-- Table structure for table `modules`
--

CREATE TABLE `modules` (
  `id` int(11) NOT NULL,
  `learning_path_id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `estimated_hours` int(11) DEFAULT 0,
  `display_order` int(11) DEFAULT 0,
  `prerequisite_module_id` int(11) DEFAULT NULL,
  `is_active` tinyint(1) DEFAULT 1,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `modules`
--

INSERT INTO `modules` (`id`, `learning_path_id`, `title`, `description`, `estimated_hours`, `display_order`, `prerequisite_module_id`, `is_active`, `created_at`, `updated_at`) VALUES
(1, 1, 'Introduction to Cybersecurity', 'Learn what cybersecurity is, why it matters, and explore career paths in the field.', 15, 1, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(2, 1, 'Linux Fundamentals', 'Master the Linux command line, file permissions, and basic system administration.', 25, 2, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(4, 1, 'Networking Essentials', 'Learn the OSI model, TCP/IP, subnetting, and common network protocols.', 30, 4, NULL, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07'),
(9, 1, 'Windows Fundamentals', 'Master Windows OS, Active Directory basics, and PowerShell for security operations.', 16, 3, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 03:05:08'),
(10, 1, 'Security Principles', 'Core security concepts: CIA Triad, AAA, encryption, defense in depth.', 14, 5, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 03:05:08'),
(11, 1, 'Windows Command Line', 'Master essential Windows commands: Navigation, Files, Networking, and Processes.', 5, 6, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12'),
(12, 2, 'Log Analysis Fundamentals', 'Master the art of reading logs, from basic authentication to advanced attack detection.', 8, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58'),
(14, 2, 'Web Proxies Fundamentals', 'Understand how proxies work, how to intercept traffic, and the basics of Burp Suite.', 5, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42'),
(15, 2, 'Introduction to IDS/IPS', 'Comprehensive guide to Intrusion Detection and Prevention Systems.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:20'),
(16, 2, 'Vulnerability Scanning', 'Master the Vulnerability Management Lifecycle.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21'),
(17, 2, 'Web App Scanning (DAST)', 'Dynamic Application Security Testing deep dive.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21'),
(18, 2, 'Introduction to OSINT', 'Master Open Source Intelligence gathering techniques and tools.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:25:25'),
(19, 2, 'Phishing & Email Analysis', 'Learn to dissect email headers and investigate phishing attacks.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:25:25'),
(20, 2, 'Social Engineering Defense', 'Understand the human element of security and how to defend against manipulation.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:28:54'),
(21, 2, 'Virtualization & Lab Setup', 'Build your own safe hacking laboratory using Virtual Machines.', 15, 0, NULL, 1, '2025-12-26 02:44:43', '2025-12-26 22:32:26'),
(22, 3, 'SIEM Fundamentals', 'Master the \"Brain\" of the SOC: Security Information and Event Management.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:35:58'),
(23, 3, 'SIEM Use Cases', 'Practical log analysis scenarios ranging from Easy to Data Exfiltration.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:41:26'),
(24, 3, 'EDR Concepts', 'Master Endpoint Detection & Response: Telemetry, Process Trees, and Threat Hunting.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:47:08'),
(25, 3, 'Intrusion Detection', 'Learn to identify and investigate network and host-based intrusions.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:50:58'),
(26, 3, 'Malware Analysis Basics', 'Learn to safely analyze malware: Static, Dynamic, and Behavioral techniques.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-26 22:55:56'),
(27, 3, 'Incident Response Framework', 'Master the structured approach to handling security incidents.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(28, 3, 'Digital Forensics Intro', 'Learn the fundamentals of collecting and analyzing digital evidence.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(29, 3, 'Network Traffic Analysis', 'Learn to capture and analyze network packets for threat detection.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(30, 3, 'Threat Hunting Basics', 'Proactively search for threats before they cause damage.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(31, 3, 'MITRE ATT&CK Framework', 'Understand the knowledge base of adversary tactics and techniques.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(32, 3, 'Cloud Security Basics', 'Understand security challenges and controls in cloud environments.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(33, 3, 'Security Automation', 'Learn to automate security tasks using SOAR and scripting.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(34, 3, 'Reporting & Documentation', 'Master the art of documenting investigations and writing reports.', 15, 0, NULL, 1, '2025-12-26 02:45:46', '2025-12-27 02:12:47'),
(36, 4, 'Advanced SIEM', 'Deep dive into SIEM engineering: Query optimization, custom parsers, and correlation logic.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:16:31'),
(37, 4, 'Memory Forensics', 'Analyze volatile memory to uncover malware, rootkits, and attacker artifacts.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:18:03'),
(38, 4, 'Malware Reverse Engineering', 'Disassemble and analyze malicious code to understand its behavior.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:19:34'),
(39, 4, 'Advanced Threat Intelligence', 'Operationalize threat intel: Collection, analysis, dissemination, and integration.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:21:00'),
(40, 4, 'Red vs Blue Team Dynamics', 'Purple teaming: Collaboration between offensive and defensive security.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:22:23'),
(41, 4, 'Purple Teaming Exercises', 'Hands-on exercises combining offensive execution with defensive detection.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:26:00'),
(42, 4, 'Container Security', 'Secure Docker, Kubernetes, and container orchestration environments.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:27:22'),
(43, 4, 'Zero Trust Architecture', 'Never trust, always verify: Implementing zero trust principles.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:28:42'),
(44, 4, 'Compliance & Frameworks', 'Navigate security compliance: NIST, ISO, SOC 2, PCI-DSS, and HIPAA.', 15, 0, NULL, 1, '2025-12-26 02:45:47', '2025-12-27 02:30:07'),
(49, 9, 'EDR Investigations', 'Learn about EDR Investigations', 0, 1, NULL, 1, '2025-12-26 17:59:30', '2025-12-26 17:59:30'),
(51, 9, 'SIEM Log Analysis', 'Learn about SIEM Log Analysis', 0, 3, NULL, 1, '2025-12-26 17:59:30', '2025-12-26 17:59:30'),
(52, 9, 'Email Security & Phishing', 'Learn about Email Security & Phishing', 0, 4, NULL, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31'),
(53, 9, 'Vulnerability Management', 'Learn about Vulnerability Management', 0, 5, NULL, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31'),
(117, 6, 'CTI Fundamentals', 'Foundations of Cyber Threat Intelligence: The Intelligence Cycle, Types of Intel, and Pyramid of Value.', 3, 1, NULL, 1, '2025-12-29 13:30:44', '2025-12-29 13:30:44'),
(118, 6, 'OSINT Techniques', 'Open Source Intelligence: Gathering data from public sources using passive reconnaissance.', 4, 2, NULL, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(119, 6, 'Malware Analysis', 'Understand malware behavior, static vs dynamic analysis, and sandboxing.', 4, 3, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(120, 6, 'Indicators & Standards', 'IOCs, IOAs, TLP, and STIX/TAXII standards.', 3, 4, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(121, 6, 'MITRE ATT&CK', 'Master the framework.', 4, 5, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(122, 6, 'Threat Hunting', 'Proactive search for threats. Stacking, Clustering, and Hypothesis driven hunting.', 4, 6, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(123, 6, 'Intelligence Platforms', 'Using MISP and OpenCTI.', 5, 7, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(124, 6, 'Reporting & Dissemination', 'Writing effective reports for different audiences.', 2, 8, NULL, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32');

-- --------------------------------------------------------

--
-- Table structure for table `notifications`
--

CREATE TABLE `notifications` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `message` text DEFAULT NULL,
  `is_read` tinyint(1) DEFAULT 0,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `operations`
--

CREATE TABLE `operations` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `apt_group` varchar(255) DEFAULT NULL,
