email clients.\n\n### Key Details\n- **Targeted Industries:** Manufacturing and Energy sectors.\n- **Attachments:** Utilized a mix of macros and embedded scripts.\n- **Exploited Vulnerabilities:** CVE-2023-XXXX, affecting older email client versions.\n\n### Recommendations\n- Immediate update of email clients to patch known vulnerabilities.\n- Conduct user training on identifying phishing attempts.\n\n### Next Steps\nPrepare for potential malicious code execution as attackers aim to gain deeper system access.', '2026-01-07 22:35:14'),
(265, 52, 552, 2, 'Malicious Code Execution Analysis', '### Overview\nFollowing the execution of malicious code, system logs indicate the deployment of advanced payloads targeting industrial control systems.\n\n### Key Findings\n- **Payload Delivery:** Delivered through exploited email attachments.\n- **Target:** Focused on PLC firmware, aiming to disrupt operational processes.\n- **Observed Behavior:** Attempts to modify system configurations and interfere with normal operations.\n\n### Recommendations\n- Isolate affected machines to prevent further damage.\n- Implement network segmentation to limit exposure.\n\n### Next Steps\nFocus on rootkit persistence mechanisms that ensure continued attacker presence.', '2026-01-07 22:35:14'),
(266, 52, 553, 3, 'Rootkit Persistence Mechanism Identified', '### Overview\nThe rootkit deployed has established a robust persistence mechanism, enabling it to survive system reboots and evade standard detection.\n\n### Detailed Insights\n- **Persistence Techniques:** Utilizes bootkit components and modifies boot sectors.\n- **Evasion Tactics:** Employs anti-forensic techniques to avoid detection by security tools.\n- **Target Impact:** Continuous monitoring and disruption of PLC operations.\n\n### Recommendations\n- Conduct a thorough forensic analysis of boot sectors.\n- Employ specialized tools for rootkit detection and removal.\n\n### Next Steps\nMonitor for lateral movement as attackers attempt to expand their foothold.', '2026-01-07 22:35:14'),
(267, 52, 554, 4, 'Lateral Movement and Credential Dumping', '### Overview\nLateral movement detected suggests attackers are expanding their reach within the network by dumping credentials and leveraging compromised accounts.\n\n### Key Indicators\n- **Tools Used:** Mimikatz and custom scripts for credential extraction.\n- **Movement Patterns:** Transition from initial points of compromise to critical infrastructure nodes.\n- **Objective:** Gain control over additional systems and facilitate data exfiltration.\n\n### Recommendations\n- Reset compromised credentials immediately.\n- Deploy additional monitoring on critical systems to detect unauthorized access.\n\n### Next Steps\nPrepare to identify and mitigate data exfiltration attempts as attackers seek to extract sensitive information.', '2026-01-07 22:35:14'),
(268, 52, 555, 5, NULL, NULL, '2026-01-07 22:35:14'),
(269, 53, 556, 1, NULL, NULL, '2026-01-07 22:39:53'),
(270, 53, 557, 2, 'SUNBURST Backdoor Activation Analysis', '### Overview\nAfter initial access via the compromised SolarWinds update, the SUNBURST backdoor activates on the affected systems. This report delves into the mechanisms behind the activation.\n\n### Key Observations\n- **Activation Timing**: SUNBURST is designed to delay its execution to avoid raising immediate suspicion.\n- **Execution Methods**: Utilizes a combination of Windows processes to blend in with legitimate operations.\n\n### Recommendations\n- Conduct a thorough review of system logs during the initial days of compromise to identify unusual process behaviors.\n\n### Next Steps\nPrepare for potential persistence mechanisms adopted by SUNBURST to maintain foothold.', '2026-01-07 22:39:53'),
(271, 53, 558, 3, 'SUNBURST Persistence Mechanisms', '### Overview\nUpon activation, SUNBURST establishes persistence to ensure its continued presence on compromised systems.\n\n### Key Observations\n- **Registry Alterations**: Modifies registry keys to launch at startup.\n- **Scheduled Tasks**: Creates tasks that mimic valid system operations for periodic execution.\n\n### Recommendations\n- Audit registry changes and scheduled tasks for anomalies.\n\n### Next Steps\nInvestigate command and control (C2) communication methods utilized by SUNBURST.', '2026-01-07 22:39:53'),
