In this advanced training scenario, participants will delve into the sophisticated world of NetWalker, a notorious APT group known for its ransomware-as-a-service model. This operation focuses on their recent campaigns targeting vulnerable healthcare and education institutions. Trainees will investigate the PowerShell-based fileless execution techniques used by NetWalker affiliates to infiltrate and disrupt critical operations. As the scenario unfolds, participants must navigate through a series of alerts, each revealing a piece of the puzzle that ultimately leads to a comprehensive understanding of NetWalker’s attack strategies.