  `description` text DEFAULT NULL,
  `story_intro` text DEFAULT NULL,
  `difficulty_level` varchar(50) DEFAULT NULL,
  `display_order` int(11) DEFAULT 0,
  `is_active` tinyint(1) DEFAULT 1,
  `is_premium` tinyint(1) DEFAULT 0,
  `passing_grade` int(11) DEFAULT 60,
  `time_limit_hours` int(11) DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`tags`)),
  `scenario_prompt` text DEFAULT NULL,
  `total_alerts` int(11) DEFAULT 0,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp(),
  `seo_title` varchar(255) DEFAULT NULL,
  `seo_description` text DEFAULT NULL,
  `slug` varchar(255) DEFAULT NULL,
  `min_level` int(11) DEFAULT 1
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `operations`
--

INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(1, 'Operation Iron Grid', 'Sandworm (Russian GRU)', 'Investigate a massive power outage affecting critical infrastructure. Use OT/ICS forensics to track the attacker\'s pivot from the corporate IT network into the SCADA control systems using BlackEnergy malware variants.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 5, '2025-12-31 13:08:59', NULL, NULL, 'operation-iron-grid', 1),
(2, 'Operation Silent Tsunami', 'Lazarus Group (North Korea)', 'A major decentralized finance (DeFi) platform has been drained of $600M. Trace the laundered cryptocurrency through mixer services and analyze the social engineering campaign that targeted developers with weaponized job offers.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 4, '2025-12-31 13:42:03', NULL, NULL, 'operation-silent-tsunami', 1),
(3, 'Operation Glass Serpent', 'APT41 (Barium)', 'A distinct supply chain attack compromising a popular server management software. Identify the malicious DLL injection in the signed update package and track the actor\'s dual-mission of espionage and financial theft across victim networks.\n', '', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 4, '2025-12-31 13:44:55', 'Operation Glass Serpent', 'A distinct supply chain attack compromising a popular server management software. Identify the malicious DLL injection in the signed update package and track the actor\'s dual-mission of espionage and financial theft across victim networks.\n', 'operation-glass-serpent', 1),
(4, 'Operation Phantom Ballot', 'APT28 (Fancy Bear)', 'Uncover a disinformation and spear-phishing campaign targeting political organizations ahead of a national election. Analyze leaked documents, track domain infrastructure used for credential harvesting, and identify the OAuth token abuse techniques.\n', '', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"\\\\\\\\\\\\\\\"[]\\\\\\\\\\\\\\\"\\\\\\\"\\\"\"', '', 4, '2025-12-31 15:16:16', 'Operation Phantom Ballot', 'Uncover a disinformation and spear-phishing campaign targeting political organizations ahead of a national election. Analyze leaked documents, track domain infrastructure used for credential harvesting, and identify the OAuth token abuse techniques.\n', 'operation-phantom-ballot', 1),
(5, 'Operation Black Harvest', 'Wizard Spider (Ryuk/Conti)', 'Respond to a catastrophic ransomware attack paralyzing a regional hospital network. Recover patient data from shadow copies, identify the initial access broker\'s entry point via TrickBot, and trace the lateral movement using Cobalt Strike beacons.', '', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 5, '2025-12-31 15:21:18', 'Operation Black Harvest', 'Respond to a catastrophic ransomware attack paralyzing a regional hospital network. Recover patient data from shadow copies, identify the initial access broker\'s entry point via TrickBot, and trace the lateral movement using Cobalt Strike beacons.', 'operation-black-harvest', 1),
(6, 'Operation Golden Ticket', 'Carbanak / FIN7', 'A global banking heist involving the manipulation of ATM withdrawal limits and SWIFT transaction gateways. Analyze the specialized administrative tools used by the attackers to impersonate bank clerks and authorize fraudulent transfers.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[]\\\"\"', '', 4, '2025-12-31 15:22:51', 'Operation Golden Ticket', 'A global banking heist involving the manipulation of ATM withdrawal limits and SWIFT transaction gateways. Analyze the specialized administrative tools used by the attackers to impersonate bank clerks and authorize fraudulent transfers.\n', 'operation-golden-ticket', 1),
(7, 'Operation Desert Mirage', 'APT34 (OilRig)', 'A simulated cyber operation led by the APT34 group aimed at infiltrating a multinational energy corporation to exfiltrate sensitive geological data.', 'In this scenario, participants will defend against a targeted cyber attack by APT34, also known as OilRig. The group is known for its focus on the energy sector, and they are suspected to be backed by a nation-state. The exercise will challenge participants to identify and mitigate threats across multiple stages of an advanced persistent threat operation.', 'intermediate', 0, 1, 1, 60, NULL, '[]', '', 5, '2026-01-02 04:27:59', NULL, NULL, 'operation-desert-mirage', 1),
(8, 'Operation Silent Harvest', 'APT10 (Stone Panda)', 'This training scenario simulates a cyber attack by APT10 (Stone Panda), known for its sophisticated cyber espionage campaigns. Participants will navigate through a series of alerts representing different stages of an attack, aiming to understand and mitigate each threat effectively.', 'In recent months, there has been an increase in suspicious activities targeting a fictional multinational corporation, TechGlobal Inc. Intelligence suggests that APT10 is behind these attacks, with the intent to exfiltrate sensitive intellectual property and confidential business data. Your task is to identify and neutralize the threats as they unfold.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[]\\\\\\\"\\\"\"', '', 5, '2026-01-02 20:23:41', NULL, NULL, 'operation-silent-harvest', 1),
(9, 'Operation Infinite Loop', 'Equation Group / Lamberts', 'Analyze a sophisticated firmware implant discovered on enterprise firewalls. This advanced persistent threat persists across reboots and OS re-installations. Conduct low-level forensic analysis of the SPI flash memory to extract the payload.', '', 'advanced', 0, 1, 1, 60, NULL, '[]', NULL, 10, '2026-01-02 20:26:53', NULL, NULL, 'operation-infinite-loop', 1),
(10, 'Operation Ocean Lotus', 'APT32 (OceanLotus)', 'A targeted watering hole attack on a human rights organization\'s website. Users are infected with a custom backdoor upon visiting the site. Analyze the obfuscated JavaScript payload and the subsequent macOS malware deployment.\n', '', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"[]\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\"\\\"\"', '', 5, '2026-01-02 20:30:06', 'Operation Ocean Lotus', 'A targeted watering hole attack on a human rights organization\'s website. Users are infected with a custom backdoor upon visiting the site. Analyze the obfuscated JavaScript payload and the subsequent macOS malware deployment.\n', 'operation-ocean-lotus', 1),
(11, 'Operation Radiant Horizon', 'Hafnium (China)', 'Train in identifying and mitigating Hafnium\'s exploitation of Exchange servers using ProxyLogon and China Chopper.', 'In early 2021, organizations worldwide faced a sophisticated onslaught by Hafnium, a Chinese state-sponsored APT group. This scenario puts you in the shoes of a cyber defense team responding to a mass exploitation event targeting on-premise Exchange servers. Your mission: analyze web shell artifacts, uncover the chain of zero-day vulnerabilities used for initial access, and determine the scope of data exfiltration. This advanced training will test your skills in real-world threat detection and incident response.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Hafnium\\\\\\\",\\\\\\\"ProxyLogon\\\\\\\",\\\\\\\"China Chopper\\\\\\\",\\\\\\\"Exchange Server Exploitation\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\"]\\\"\"', '', 8, '2026-01-03 00:02:24', 'Advanced Response to Hafnium\'s Mass Exploitation of Exchange Servers', 'Train in identifying and mitigating Hafnium\'s exploitation of Exchange servers using ProxyLogon and China Chopper.', 'operation-radiant-horizon', 1),
(12, 'Operation Silent Star', 'Turla (Snake / Uroburos)', 'Investigate Turla\'s hijacking of satellite links to mask C2 locations using rootkits on diplomatic networks.', 'In a world where digital espionage knows no bounds, the notorious Turla group has taken cyber warfare to new heights. By hijacking commercial satellite internet links, they\'ve crafted an insidious method to conceal their command and control locations. As a cyber threat analyst, your mission is to dismantle this operation by tracing the hijacked downstream traffic and unearthing the sophisticated rootkit deployed within diplomatic networks. Can you unravel the layers of deception and thwart Turla\'s ambitions?', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Turla APT\\\\\\\",\\\\\\\"cyber espionage\\\\\\\",\\\\\\\"satellite hijacking\\\\\\\",\\\\\\\"network security\\\\\\\",\\\\\\\"rootkit analysis\\\\\\\"]\\\"\"', '', 5, '2026-01-03 00:36:50', 'Operation Satellite Serpent: Uncovering Turla\'s Covert Channels', 'Investigate Turla\'s hijacking of satellite links to mask C2 locations using rootkits on diplomatic networks.', 'operation-silent-star', 1),
