In this operation, analysts are tasked with uncovering the sophisticated tactics employed by APT1, a Chinese state-sponsored group, in their prolonged and undetected breach of the Starwood/Marriott database. This breach, affecting 500 million guest records, showcases the group's expertise in maintaining persistence and evading detection through strategic use of Remote Access Trojans (RATs) and advanced data encryption. Participants will dive into the intricacies of the attack, focusing on the exposure of sensitive data such as passport numbers, and how the attackers leveraged the Starwood acquisition to their advantage.