(272, 53, 559, 4, 'C2 Communication via Domain Generation Algorithm', '### Overview\nSUNBURST employs a highly sophisticated domain generation algorithm (DGA) for its C2 communications, making detection challenging.\n\n### Key Observations\n- **Dynamic Domain Generation**: Regularly updates potential C2 domains, reducing the efficacy of static blocking.\n- **Encrypted Traffic**: Uses HTTPS for C2 communications to blend in with normal traffic.\n\n### Recommendations\n- Implement anomaly-based detection systems to flag unusual domain communications.\n\n### Next Steps\nFocus on identifying credential harvesting activities designed for lateral movement within the network.', '2026-01-07 22:39:53'),
(273, 53, 560, 5, 'Credential Harvesting and Lateral Movement', '### Overview\nWith a foothold established, APT29 utilizes SUNBURST to harvest credentials and facilitate lateral movement across networks.\n\n### Key Observations\n- **Credential Dumping Tools**: SUNBURST deploys tools to extract credentials from memory and secure storage.\n- **Lateral Movement Tactics**: Utilizes harvested credentials to access other systems, expanding its reach.\n\n### Recommendations\n- Monitor authentication logs for unusual access patterns and failed login attempts.\n\n### Next Steps\nPrepare for potential deployment of second-stage payloads following successful lateral movement.', '2026-01-07 22:39:53'),
(274, 53, 561, 6, 'Deployment of Second-Stage Payloads', '### Overview\nFollowing lateral movement, second-stage payloads are deployed to fulfill specific objectives of the operation.\n\n### Key Observations\n- **Payload Types**: Range from data collection tools to further exploitation utilities.\n- **Stealth Techniques**: Employs various methods to remain undetected, including fileless malware tactics.\n\n### Recommendations\n- Employ endpoint detection and response (EDR) solutions to identify and mitigate payload deployment.\n\n### Next Steps\nFocus on identifying data exfiltration methods utilized by the attackers.', '2026-01-07 22:39:53'),
(275, 53, 562, 7, 'Data Exfiltration via Stealth Channels', '### Overview\nAPT29 exfiltrates sensitive data using stealth channels to avoid detection.\n\n### Key Observations\n- **Stealth Channels**: Utilizes encrypted channels and legitimate services to mask data exfiltration.\n- **Data Types Targeted**: Includes intellectual property, sensitive communications, and credentials.\n\n### Recommendations\n- Implement data loss prevention (DLP) solutions to monitor and block unauthorized data transfers.\n\n### Next Steps\nInvestigate techniques used by APT29 to cover tracks and evade defenses.', '2026-01-07 22:39:53'),
(276, 53, 563, 8, 'Covering Tracks and Cleanup', '### Overview\nAs the operation concludes, APT29 employs various techniques to cover tracks and evade detection.\n\n### Key Observations\n- **Log Manipulation**: Alters or deletes logs to erase traces of their activities.\n- **File Removal**: Removes malware files and tools to prevent forensic analysis.\n\n### Recommendations\n- Regularly back up and secure logs offsite to prevent tampering.\n\n### Conclusion\nUnderstanding these techniques provides insight into APT29\'s strategies, aiding in future prevention and detection efforts.', '2026-01-07 22:39:53'),
(277, 54, 564, 1, 'Post-Phishing Attack Analysis', '### Context\nAfter the initial access was gained via a phishing attack, it\'s crucial to understand the tactics used by Lazarus Group to deliver the malicious payload.\n\n### Key Points\n- **Phishing Techniques**: The attackers utilized spear-phishing emails targeting specific employees at Sony Pictures.\n- **Email Content**: Emails included attachments or links leading to malicious sites.\n- **Employee Targets**: Employees with access to sensitive data were prioritized.\n\n### Next Steps\nPrepare for the possible deployment of malware, specifically the Destover malware, which is known to be used by Lazarus Group post-phishing.', '2026-01-07 22:40:38'),