(13, 'Operation Dragon Breath', 'APT40 (Periscope)', 'Uncover APT40\'s tactics in stealing maritime research data via compromised servers and custom malware.', 'In an unprecedented cyber breach, APT40 has targeted a naval engineering university, stealing sensitive maritime research data. Analysts must uncover how compromised web servers were used as relay points and analyze the custom malware deployed to exfiltrate proprietary sonar technology schematics. This operation requires a keen understanding of APT40\'s tactics and technical prowess to unravel their sophisticated attack chain.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT40\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"maritime data breach\\\\\\\",\\\\\\\"custom malware\\\\\\\",\\\\\\\"threat analysis\\\\\\\"]\\\"\"', '', 5, '2026-01-03 00:41:42', 'Investigating APT40\'s Maritime Data Heist', 'Uncover APT40\'s tactics in stealing maritime research data via compromised servers and custom malware.', 'operation-dragon-breath', 1),
(14, 'Operation Wasted Locker', 'Evil Corp (Indrik Spider)', 'Engage in simulated ransomware negotiation and decryption against Evil Corp in this advanced cybersecurity training scenario.', 'In a high-stakes cybersecurity operation, a Fortune 500 company falls victim to a sophisticated ransomware attack by the notorious APT group, Evil Corp. As the company\'s data is held hostage, your team is tasked with negotiating with the attackers while simultaneously reverse-engineering the malware to identify a vulnerability in its encryption. The initial infection vector is traced back to a cunning drive-by download, demonstrating Evil Corp\'s technical prowess. Can you outsmart the attackers, recover the data, and trace the attack back to its source?', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Evil Corp\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"malware analysis\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 7, '2026-01-03 00:49:14', 'Evil Corp Ransomware Negotiation and Decryption Challenge', 'Engage in simulated ransomware negotiation and decryption against Evil Corp in this advanced cybersecurity training scenario.', 'operation-wasted-locker', 1),
(15, 'Operation Soft Cell', 'Gallium (Soft Cell)', 'Beginner-level scenario to detect and remediate Gallium APT\'s long-term intrusion in telecoms capturing call records.', 'In this training scenario, participants will dive into the covert world of cyber espionage as they work to uncover and disrupt Gallium APT\'s intrusion into global telecommunications networks. The attackers are meticulously capturing Call Detail Records of high-value targets, using stealthy web shells and \'living off the land\' tactics to remain undetected. Trainees will learn to identify these threats and employ effective remediation strategies.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Gallium APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"telecommunications security\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"web shell detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cyber threat intelligence\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"call detail record\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-03 00:53:35', 'Gallium APT: Telecom Intrusion Detection Training', 'Beginner-level scenario to detect and remediate Gallium APT\'s long-term intrusion in telecoms capturing call records.', 'operation-soft-cell', 1),
(16, 'Operation Rabid Dog', 'MuddyWater (Static Kitten)', 'Uncover and mitigate MuddyWater\'s destructive wiper attack disguised as ransomware against a government agency.', 'In the heart of a bustling government agency, a seemingly routine email arrives, carrying a sinister payload. The notorious APT group MuddyWater, known for their cunning tactics, has launched a deceptive wiper attack, masquerading as ransomware. The operation requires the team to dissect the macro-enabled document that serves as the initial vector, analyze the embedded \'POWERSTATS\' backdoor, and extract critical forensic artifacts before the destructive wiping logic can execute. The race against the clock is on, as every second counts in preventing irreversible damage.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"MuddyWater\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"wiper attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 10, '2026-01-03 23:50:48', 'MuddyWater\'s Deceptive Wiper Attack on Government Infrastructure', 'Uncover and mitigate MuddyWater\'s destructive wiper attack disguised as ransomware against a government agency.', 'operation-rabid-dog', 1),
(17, 'Operation Horizon', 'APT1 ', 'Engage in a beginner-friendly cyber operation simulation featuring APT1\'s well-known tactics and techniques.', 'In this training scenario, participants will dive into a simulated cyber espionage operation orchestrated by the notorious APT1 group. Known for its sophisticated attacks and persistence, APT1 has launched a new campaign targeting a fictional global manufacturing company. Trainees will navigate through realistic alerts to identify and mitigate threats, gaining insights into APT1\'s tactics, techniques, and procedures (TTPs) as they progress through the attack lifecycle.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT1 operation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"beginner cyber scenario\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"threat intelligence\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cyber espionage\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 00:58:38', 'APT1 Cyber Espionage Scenario: Beginner\'s Threat Simulation', 'Engage in a beginner-friendly cyber operation simulation featuring APT1\'s well-known tactics and techniques.', 'operation-horizon', 1),
(18, 'Operation Gothic Panda', 'APT3 (Gothic Panda)', 'Train to counter APT3\'s sophisticated cyberattack, simulating their known TTPs in a realistic, intermediate-level scenario.', 'In this scenario, your organization is targeted by APT3, also known as Gothic Panda, a notorious cyber espionage group. Known for their sophisticated techniques and extensive resource access, APT3 has set its sights on exfiltrating your company\'s sensitive data. Your mission is to navigate through a series of alerts, utilizing threat intelligence and defensive strategies to thwart their multi-stage infiltration attempt.', 'Intermediate', 0, 1, 1, 60, NULL, '\"[]\"', '', 5, '2026-01-04 02:06:57', 'Defend Against Gothic Panda\'s Multi-Stage Infiltration', 'Train to counter APT3\'s sophisticated cyberattack, simulating their known TTPs in a realistic, intermediate-level scenario.', 'operation-gothic-panda', 1),
(19, 'Operation Red Apollo', 'APT10 (MenuPass)', 'Explore APT10\'s DLL side-loading techniques in a complex aerospace sector espionage campaign.', 'In the ever-evolving landscape of cyber threats, APT10, also known as MenuPass, has launched a sophisticated espionage campaign targeting the aerospace industry. Leveraging DLL side-loading techniques, the threat actors aim to infiltrate, persist, and exfiltrate critical intellectual property, including large CAD files, to gain a competitive edge in aerospace technology.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"APT10\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DLL Side-Loading\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Aerospace Espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Intellectual Property Theft\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 7, '2026-01-04 02:13:24', 'APT10\'s Aerospace Espionage - DLL Side-Loading Tactics', 'Explore APT10\'s DLL side-loading techniques in a complex aerospace sector espionage campaign.', 'operation-red-apollo', 1),
(20, 'Operation Whitefly', 'Whitefly (Singapore-based?)', 'Investigate Whitefly APT\'s breach using Vcrodat malware in the healthcare sector, focusing on persistence and compromised open-source tools.', 'In this advanced scenario, analysts are tasked with investigating a sophisticated breach within the healthcare and materials science sectors. The notorious Whitefly APT group has employed their custom Vcrodat malware to maintain persistence while cleverly blending their malicious activities with legitimate developer behaviors by compromising open-source tools. Participants will need to piece together clues from multiple alerts to unravel the attackers\' tactics, techniques, and procedures.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Whitefly APT\\\\\\\",\\\\\\\"Vcrodat malware\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"healthcare breach\\\\\\\",\\\\\\\"open-source compromise\\\\\\\"]\\\"\"', '', 7, '2026-01-04 02:14:54', 'Advanced Breach Investigation: Whitefly APT in Healthcare', 'Investigate Whitefly APT\'s breach using Vcrodat malware in the healthcare sector, focusing on persistence and compromised open-source tools.', 'operation-whitefly', 1),
