In 2017, the world witnessed one of the most devastating cyberattacks in history when the NotPetya malware struck, inflicting over $10 billion in damages globally. Among its victims was Maersk, the world's largest shipping company, whose operations ground to a halt, resulting in a $300 million impact. This training scenario dives into the intricate investigation of the attack, focusing on the complete IT infrastructure rebuild, the serendipitous discovery of a functional domain controller in Ghana, and the relentless 10-day recovery effort.