(278, 54, 565, 2, 'Destover Malware Deployment Analysis', '### Context\nFollowing the phishing attack, Destover malware was executed within Sony Pictures\' network.\n\n### Key Points\n- **Malware Characteristics**: Destover is designed to wipe data and damage systems.\n- **Deployment Method**: Dropped via malicious email attachments or links.\n- **Initial Impact**: Systems were compromised, and data began to be wiped.\n\n### Next Steps\nPrepare for potential backdoor installations as attackers seek to establish persistence within the network.', '2026-01-07 22:40:38'),
(279, 54, 566, 3, 'Backdoor Installation and Persistence', '### Context\nWith the execution of the Destover malware, the attackers focus on maintaining access to the network.\n\n### Key Points\n- **Backdoor Tools**: Custom tools used by Lazarus Group to create persistent backdoors.\n- **Network Persistence**: Aim to maintain long-term access to the compromised systems.\n- **Detection and Evasion**: Techniques to evade detection by security systems.\n\n### Next Steps\nMonitor for signs of lateral movement as attackers map out the internal network.', '2026-01-07 22:40:38'),
(280, 54, 567, 4, 'Internal Network Reconnaissance', '### Context\nWith persistence established, the attackers began exploring the internal network of Sony Pictures.\n\n### Key Points\n- **Reconnaissance Tactics**: Use of legitimate credentials to move laterally.\n- **Target Identification**: Identification of high-value assets and data.\n- **Network Mapping**: Creation of a detailed map of the network\'s structure.\n\n### Next Steps\nFocus on identifying signs of data exfiltration activities, particularly through proxy chains.', '2026-01-07 22:40:38'),
(281, 54, 568, 5, 'Data Theft and Exfiltration Methods', '### Context\nAfter internal reconnaissance, the attackers initiated data exfiltration operations.\n\n### Key Points\n- **Exfiltration Techniques**: Data sent through encrypted channels and proxy chains to obfuscate origin.\n- **Target Data**: Intellectual property, confidential emails, and employee data.\n- **Stealth Tactics**: Use of legitimate network tools to blend with normal traffic.\n\n### Next Steps\nAnticipate attempts at log deletion to cover tracks and hinder forensic analysis.', '2026-01-07 22:40:38'),
(282, 54, 569, 6, 'Log Deletion and Evidence Destruction', '### Context\nAs data exfiltration concluded, the attackers shifted focus to destroying evidence.\n\n### Key Points\n- **Log Deletion**: System logs were systematically targeted and deleted.\n- **Forensic Challenges**: Hindered efforts to trace activities and attackers.\n- **Recovery Methods**: Possible methods to recover deleted logs for analysis.\n\n### Next Steps\nConduct a comprehensive analysis of the geopolitical motivations behind the attack, focusing on the interests of the Lazarus Group.', '2026-01-07 22:40:38'),
(283, 54, 570, 7, NULL, NULL, '2026-01-07 22:40:38'),
(284, 55, 571, 1, 'Report: Initial Access via HVAC Vendor Breach', '### Overview\nFollowing the compromise of the HVAC vendor\'s network, FIN7 leveraged stolen credentials to gain unauthorized access to the target retail system. This initial breach facilitated further infiltration into the target\'s infrastructure.\n\n### Key Findings\n- **Credential Theft**: FIN7 successfully harvested credentials from the HVAC vendor, exploiting weak security practices.\n- **Vulnerability Exploitation**: Existing vulnerabilities in the vendor\'s remote access protocols were manipulated to bypass security controls.\n\n### Next Steps\n- **Monitor for Malware Deployment**: With initial access achieved, anticipate the deployment of malicious software, specifically RAM-scraping malware, aimed at extracting sensitive data from Point-of-Sale (POS) systems.', '2026-01-08 22:01:14'),