(21, 'Operation Silent Shield', 'Kimsuky (Velvet Chollima)', 'Explore Kimsuky\'s use of malicious browser extensions and BabyShark malware in a targeted spear-phishing campaign.', 'In a rapidly evolving cyber landscape, the global think tank specializing in nuclear policy finds itself under siege. The notorious APT group Kimsuky, known for its advanced tactics, has launched a spear-phishing campaign employing malicious browser extensions and the insidious BabyShark malware. As a beginner analyst, your mission is to unravel the layers of this attack, tracing each step from initial access to data exfiltration, and fortifying defenses against future threats.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Kimsuky APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"spear-phishing\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"BabyShark malware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"nuclear policy\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 02:18:07', 'Kimsuky Spear-Phishing Tactics Against Nuclear Policy Think Tanks', 'Explore Kimsuky\'s use of malicious browser extensions and BabyShark malware in a targeted spear-phishing campaign.', 'operation-silent-shield', 1),
(22, 'Operation Double Dragon', 'APT41 (Double Dragon)', 'Investigate APT41\'s dual-mode operation targeting gaming source code and PII for espionage.', 'In this advanced training scenario, participants will track APT41, a notorious cyber threat actor known for conducting both state-sponsored espionage and financially-motivated attacks. The operation begins with the theft of strategic game source code for profit and pivots to a more sinister goal: accessing databases containing citizens\' PII. As they unravel this complex operation, participants will navigate through sophisticated supply chain attacks and lateral movements emblematic of APT41\'s tactics, techniques, and procedures.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"APT41\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cyber Espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Gaming Industry\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Supply Chain Attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"PII Theft\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 02:21:13', 'APT41: Dual-Mode Cyber Operation Training', 'Investigate APT41\'s dual-mode operation targeting gaming source code and PII for espionage.', 'operation-double-dragon', 1),
(23, 'Operation Red Echo', 'APT41 / RedEcho', 'Engage with APT41 tactics in Operation Red Echo, a realistic cyber defense scenario for intermediate analysts.', 'In this immersive training scenario, participants are tasked with defending a fictional telecom company under siege by the notorious APT41, known as RedEcho. This advanced persistent threat group, originating from China, has launched a multi-vector attack, leveraging their expertise in supply chain compromises and ransomware to infiltrate the company\'s network. Your mission is to detect, analyze, and mitigate the threats as they unfold in a five-step attack sequence. Can you thwart RedEcho\'s espionage and financial motives before critical data is exfiltrated?', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT41\\\\\\\",\\\\\\\"RedEcho\\\\\\\",\\\\\\\"Cyber Defense Training\\\\\\\",\\\\\\\"Intermediate Cybersecurity\\\\\\\",\\\\\\\"Supply Chain Attack\\\\\\\"]\\\"\"', '', 5, '2026-01-04 04:11:04', 'Operation Red Echo: Intermediate Cyber Defense Training', 'Engage with APT41 tactics in Operation Red Echo, a realistic cyber defense scenario for intermediate analysts.', 'operation-red-echo', 1),
(24, 'Operation Pipeline Shut', 'DarkSide', 'Learn to defend against DarkSide with this beginner operation: Pipeline Shut, designed for cybersecurity training.', 'In the wake of increasing cyber threats, DarkSide has targeted a major energy pipeline. As part of the security team, you must identify and mitigate their efforts. This operation will take you through the critical stages of an attack, from initial access to data exfiltration.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"DarkSide\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"pipeline security\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"beginner threat detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:13:17', 'Operation Pipeline Shut: Training Scenario Against DarkSide', 'Learn to defend against DarkSide with this beginner operation: Pipeline Shut, designed for cybersecurity training.', 'operation-pipeline-shut', 1),
(25, 'Operation Kinetic Strike', 'REvil (Sodinokibi)', 'Intermediate cybersecurity operation simulating REvil\'s tactics for effective threat response training.', 'In the wake of escalating ransomware attacks, Operation Kinetic Strike challenges your cybersecurity team to defend against REvil, a notorious APT group. Your mission is to detect and mitigate their attack as they compromise a fictional corporation\'s network. Stay vigilant as REvil employs sophisticated techniques in a bid to encrypt sensitive data and demand a hefty ransom.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"REvil Ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT Group Simulation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Threat Detection\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Ransomware Defense\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:24:42', 'Operation Kinetic Strike: REvil Ransomware Simulation', 'Intermediate cybersecurity operation simulating REvil\'s tactics for effective threat response training.', 'operation-kinetic-strike', 1),
(26, 'Operation File Transfer', 'Cl0p (TA505)', 'Engage in an advanced simulation against Cl0p (TA505), focusing on their sophisticated file transfer tactics.', 'In the midst of a bustling financial quarter, your organization receives a tip-off about Cl0p (TA505) targeting your infrastructure. This notorious APT group is known for their adeptness in exploiting network vulnerabilities for massive data exfiltration. As part of the cybersecurity team, you must thwart their Operation File Transfer before critical data falls into the wrong hands.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Cl0p APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"advanced threat simulation\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"file transfer security\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-04 04:37:17', 'Operation File Transfer: Cl0p\'s Advanced Tactics', 'Engage in an advanced simulation against Cl0p (TA505), focusing on their sophisticated file transfer tactics.', 'operation-file-transfer', 1),
(27, 'Operation Midnight Storm', 'Nobelium (Midnight Blizzard)', 'Train on detecting and mitigating Nobelium\'s cloud-based identity attacks targeting diplomatic entities.', 'In a world of escalating cyber threats, a new wave of attacks has emerged, targeting diplomatic entities through sophisticated cloud identity compromises. Nobelium, the notorious APT group linked to Russia\'s SVR, has launched a campaign using advanced techniques like password spraying and token theft to bypass MFA. Your mission is to investigate these breaches, uncover rogue OAuth applications, and secure the compromised systems.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Nobelium\\\",\\\"cloud security\\\",\\\"identity compromise\\\",\\\"APT29\\\",\\\"cybersecurity training\\\"]\"', '', 5, '2026-01-04 23:54:35', 'Nobelium Cloud Identity Compromise Simulation', 'Train on detecting and mitigating Nobelium\'s cloud-based identity attacks targeting diplomatic entities.', 'operation-midnight-storm', 1),
(28, 'Operation Volt Strike', 'Volt Typhoon', 'Train to detect Volt Typhoon\'s stealthy living off the land tactics using built-in Windows tools in critical infrastructure.', 'In the world of cyber espionage, stealth is paramount. Volt Typhoon, a notorious APT group, has launched a covert operation targeting critical infrastructure sectors. Their modus operandi: blending in with legitimate administrative activity using only native Windows tools. As a cybersecurity analyst, your mission is to uncover this clandestine campaign, piecing together subtle clues that reveal their presence. Can you follow the trail and mitigate the threat before it\'s too late?', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Volt Typhoon\\\",\\\"cybersecurity training\\\",\\\"LOLBins\\\",\\\"critical infrastructure\\\",\\\"advanced threat detection\\\"]\"', '', 5, '2026-01-04 23:56:24', 'Advanced Detection of LOLBins in Critical Infrastructure by Volt Typhoon', 'Train to detect Volt Typhoon\'s stealthy living off the land tactics using built-in Windows tools in critical infrastructure.', 'operation-volt-strike', 1),
