In this beginner-level training scenario, you'll confront a cyber attack orchestrated by the notorious Sandworm group. Disguised as ransomware, the attack spreads through a compromised update of an accounting software, aiming to destroy data and disrupt operations. Participants will learn to identify the master boot record (MBR) overwriting behavior and the use of Mimikatz to harvest credentials, facilitating rapid lateral movement across networks.