(285, 55, 572, 2, 'Report: RAM-Scraping Malware Deployed', '### Overview\nFollowing initial access, FIN7 deployed RAM-scraping malware on the retailer\'s POS systems. This malware aims to capture unencrypted credit card data during transactions.\n\n### Key Findings\n- **Malware Characteristics**: The deployed malware is designed to scrape memory, extracting payment card information in real-time.\n- **Infection Vector**: POS systems were targeted via network access established through the compromised HVAC vendor credentials.\n\n### Next Steps\n- **Establishing Persistence**: It is critical to investigate methods used by FIN7 to maintain long-term access within the network, potentially through backdoors or additional malware components.', '2026-01-08 22:01:14'),
(286, 55, 573, 3, 'Report: Persistence Mechanisms Identified', '### Overview\nFIN7 has implemented various persistence mechanisms to ensure continued access to the retailer\'s network, complicating remediation efforts.\n\n### Key Findings\n- **Backdoor Installations**: Multiple backdoors have been identified, allowing FIN7 to regain access even after initial malware removal attempts.\n- **Scheduled Tasks and Services**: The attackers utilized scheduled tasks and modified system services to maintain their foothold.\n\n### Next Steps\n- **Lateral Movement Detection**: With persistence established, anticipate attempts to move laterally within the network, specifically towards the payment processing environments.', '2026-01-08 22:01:14'),
(287, 55, 574, 4, 'Report: Lateral Movement to Payment Network', '### Overview\nFIN7 successfully navigated laterally through the network, reaching the payment processing systems. This movement facilitated the exfiltration phase.\n\n### Key Findings\n- **Credential Reuse**: Previously compromised credentials were reused to access high-value systems.\n- **Network Mapping**: The attackers conducted extensive mapping of the internal network to identify critical assets.\n\n### Next Steps\n- **Data Exfiltration Monitoring**: With access to the payment network confirmed, focus on detecting and preventing the exfiltration of credit card information. Implement heightened monitoring of data flows leaving the network perimeter.', '2026-01-08 22:01:14'),
(288, 55, 575, 5, NULL, NULL, '2026-01-08 22:01:14'),
(289, 56, 576, 1, NULL, NULL, '2026-01-08 22:06:19'),
(290, 56, 577, 2, 'Initial Access Analysis', '## Analysis of Suspicious HTTP Request\nThe initial suspicious HTTP request detected was aimed at the Apache Struts framework. It appears to have exploited the CVE-2017-5638 vulnerability. This exploit allows remote attackers to execute arbitrary commands via a crafted Content-Type header. Further investigation is needed to confirm execution vectors leading to subsequent activities.', '2026-01-08 22:06:19'),
(291, 56, 578, 3, 'Execution Tactics Uncovered', '## Unusual Command Execution Observed\nFollowing the initial access, an unusual command was executed on the server. This command matches known patterns used to drop web shells, indicating a potential foothold has been established. Investigate server directories for anomalies in file modifications and check for unauthorized shell scripts.', '2026-01-08 22:06:19'),
(292, 56, 579, 4, 'Persistence Tactics Identified', '## Web Shell Detected in Server Directory\nA web shell has been detected on the server, placed in a directory accessible via HTTP requests. This suggests the attackers have established persistence, potentially allowing for remote command execution. Immediate containment is necessary to prevent further compromise.', '2026-01-08 22:06:19'),
(293, 56, 580, 5, 'Exfiltration Indicators', '## Unexpected Outbound Traffic Spike\nA significant spike in outbound traffic was observed, coinciding with the detection of the web shell. This traffic anomaly suggests potential data exfiltration. It is crucial to identify the data being accessed and determine the destination of the outbound traffic.', '2026-01-08 22:06:19'),