(29, 'Operation Charming Charter', 'Charming Kitten (Phosphorus)', 'Analyze Charming Kitten\'s social engineering campaign targeting journalists via WhatsApp and email using DownPaper backdoor.', 'In recent months, the notorious APT group Charming Kitten has intensified its operations, targeting journalists and human rights activists. Using social engineering tactics via WhatsApp and email, they aim to infiltrate networks and extract sensitive information. This operation focuses on analyzing the DownPaper backdoor and the credential harvesting tactics disguised as legitimate interview requests.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Charming Kitten\\\\\\\",\\\\\\\"social engineering\\\\\\\",\\\\\\\"DownPaper\\\\\\\",\\\\\\\"credential harvesting\\\\\\\"]\\\"\"', '', 5, '2026-01-04 23:58:37', 'Charming Kitten Social Engineering and DownPaper Analysis', 'Analyze Charming Kitten\'s social engineering campaign targeting journalists via WhatsApp and email using DownPaper backdoor.', 'operation-charming-charter', 1),
(30, 'Operation Fox Hunt', 'Fox Kitten', 'Experience Fox Kitten\'s APT exploitation of VPN concentrators to infiltrate and compromise domain controllers.', 'In this scenario, the notorious Fox Kitten APT group targets unpatched VPN concentrators, swiftly penetrating corporate networks. Once inside, they rapidly deploy web shells and move laterally to compromise the domain controller, dumping critical credentials and paving the way for further exploitation. Participants must identify and neutralize the threat to protect sensitive enterprise environments.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Fox Kitten\\\\\\\",\\\\\\\"VPN Exploit\\\\\\\",\\\\\\\"Domain Controller\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\",\\\\\\\"APT\\\\\\\"]\\\"\"', '', 7, '2026-01-05 00:00:59', 'Fox Kitten\'s VPN Exploit and Domain Controller Breach', 'Experience Fox Kitten\'s APT exploitation of VPN concentrators to infiltrate and compromise domain controllers.', 'operation-fox-hunt', 1),
(33, 'Operation Swipe Left', 'FIN6', 'Investigate a breach by FIN6 using Trinity malware to scrape credit card data from a retail giant\'s POS network.', 'In this intermediate-level training scenario, participants will dive into a high-stakes breach investigation involving the notorious cybercrime group FIN6. The group has infiltrated a leading retail company\'s Point-of-Sale (POS) network using compromised vendor credentials. Their goal? To deploy the insidious \'Trinity\' malware, designed to scrape sensitive credit card data directly from RAM before it can be encrypted. As the investigation unfolds, you must trace their steps through the network, piece together the attack sequence, and mitigate the damage.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"FIN6\\\",\\\"Trinity malware\\\",\\\"POS network breach\\\",\\\"cybersecurity training\\\",\\\"credit card data\\\"]\"', '', 5, '2026-01-05 00:09:23', 'FIN6 Breach Simulation: Uncovering Trinity Malware in Retail POS Network', 'Investigate a breach by FIN6 using Trinity malware to scrape credit card data from a retail giant\'s POS network.', 'operation-swipe-left', 1),
(32, 'Operation Cart Skimmer', 'Magecart (Group 12)', 'Experience an intermediate-level Magecart attack scenario with digital skimming and data exfiltration analysis.', 'In this scenario, participants are tasked with analyzing a sophisticated digital skimming attack orchestrated by Magecart Group 12. The attack targets the checkout pages of numerous online stores through a compromised third-party advertising library. Participants will uncover obfuscated JavaScript code and trace the exfiltrated data to an external drop server, simulating real-world cybersecurity challenges.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Magecart\\\",\\\"digital skimming\\\",\\\"cybersecurity training\\\",\\\"JavaScript analysis\\\",\\\"data exfiltration\\\"]\"', '', 3, '2026-01-05 00:06:31', 'Magecart Digital Skimming Attack Simulation', 'Experience an intermediate-level Magecart attack scenario with digital skimming and data exfiltration analysis.', 'operation-cart-skimmer', 1),
(34, 'Operation Primitive Bear', 'Gamaredon (Shuckworm)', 'Simulate a Gamaredon cyber-espionage campaign targeting military personnel with weaponized Word documents and VBScript backdoors.', 'In this training scenario, participants will navigate a simulated cyber-espionage campaign orchestrated by the notorious APT group, Gamaredon, also known as Shuckworm. The operation centers around a high-volume attack targeting military personnel using weaponized Word documents. Trainees will delve into how these documents leverage template injection techniques and incorporate custom VBScript backdoors to facilitate rapid data theft. This exercise will enhance understanding of how such threats manifest in real-world scenarios and prepare analysts to identify and mitigate similar threats.', 'beginner', 0, 1, 0, 60, NULL, '\"[\\\"Gamaredon\\\",\\\"cyber-espionage\\\",\\\"Word document injection\\\",\\\"VBScript backdoor\\\",\\\"military cybersecurity\\\"]\"', '', 3, '2026-01-05 02:58:53', 'Gamaredon Espionage Simulation: Weaponized Word Docs & VBScript Backdoors', 'Simulate a Gamaredon cyber-espionage campaign targeting military personnel with weaponized Word documents and VBScript backdoors.', 'operation-primitive-bear', 1),
(35, 'Operation Energy Bear', 'Dragonfly (Energetic Bear)', 'Simulate Dragonfly\'s strategic intrusion in the energy sector using trojanized ICS software updates.', 'In this scenario, the notorious Dragonfly APT group, also known as Energetic Bear, targets the energy sector by infiltrating the supply chain. The attackers have trojanized legitimate software updates for industrial control systems (ICS) equipment. This operation will train participants to identify the \'Havex\' RAT and trace the network reconnaissance activities within an industrial control network, enhancing their skills in defending critical infrastructure.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Dragonfly APT\\\\\\\",\\\\\\\"ICS security\\\\\\\",\\\\\\\"Havex RAT\\\\\\\",\\\\\\\"cyber threat intelligence\\\\\\\",\\\\\\\"supply chain attack\\\\\\\"]\\\"\"', '', 5, '2026-01-05 03:01:44', 'Dragonfly\'s ICS Supply Chain Attack Simulation', 'Simulate Dragonfly\'s strategic intrusion in the energy sector using trojanized ICS software updates.', 'operation-energy-bear', 1),
(36, 'Operation Hotel Guest', 'DarkHotel', 'Advanced scenario: DarkHotel targets luxury hotel executives via Wi-Fi, delivering Tapaoux malware disguised as updates.', 'In a high-stakes cyber operation, the notorious APT group DarkHotel has launched a precision spear-phishing campaign targeting executives staying at luxury hotels. Leveraging the hotel\'s Wi-Fi network, they deliver sophisticated, signed malware disguised as software updates. Trainees will analyze the Tapaoux malware and investigate certificate spoofing tactics used by the attackers to compromise their high-profile targets.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"DarkHotel\\\\\\\",\\\\\\\"spear-phishing\\\\\\\",\\\\\\\"Tapaoux malware\\\\\\\",\\\\\\\"certificate spoofing\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\"]\\\"\"', '', 5, '2026-01-05 03:03:57', 'DarkHotel Spear-Phishing Attack on Luxury Hotel Executives', 'Advanced scenario: DarkHotel targets luxury hotel executives via Wi-Fi, delivering Tapaoux malware disguised as updates.', 'operation-hotel-guest', 1),
(37, 'Operation Sea Lotus', 'Naikon', 'Investigate Naikon\'s espionage using RoyalRoad and Aria-body in a South China Sea cyber operation.', 'In the geopolitical hotspot of the South China Sea, a sophisticated threat actor, Naikon, has launched a stealthy cyber espionage campaign. Using the RoyalRoad RTF weaponizer, they deliver the Aria-body backdoor, gaining access to sensitive information. This operation requires you to meticulously analyze alerts, trace the attack path, and uncover the command and control infrastructure disguised as legitimate government domains. Your mission is to dismantle this campaign and safeguard regional cybersecurity.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Naikon APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"RoyalRoad exploit\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Aria-body backdoor\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Espionage campaign\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity training\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-05 03:07:33', 'South China Sea Espionage: Uncovering Naikon\'s RoyalRoad Exploit', 'Investigate Naikon\'s espionage using RoyalRoad and Aria-body in a South China Sea cyber operation.', 'operation-sea-lotus', 1),