(294, 56, 581, 6, 'Lateral Movement Analysis', '## Unauthorized User Account Activity\nFollowing the exfiltration indicators, unauthorized activity was detected on multiple user accounts. This suggests attempts at lateral movement within the network. Review user account logs and network access patterns to identify the scope of compromise.', '2026-01-08 22:06:19'),
(295, 56, 582, 7, 'Reconnaissance Patterns Detected', '## Anomalous File Access Patterns\nAnomalous file access patterns have been detected, indicative of reconnaissance efforts. Files typically not accessed by routine processes are being queried, suggesting preparation for further exploitation. Conduct a thorough audit of access logs to identify unusual patterns.', '2026-01-08 22:06:19'),
(296, 56, 583, 8, 'Command and Control Channel Investigation', '## DNS Tunneling Suspected\nUnusual DNS queries have been observed, consistent with DNS tunneling techniques used for command and control communication. This covert channel allows attackers to bypass traditional security measures. Immediate action is needed to disrupt this communication chain.', '2026-01-08 22:06:19'),
(297, 56, 584, 9, 'Exfiltration Anomalies', '## Encrypted Traffic Anomaly\nAn anomaly in encrypted traffic was detected, potentially indicating advanced exfiltration methods. The use of non-standard encryption protocols points to sophisticated efforts to mask data transfer. Analyze traffic patterns and decryption attempts to ascertain data flow.', '2026-01-08 22:06:19'),
(298, 56, 585, 10, 'Privilege Escalation Attempts', '## Privileged Account Escalation Attempt\nAn attempt to escalate privileges on a compromised account has been detected. This attempt was thwarted, but it suggests a strategy to gain higher-level access within the network. Review all privileged accounts for signs of tampering or unauthorized access.', '2026-01-08 22:06:19'),
(299, 57, 586, 1, 'Post-Initial Access: Analyzing JNDI Payloads', '## Overview\nFollowing the detection of JNDI injection, further analysis is required to understand the payloads utilized by the attackers. These payloads often serve as the initial stage for further exploitation.\n\n## Key Findings\n- **Payload Variants:** Multiple JNDI payloads have been identified, indicating a sophisticated attack strategy.\n- **APT Attribution:** Evidence suggests the involvement of Chinese APT groups, leveraging customized payloads for deeper penetration.\n\n## Recommendations\n- **Immediate Patch Application:** Ensure all systems are updated with the latest security patches for Log4j vulnerabilities.\n- **Network Monitoring:** Increase monitoring of outbound connections to detect any unauthorized data flows.', '2026-01-08 22:09:13'),
(300, 57, 587, 2, 'Cryptominer Deployment: Identifying Malware Behavior', '## Overview\nThe deployment of cryptominers has been confirmed following the JNDI injection. This stage marks the transition from initial access to execution.\n\n## Key Findings\n- **Cryptominer Characteristics:** The malware is designed to utilize compromised systems for mining cryptocurrency, primarily focusing on Monero.\n- **Indicators of Compromise (IoCs):** Hash values and network traffic patterns associated with the cryptominer have been documented.\n\n## Recommendations\n- **System Resource Monitoring:** Watch for abnormal CPU usage, which may indicate cryptominer activity.\n- **Endpoint Detection and Response (EDR):** Deploy EDR solutions to detect and mitigate malware installations.', '2026-01-08 22:09:13'),
(301, 57, 588, 3, 'Backdoor Creation: Ensuring Persistence', '## Overview\nA backdoor has been identified, indicating the attackers\' intent to maintain long-term access to the compromised network.\n\n## Key Findings\n- **Backdoor Mechanisms:** The backdoor utilizes both known and custom methods to evade detection.\n- **Targeted Systems:** Persistence mechanisms have been established on critical infrastructure components.\n\n## Recommendations\n- **Comprehensive Threat Hunting:** Conduct thorough investigations to uncover hidden backdoors.\n- **Access Control Review:** Reassess access permissions and implement stricter access controls.', '2026-01-08 22:09:13'),
(302, 57, 589, 4, 'Lateral Movement: Expanding Network Foothold', '## Overview\nUnauthorized access has been detected, suggesting lateral movement within the network. This phase indicates an attempt to expand control and compromise additional systems.\n\n## Key Findings\n- **Techniques Used:** Attackers are leveraging stolen credentials and exploiting weak network segmentations.\n- **Potential Targets:** Systems holding sensitive data and high-value assets are at increased risk.\n\n## Recommendations\n- **Network Segmentation:** Strengthen network segmentation to limit lateral movements.\n- **User Behavior Analytics:** Implement solutions to detect anomalies in user behavior that may indicate credential misuse.', '2026-01-08 22:09:13'),
(303, 57, 590, 5, NULL, NULL, '2026-01-08 22:09:13'),
(304, 58, 591, 1, 'Insight into SQL Injection Vulnerability and Exploitation', '### Overview\nFollowing the initial alert on Cl0p\'s zero-day exploitation via SQL injection, it is crucial to understand the mechanisms and potential impacts of this attack vector.\n\n### SQL Injection Details\nSQL injection is a code injection technique that might destroy your database. It is one of the most common web hacking techniques. It can allow attackers to gain unauthorized access to sensitive data and even execute administrative operations on the database.\n\n### Potential Impacts\n- Unauthorized access to sensitive data.\n- Database corruption or deletion.\n- Network compromise and further exploitation.\n\n### Recommendations\n- Immediate patching of known vulnerabilities in the MOVEit system.\n- Enhanced monitoring of SQL queries and database access logs.', '2026-01-08 22:12:37'),
(305, 58, 592, 2, 'Automated Data Harvesting Scripts: A Deeper Look', '### Overview\nFollowing the execution of data harvesting scripts, it is important to analyze the methods and scripts used in this automated process.\n\n### Command and Scripting Interpreter: JavaScript (T1059.007)\nCl0p employs JavaScript-based scripts to automate the extraction and collection of data. These scripts can run with minimal detection and can be tailored to target specific datasets.\n\n### Key Characteristics\n- Scripts are designed to execute silently and efficiently.\n- They can be modified on-the-fly to avoid detection by security tools.\n- Typically exfiltrate data to external servers controlled by attackers.\n\n### Recommendations\n- Implement script execution monitoring.\n- Utilize behavioral analysis tools to identify unusual script activities.\n- Regularly update security policies to counter emerging threats.', '2026-01-08 22:12:37'),
(306, 58, 593, 3, 'Establishing Persistence: Techniques and Indicators', '### Overview\nPersistence mechanisms are crucial for attackers to maintain a foothold within compromised networks. Understanding these mechanisms can aid in detection and remediation.\n\n### Boot or Logon Autostart Execution (T1547)\nCl0p uses various techniques to ensure persistence, including modifying autostart entries and using scheduled tasks.\n\n### Indicators of Compromise\n- Unexpected changes in registry keys related to startup items.\n- New or modified scheduled tasks.\n- Unusual applications set to auto-start.\n\n### Recommendations\n- Conduct regular audits of startup and scheduled task configurations.\n- Implement endpoint detection and response (EDR) solutions to identify suspicious behavior.', '2026-01-08 22:12:37'),
(307, 58, 594, 4, 'Lateral Movement and Data Exfiltration: Strategies and Mitigation', '### Overview\nCl0p\'s lateral movement and data exfiltration strategies pose significant risks. Understanding these tactics can help in strengthening defenses.\n\n### Indicator Removal on Host (T1070)\nTo facilitate lateral movement, Cl0p employs techniques to hide their tracks by removing indicators of compromise.\n\n### Exfiltration Over C2 Channel (T1041)\nMass exfiltration is conducted over command and control (C2) channels, often using encrypted communication to avoid detection.\n\n### Mitigation Strategies\n- Deploy network segmentation to limit lateral movement.\n- Monitor for anomalous network traffic patterns.\n- Implement data loss prevention (DLP) solutions to detect and prevent unauthorized data transfers.', '2026-01-08 22:12:37'),