(39, 'Operation Ghost Writer', 'UNC1151', 'Train on UNC1151\'s tactics in hacking news sites to spread misinformation, from CMS breaches to social media manipulation.', 'In this training scenario, participants will dive into the world of cyber-influence operations orchestrated by UNC1151. This APT group has targeted popular news websites, compromising their CMS accounts to publish false narratives. As the fabricated stories spread, a coordinated effort on social media amplifies the misinformation, challenging trainees to trace the attack and mitigate its impact.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"UNC1151\\\",\\\"cyber-influence\\\",\\\"APT training\\\",\\\"media manipulation\\\",\\\"CMS hacking\\\"]\"', '', 5, '2026-01-05 03:21:54', 'UNC1151\'s Media Manipulation: A Cyber-Influence Training Scenario', 'Train on UNC1151\'s tactics in hacking news sites to spread misinformation, from CMS breaches to social media manipulation.', 'operation-ghost-writer', 1),
(40, 'Operation Wicked Game', 'APT41 (Wicked Panda)', 'Experience an advanced simulation of APT41\'s supply chain attack on the gaming industry, featuring the ShadowPad payload.', 'In this high-stakes training scenario, participants will delve into a sophisticated supply chain attack orchestrated by APT41, a notorious cyber threat group from China. The operation focuses on the gaming industry, where attackers have infiltrated the build environment of a popular game to inject a malicious backdoor, known as ShadowPad, into the game\'s executable. This backdoor is then distributed to millions of unsuspecting players, setting the stage for a widespread cybersecurity breach. Trainees must navigate through a series of alerts to uncover the full scope of the attack and neutralize the threat.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Supply Chain Attack\\\",\\\"APT41\\\",\\\"ShadowPad\\\",\\\"Cybersecurity Training\\\",\\\"Gaming Industry\\\"]\"', '', 5, '2026-01-05 03:25:53', 'Advanced Supply Chain Attack Simulation with APT41', 'Experience an advanced simulation of APT41\'s supply chain attack on the gaming industry, featuring the ShadowPad payload.', 'operation-wicked-game', 1),
(41, 'Operation Heavy Anchor', 'Lazarus (Andariel)', 'Advanced training scenario exploring Lazarus Group\'s cyber-attack on South Korean defense firms to steal sensitive tank and laser weapon designs.', 'In a high-stakes cyber espionage campaign, the notorious Lazarus Group, specifically its Andariel sub-group, has set its sights on the South Korean defense industrial base. Their objective: to infiltrate and exfiltrate sensitive schematics of cutting-edge tank and laser weaponry. Utilizing their signature DTrack malware, the attackers employ a sophisticated kill chain to breach defenses, maintain persistence, and ultimately achieve their goal of intelligence theft.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"DTrack malware\\\\\\\",\\\\\\\"cyber espionage\\\\\\\",\\\\\\\"defense industrial base\\\\\\\",\\\\\\\"APT\\\\\\\"]\\\"\"', '', 5, '2026-01-05 04:00:31', 'Operation Stealth Blueprint: Lazarus Group Targeting Defense Secrets', 'Advanced training scenario exploring Lazarus Group\'s cyber-attack on South Korean defense firms to steal sensitive tank and laser weapon designs.', 'operation-heavy-anchor', 1),
(42, 'Operation Kitty Corner', 'CopyKittens', 'Train to counter CopyKittens\' Matryoshka RAT targeting foreign affairs via DNS tunneling.', 'In this scenario, participants will engage in a simulated espionage campaign orchestrated by the notorious APT group, CopyKittens. The group has set its sights on Ministries of Foreign Affairs, deploying their infamous \'Matryoshka\' RAT to infiltrate and exfiltrate sensitive governmental documents. Participants must decode encrypted DNS traffic to thwart the attackers and secure critical intelligence.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"CopyKittens\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Matryoshka RAT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DNS tunneling\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"espionage\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-05 04:02:16', 'Operation Matryoshka: CopyKittens Espionage Drill', 'Train to counter CopyKittens\' Matryoshka RAT targeting foreign affairs via DNS tunneling.', 'operation-kitty-corner', 1),
(43, 'Operation Rocket Man', 'Rocket Kitten', 'Simulate and analyze Rocket Kitten\'s tactics targeting aerospace firms using \'Gholee\' malware and fake personas.', 'In a world where every byte of data can shape destinies, Rocket Kitten, a notorious APT group, sets its sights on the aerospace industry. Utilizing their infamous \'Gholee\' malware and deceptive social engineering via fake Facebook profiles, they embark on a mission to infiltrate, persist, and exfiltrate critical data. Trainees, prepare to navigate through a web of deceit and cybersecurity challenges.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Rocket Kitten\\\",\\\"Gholee malware\\\",\\\"cybersecurity training\\\",\\\"APT simulation\\\",\\\"aerospace security\\\"]\"', '', 6, '2026-01-06 01:22:55', 'Rocket Kitten\'s Aerospace Intrusion Simulation', 'Simulate and analyze Rocket Kitten\'s tactics targeting aerospace firms using \'Gholee\' malware and fake personas.', 'operation-rocket-man', 1),
(44, 'Operation Jolly Roger', 'Lazarus (WannaCry)', 'Engage in an advanced cybersecurity scenario analyzing the SMB propagation of WannaCry via EternalBlue.', 'In May 2017, the world witnessed a massive ransomware outbreak known as WannaCry, orchestrated by the notorious Lazarus APT group. Exploiting the EternalBlue vulnerability in Microsoft SMB protocol, the ransomware spread rapidly, causing widespread panic and disruption. As a senior cyber threat intelligence analyst, your mission is to dissect this attack, understanding its propagation mechanics, identifying potential kill-switch domains, and determining if decryption is possible without succumbing to ransom demands.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"WannaCry\\\\\\\",\\\\\\\"EternalBlue\\\\\\\",\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"Ransomware\\\\\\\",\\\\\\\"Cybersecurity Training\\\\\\\"]\\\"\"', '', 8, '2026-01-06 01:32:21', 'Global Ransomware Outbreak Simulation: Analyzing EternalBlue and WannaCry', 'Engage in an advanced cybersecurity scenario analyzing the SMB propagation of WannaCry via EternalBlue.', 'operation-jolly-roger', 1),
(45, 'Operation Blackout', 'Sandworm (NotPetya)', 'Train to identify Sandworm\'s wiper attack masquerading as ransomware via compromised software updates.', 'In this beginner-level training scenario, you\'ll confront a cyber attack orchestrated by the notorious Sandworm group. Disguised as ransomware, the attack spreads through a compromised update of an accounting software, aiming to destroy data and disrupt operations. Participants will learn to identify the master boot record (MBR) overwriting behavior and the use of Mimikatz to harvest credentials, facilitating rapid lateral movement across networks.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sandworm\\\\\\\",\\\\\\\"wiper attack\\\\\\\",\\\\\\\"NotPetya\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"ransomware disguise\\\\\\\"]\\\"\"', '', 5, '2026-01-06 01:35:52', 'Sandworm\'s Ransomware Disguise: MBR Wiper Attack', 'Train to identify Sandworm\'s wiper attack masquerading as ransomware via compromised software updates.', 'operation-blackout', 1),
(46, 'Operation Bad Rabbit', 'Callisto Group? (Unattributed)', 'Investigate Callisto Group\'s ransomware drive-by download attack using fake Adobe Flash updates and analyze the DiskCryptor ransomware code.', 'In a rapidly evolving digital landscape, the Callisto Group has launched a sophisticated ransomware campaign. Utilizing compromised news sites as a vector, unsuspecting users are lured into downloading fake Adobe Flash updates. Once executed, the payload encrypts the victim\'s hard drive using DiskCryptor and propagates through networks via SMB, demanding a hefty ransom. This scenario will take participants through a realistic threat investigation to dissect the attack\'s stages.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"ransomware\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"cybersecurity training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"drive-by download\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"DiskCryptor\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 5, '2026-01-06 01:38:27', 'Analyzing Callisto Group\'s Ransomware via Fake Adobe Updates', 'Investigate Callisto Group\'s ransomware drive-by download attack using fake Adobe Flash updates and analyze the DiskCryptor ransomware code.', 'operation-bad-rabbit', 1),