(308, 58, 595, 5, NULL, NULL, '2026-01-08 22:12:37'),
(309, 59, 596, 1, 'Initial Access Analysis', '## Overview\n\nFollowing the **Suspicious Access to Exchange Server** alert, further analysis was conducted to identify the initial access vector. It appears the adversary leveraged a known Exchange vulnerability, likely CVE-2021-34473, to gain unauthorized access.\n\n## Technical Details\n- **IP Address**: 192.168.1.10\n- **User Agent**: Suspicious pattern indicating automated tool usage\n- **Vulnerability Exploited**: CVE-2021-34473\n\n## Recommendations\n- Patch vulnerable Exchange servers immediately.\n- Implement network segmentation to limit access to critical assets.\n\n## Next Steps\nPrepare for potential web shell deployment as adversaries often use this method for further exploitation post-initial access.', '2026-01-08 22:15:20'),
(310, 59, 597, 2, 'Web Shell Deployment Insights', '## Overview\n\nPost detection of **Web Shell Deployment**, an investigation revealed the presence of multiple malicious web shells on the Exchange server.\n\n## Indicators of Compromise\n- **File Path**: `/owa/auth/xyz.aspx`\n- **File Size**: 3kb\n- **Behavior**: Command execution via PowerShell\n\n## Recommendations\n- Conduct a thorough scan for additional web shells.\n- Isolate the affected server to prevent further compromise.\n\n## Next Steps\nMonitor for privilege escalation attempts, particularly those exploiting CVE-2021-34523.', '2026-01-08 22:15:20'),
(311, 59, 598, 3, 'Privilege Escalation Attempt Detected', '## Overview\n\nThe adversary has exploited **CVE-2021-34523** for privilege escalation, gaining SYSTEM-level access on the compromised Exchange server.\n\n## Technical Details\n- **Exploit Tool Used**: PrivEsc v2.0\n- **Privileges Gained**: SYSTEM\n\n## Recommendations\n- Review and restrict service account permissions.\n- Enhance monitoring on privileged account activities.\n\n## Next Steps\nAnticipate lateral movement attempts as adversaries seek to expand their foothold within the network.', '2026-01-08 22:15:20'),
(312, 59, 599, 4, 'Lateral Movement Strategy', '## Overview\n\nLateral movement activities have been identified, indicating the adversary\'s intent to expand their presence within the network.\n\n## Observed Tactics\n- **Technique**: Pass-the-Hash\n- **Targeted Systems**: File servers and domain controllers\n\n## Recommendations\n- Implement SMB signing and limit NTLM use.\n- Monitor network traffic for anomalous patterns.\n\n## Next Steps\nPrepare for potential data exfiltration efforts, focusing on monitoring unusual data transfer channels.', '2026-01-08 22:15:20'),
(313, 59, 600, 5, NULL, NULL, '2026-01-08 22:15:20'),
(314, 60, 771, 1, 'Analysis of Initial Access via Phishing Email', '## Context\nFollowing Alert 1, the phishing email campaign targeting JBS Foods was identified as the initial entry point for the REvil ransomware attack. This report provides a detailed analysis of the social engineering tactics employed and the potential vulnerabilities exploited.\n\n## Phishing Email Characteristics\n- **Subject Line**: Mimicked internal communications.\n- **Sender**: Spoofed email addresses resembling trusted partners.\n- **Content**: Included links to a compromised website hosting malicious payloads.\n\n## Vulnerabilities\n- **End-User Awareness**: Lack of effective phishing awareness among employees.\n- **Email Filtering**: Insufficient filtering and detection mechanisms.\n\n## Recommendations\n- **Training**: Enhance security training focused on phishing threats.\n- **Technical Measures**: Implement advanced email filtering solutions.\n\nThis analysis sets the stage for understanding how the ransomware was successfully deployed after gaining initial access.', '2026-01-11 23:33:15'),
(315, 60, 772, 2, 'Insights into Ransomware Deployment and Execution', '## Overview\nAfter gaining initial access through phishing, the threat actors moved to deploy and execute the REvil ransomware. This report delves into the methods used for malware deployment and subsequent execution.\n\n## Deployment Tactics\n- **Lateral Movement**: Exploited internal network vulnerabilities to propagate.\n- **Privilege Escalation**: Used stolen credentials to gain administrative access.\n\n## Execution Details\n- **Payload Delivery**: The ransomware was delivered via script execution on compromised systems.\n- **Encryption Process**: Files were encrypted using strong encryption algorithms, making recovery without payment challenging.\n\n## Mitigation Strategies\n- **Network Segmentation**: Implement robust segmentation to contain threats.\n- **Access Controls**: Regularly update and audit user access rights.\n\nUnderstanding these techniques is crucial for tracing the Bitcoin ransom payments and analyzing financial transactions, as detailed in the subsequent alert.', '2026-01-11 23:33:15'),
(316, 60, 773, 3, NULL, NULL, '2026-01-11 23:33:15'),
(317, 61, 774, 1, 'Phishing Attack Analysis and Implications', '# Phishing Attack Analysis and Implications\n\n## Overview\nThe initial compromise of JBS Foods\' network was executed through a sophisticated phishing attack. This report provides an in-depth analysis of the phishing techniques employed and the potential vulnerabilities that were exploited.\n\n## Key Findings\n- **Attack Vector:** The attackers used spear-phishing emails targeting specific employees with access to critical systems.\n- **Email Content:** The phishing emails contained malicious links disguised as legitimate vendor communication. These links redirected to a cloned login page to harvest credentials.\n- **Exploited Vulnerabilities:** The lack of multi-factor authentication (MFA) and insufficient email filtering allowed the phishing emails to bypass security measures.\n\n## Implications\nUnderstanding this initial compromise is crucial for preparing a defense against the deployment of ransomware, the next stage in the attack chain.', '2026-01-11 23:35:35'),
(318, 61, 775, 2, 'Ransomware Deployment and System Impact', '# Ransomware Deployment and System Impact\n\n## Overview\nFollowing the successful phishing attack, REvil deployed ransomware across JBS Foods\' network. This report details the deployment strategy and its immediate impact on operations.\n\n## Deployment Strategy\n- **Malware Delivery:** Utilizing the harvested credentials, attackers executed the ransomware payload on compromised systems.\n- **Immediate Effects:** Critical systems were encrypted, causing significant disruption to JBS Foods\' supply chain and operations.\n\n## System Impact\n- **Operational Disruption:** Production and distribution were severely impacted, with losses estimated in millions.\n- **Response Measures:** Immediate incident response involved isolating affected systems and initiating backup restoration protocols.\n\nUnderstanding this stage is essential for anticipating the mechanisms attackers may use to establish persistence within the network.', '2026-01-11 23:35:35'),
(319, 61, 776, 3, 'Persistence Mechanisms and Threat Intelligence', '# Persistence Mechanisms and Threat Intelligence\n\n## Overview\nAfter deploying ransomware, attackers focused on establishing persistence within JBS Foods\' network to maintain control and facilitate further operations.\n\n## Persistence Tactics\n- **Backdoor Installation:** Attackers installed backdoors on key systems, enabling remote access even after initial detection.\n- **Credential Dumping:** Tools were used to extract additional credentials, allowing deeper penetration into the network.\n\n## Threat Intelligence\n- **Indicators of Compromise (IOCs):** Monitoring for known IOCs is vital for detecting ongoing attacker activity.\n- **Advanced Threat Detection:** Utilizing behavioral analytics to identify unusual network traffic patterns indicative of lateral movement.\n\nThis report highlights the importance of understanding persistence tactics to counteract the lateral movement toward critical systems.', '2026-01-11 23:35:35');