(47, 'Operation False Flag', 'Sandworm (Olympic Destroyer)', 'Investigate a Sandworm cyberattack disrupting a major sporting event, uncovering false flags and true attribution.', 'As the world gathers to witness the grandeur of a major sporting event\'s opening ceremony, chaos ensues as an unexpected cyberattack disrupts the celebration. The attack, attributed to the notorious Sandworm group, carries false flags pointing towards other nations. Participants will deconstruct the malware to trace its true origins, drawing parallels to Sandworm\'s previous operations. This exercise will test your skills in attribution and understanding of advanced persistent threats.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sandworm\\\\\\\",\\\\\\\"Olympic Destroyer\\\\\\\",\\\\\\\"cyberattack\\\\\\\",\\\\\\\"malware analysis\\\\\\\",\\\\\\\"APT Group\\\\\\\"]\\\"\"', '', 5, '2026-01-06 01:43:17', 'Sandworm Cyberattack: Unveiling the Olympic Ceremony Disruption', 'Investigate a Sandworm cyberattack disrupting a major sporting event, uncovering false flags and true attribution.', 'operation-false-flag', 1),
(48, 'Operation Shadow Hammer', 'Barium (Winnti)', 'Investigate a sophisticated supply chain attack that compromised the ASUS Live Update utility, targeting specific MAC addresses.', 'In an unprecedented cyber offensive, APT41, also known as Barium, launched a surgical strike within a mass infection by compromising the ASUS Live Update utility. This operation, dubbed \'Shadow Strike\', saw the deployment of malware targeting specific MAC addresses, revealing a calculated and highly selective attack amidst a sea of potential victims. Trainees must navigate through this complex landscape to uncover the true objectives and mitigate the threats posed by this advanced persistent threat group.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"\\\\\\\"[\\\\\\\\\\\\\\\"Supply Chain Attack\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"APT41\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"ASUS Live Update\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Cybersecurity Training\\\\\\\\\\\\\\\",\\\\\\\\\\\\\\\"Barium\\\\\\\\\\\\\\\"]\\\\\\\"\\\"\"', '', 8, '2026-01-06 02:34:49', 'Operation Shadow Strike: The ASUS Supply Chain Breach', 'Investigate a sophisticated supply chain attack that compromised the ASUS Live Update utility, targeting specific MAC addresses.', 'operation-shadow-hammer', 1),
(49, 'Operation Cloud Atlas', 'Inception', 'Train on detecting Inception APT\'s Cloud Atlas malware targeting Eastern European diplomats.', 'In the heart of Eastern Europe, diplomatic entities face a sophisticated threat. The Inception APT group, known for its high-level espionage capabilities, launches a campaign using the elusive Cloud Atlas malware. Leveraging popular cloud storage services, they aim to infiltrate and extract sensitive information while evading detection. As a cybersecurity analyst, you are tasked with unraveling their tactics and protecting critical diplomatic communications.', 'beginner', 0, 1, 1, 60, NULL, '\"[\\\"cybersecurity training\\\",\\\"APT Inception\\\",\\\"Cloud Atlas malware\\\",\\\"espionage campaign\\\",\\\"Eastern Europe\\\"]\"', '', 3, '2026-01-07 22:28:11', 'Inception APT: Espionage in Eastern Europe', 'Train on detecting Inception APT\'s Cloud Atlas malware targeting Eastern European diplomats.', 'operation-cloud-atlas', 1),
(50, 'Operation Red October', 'Rocra', 'Analyze Rocra\'s malware in a cyber-espionage campaign targeting diplomatic and research sectors.', 'In the shadows of international diplomacy and scientific innovation, a silent threat emerges. Rocra, an advanced persistent threat group, launches a massive cyber-espionage campaign targeting diplomatic, governmental, and scientific research organizations. The objective: to pilfer sensitive, encrypted information and recover deleted data from unsuspecting victims\' USB drives. Trainees must navigate this intricate operation, uncover the Rocra malware framework, and counteract its espionage tactics.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Rocra\\\",\\\"cyber-espionage\\\",\\\"APT\\\",\\\"malware analysis\\\",\\\"data exfiltration\\\"]\"', '', 5, '2026-01-07 22:28:37', 'Operation Red October: Unveiling Rocra\'s Cyber-Espionage Tactics', 'Analyze Rocra\'s malware in a cyber-espionage campaign targeting diplomatic and research sectors.', 'operation-red-october', 1),
(51, 'Operation Flame', 'Equation Group', 'Analyze Equation Group\'s sophisticated malware in the Middle East using MD5 collisions and espionage modules.', 'In the dimly lit corridors of cyberspace, the Equation Group has unleashed a sophisticated malware platform targeting Middle Eastern entities. This scenario requires you to dissect intricate modules for audio recording, Bluetooth sniffing, and screen capture, while unraveling the mystery of MD5 collision attacks used to sign their malware. As tensions rise, your mission is to trace the attackers\' steps, analyze their tactics, and neutralize the threat before critical data is exfiltrated.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Equation Group\\\\\\\",\\\\\\\"cyber-espionage\\\\\\\",\\\\\\\"malware analysis\\\\\\\",\\\\\\\"MD5 collision\\\\\\\",\\\\\\\"Middle East\\\\\\\"]\\\"\"', '', 5, '2026-01-07 22:31:17', 'Unraveling Equation Group\'s Espionage: A Deep Dive into Advanced Malware Tactics', 'Analyze Equation Group\'s sophisticated malware in the Middle East using MD5 collisions and espionage modules.', 'operation-flame', 1);
INSERT INTO `operations` (`id`, `title`, `apt_group`, `description`, `story_intro`, `difficulty_level`, `display_order`, `is_active`, `is_premium`, `passing_grade`, `time_limit_hours`, `tags`, `scenario_prompt`, `total_alerts`, `created_at`, `seo_title`, `seo_description`, `slug`, `min_level`) VALUES
(52, 'Operation Centrifuge Saboteur', 'Equation Group (Stuxnet)', 'Investigate a PLC rootkit by Equation Group causing physical damage to industrial systems.', 'Amidst rising geopolitical tensions, a covert cyber-weapon has been unleashed on critical infrastructure. The Equation Group, with its sophisticated arsenal, has deployed a rootkit targeting industrial PLCs. Your mission is to unravel this operation\'s intricacies, uncovering the plot that manipulates centrifuges while deceiving monitoring systems, ultimately leading to physical sabotage.', 'intermediate', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"cyber-weapon\\\\\\\",\\\\\\\"industrial control systems\\\\\\\",\\\\\\\"PLC rootkit\\\\\\\",\\\\\\\"Equation Group\\\\\\\",\\\\\\\"Stuxnet\\\\\\\"]\\\"\"', '', 5, '2026-01-07 22:33:37', 'Operation Centrifuge Saboteur', 'Investigate a PLC rootkit by Equation Group causing physical damage to industrial systems.', 'operation-centrifuge-saboteur', 1),
(53, 'Operation Sunburst', 'APT29 (Cozy Bear / Nobelium)', 'Analyze the SolarWinds attack by APT29, focusing on the SUNBURST backdoor and C2 techniques.', 'In December 2020, one of the most sophisticated cyber espionage operations in history was uncovered. APT29, a cyber threat group linked to Russia\'s Foreign Intelligence Service, infiltrated the software supply chain of SolarWinds. By injecting a backdoor known as SUNBURST into an Orion software update, they gained access to multiple high-value targets, including government agencies. This training scenario will guide you through the investigation of this complex supply chain attack, exploring the domain generation algorithm used for command and control, and the second-stage payloads deployed to compromise sensitive networks.', 'advanced', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"APT29\\\\\\\",\\\\\\\"SolarWinds\\\\\\\",\\\\\\\"Cyber Espionage\\\\\\\",\\\\\\\"Supply Chain Attack\\\\\\\",\\\\\\\"SUNBURST\\\\\\\"]\\\"\"', '', 8, '2026-01-07 22:37:57', 'Advanced Cybersecurity Training: APT29\'s SolarWinds Supply Chain Attack', 'Analyze the SolarWinds attack by APT29, focusing on the SUNBURST backdoor and C2 techniques.', 'operation-sunburst', 1),
(54, 'Operation Sony Spectacle', 'Lazarus Group (North Korea)', 'Beginner-level training on the Sony Pictures hack by Lazarus Group, focusing on Destover malware analysis and data exfiltration tracing.', 'In 2014, the entertainment industry was rocked by a devastating cyberattack on Sony Pictures, attributed to the notorious Lazarus Group. This training scenario invites you to step into the shoes of a cybersecurity analyst, dissecting the infamous attack. You\'ll analyze the destructive \'Destover\' wiper malware, trace complex proxy chains used for data exfiltration, and delve into the geopolitical motivations that drove this high-profile breach.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Sony Pictures hack\\\\\\\",\\\\\\\"Lazarus Group\\\\\\\",\\\\\\\"Destover malware\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"beginner\\\\\\\"]\\\"\"', '', 7, '2026-01-07 22:38:59', 'Cybersecurity Training: Analyzing the Sony Pictures Hack by Lazarus Group', 'Beginner-level training on the Sony Pictures hack by Lazarus Group, focusing on Destover malware analysis and data exfiltration tracing.', 'operation-sony-spectacle', 1),
(55, 'Operation Bullseye', 'FIN7 / Anunak', 'Investigate the FIN7 APT Target breach, tracing from HVAC vendor compromise to POS malware and payment network infiltration.', 'During the bustling holiday season, a major retail chain, Target, fell victim to an orchestrated cyberattack. This operation simulates the breach orchestrated by the notorious FIN7 group, also known as Anunak, which led to the compromise of 40 million credit cards. Participants will follow the trail from an unsuspecting HVAC vendor compromise to sophisticated RAM-scraping malware infiltrating POS systems and finally, uncover the lateral movements within the payment network.', 'beginner', 0, 1, 1, 60, NULL, '\"\\\"[\\\\\\\"Target breach\\\\\\\",\\\\\\\"FIN7\\\\\\\",\\\\\\\"cybersecurity training\\\\\\\",\\\\\\\"APT\\\\\\\",\\\\\\\"POS malware\\\\\\\"]\\\"\"', '', 5, '2026-01-08 21:59:26', 'FIN7\'s Retail Breach: Uncovering the Target Holiday Heist', 'Investigate the FIN7 APT Target breach, tracing from HVAC vendor compromise to POS malware and payment network infiltration.', 'operation-bullseye', 1),
(56, 'Operation Credit Bureau', 'Chinese State-Sponsored (Unattributed)', 'Train on responding to the Equifax breach; analyze Apache Struts exploitation and persistence tactics.', 'In 2017, Equifax faced a catastrophic data breach, exposing 147 million Americans\' personal data. This scenario immerses you in the incident response team tasked with analyzing and mitigating the attack. You will navigate through the exploitation of Apache Struts vulnerability CVE-2017-5638, uncover the undetected dwell time, and understand the persistence mechanisms employed by a Chinese state-sponsored APT group.', 'intermediate', 0, 1, 1, 60, NULL, '\"[\\\"Equifax breach\\\",\\\"Apache Struts\\\",\\\"CVE-2017-5638\\\",\\\"cybersecurity training\\\",\\\"APT\\\"]\"', '', 10, '2026-01-08 22:03:35', 'Operation Breach Analysis: Equifax 2017 Incident Response Training', 'Train on responding to the Equifax breach; analyze Apache Struts exploitation and persistence tactics.', 'operation-credit-bureau', 1),
(57, 'Operation Log4Chaos', 'Multiple (Chinese APTs, Ransomware Groups)', 'Advanced training on Log4Shell exploitation by Chinese APTs and ransomware groups. Analyze JNDI payloads and cryptominer deployments.', 'In late 2021, a critical vulnerability known as Log4Shell (CVE-2021-44228) began affecting millions of Java applications worldwide. As organizations scrambled to patch, Chinese APTs and ransomware groups initiated a mass exploitation campaign. Trainees will navigate through the chaotic landscape, analyzing JNDI injection payloads and cryptominer deployments while racing against time to defend critical systems.', 'advanced', 0, 1, 1, 60, NULL, '\"[\\\"Log4Shell\\\",\\\"APT\\\",\\\"Ransomware\\\",\\\"Cybersecurity Training\\\",\\\"JNDI Injection\\\"]\"', '', 5, '2026-01-08 22:08:03', 'Operation Log4Shell: APT and Ransomware Exploit Race', 'Advanced training on Log4Shell exploitation by Chinese APTs and ransomware groups. Analyze JNDI payloads and cryptominer deployments.', 'operation-log4chaos', 1),
(58, 'Operation MOVEit Mayhem', 'Cl0p (TA505)', 'Train on Cl0p\'s zero-day exploitation of MOVEit, focusing on SQL injection, mass data theft, and unique extortion tactics.', 'In this scenario, the notorious Cl0p group has discovered a zero-day vulnerability in the widely-used MOVEit file transfer platform. As organizations worldwide unknowingly expose sensitive data due to an SQL injection flaw, Cl0p orchestrates an unprecedented mass data theft. Uniquely, the group opts for a strategic extortion model, choosing not to deploy ransomware encryptors, challenging security teams to respond without the typical encryption-based clues.', 'intermediate', 0, 1, 0, 60, NULL, '\"[\\\"Cl0p\\\",\\\"Zero-Day Exploitation\\\",\\\"SQL Injection\\\",\\\"MOVEit Platform\\\",\\\"Cyber Extortion\\\"]\"', '', 5, '2026-01-08 22:11:08', 'Cl0p\'s Zero-Day Exploitation of MOVEit: A Cybersecurity Training Scenario', 'Train on Cl0p\'s zero-day exploitation of MOVEit, focusing on SQL injection, mass data theft, and unique extortion tactics.', 'operation-moveit-mayhem', 1),
(59, 'Operation Exchange Exploit: APTs and Ransomware', 'Multiple (Hafnium, LockBit, Conti)', 'Investigate APT and ransomware exploitation of Microsoft Exchange vulnerabilities for web shell deployment and privilege escalation.', 'In early 2021, Microsoft Exchange servers worldwide became prime targets due to critical vulnerabilities. These security gaps were rapidly weaponized by both state-sponsored APT groups like Hafnium and financially-motivated ransomware operators such as LockBit and Conti. Trainees will investigate the exploitation chain, from initial access to data exfiltration, understanding the threat landscape\'s complexity.', 'intermediate', 0, 1, 1, 60, NULL, '[\"Microsoft Exchange vulnerabilities\",\"APT groups\",\"ransomware\",\"cybersecurity training\",\"web shell\"]', NULL, 5, '2026-01-08 22:14:11', 'Operation Exchange Exploit: APTs and Ransomware', 'Investigate APT and ransomware exploitation of Microsoft Exchange vulnerabilities for web shell deployment and privilege escalation.', 'operation-proxyshell', 1);

-- --------------------------------------------------------

--
-- Table structure for table `operation_alerts`
--

CREATE TABLE `operation_alerts` (
  `id` int(11) NOT NULL,
  `operation_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `sequence_order` int(11) NOT NULL,
  `intel_report_title` varchar(255) DEFAULT NULL,
  `intel_report_content` text DEFAULT NULL,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `operation_alerts`
--

INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(1, 1, 268, 1, 'Investigative Report: Phishing Email Analysis', '### Overview\nThe initial alert in Operation Dark Current has detected a phishing email targeting employees at the power facility. The email contained a malicious attachment disguised as a routine internal document.\n\n### Findings\n- **Sender:** The email originated from a compromised external account known for past association with the Sandworm APT group.\n- **Attachment:** An Excel file with embedded macros designed to execute upon opening.\n- **Targets:** Key personnel within the corporate IT network.\n\n### Next Steps\nThis incident indicates the potential for malware deployment. Increased scrutiny on email attachments and network traffic is advised as the next phase of the attack may involve malware execution.', '2025-12-31 13:10:04'),
(2, 1, 269, 2, 'Malware Analysis: BlackEnergy Deployment', '### Overview\nFollowing the phishing incident, BlackEnergy malware has been executed within the corporate IT network. Analysis of this malware is crucial to understanding the attack vector and preventing further incidents.\n\n### Findings\n- **Functionality:** BlackEnergy is a versatile malware capable of launching DDoS attacks, stealing credentials, and deploying additional payloads.\n- **Indicators of Compromise:** Network traffic to known malicious IPs and unusual process creation on infected systems.\n\n### Next Steps\nDetection of persistence mechanisms is critical. Efforts should be focused on identifying registry changes or scheduled tasks that suggest the establishment of persistence within the network.', '2025-12-31 13:10:04'),
(3, 1, 270, 3, 'Persistence Mechanism Identified', '### Overview\nInvestigation reveals that the attackers have established persistence within the corporate IT environment, allowing them to maintain access even after system reboots.\n\n### Findings\n- **Techniques Used:** Modification of startup scripts and registry keys; scheduled tasks pointing to malicious scripts.\n- **Affected Systems:** Several key servers and workstations exhibit signs of compromise.\n\n### Next Steps\nAttention should now shift towards detecting and preventing lateral movement towards the Operational Technology (OT) network, as this is a likely next step for the attackers.', '2025-12-31 13:10:04'),
(4, 1, 271, 4, 'Lateral Movement Detected: OT Network Breach', '### Overview\nThe attackers have successfully moved laterally from the corporate IT network into the OT network, a critical phase in compromising the power grid\'s infrastructure.\n\n### Findings\n- **Methods:** Use of stolen credentials and exploitation of trusted connections between IT and OT networks.\n- **Compromised Components:** Initial access to the OT network has been confirmed on systems managing SCADA operations.\n\n### Next Steps\nImmediate action is required to contain and mitigate any potential SCADA system compromise. Focus should be on isolating affected systems and monitoring for execution attempts within the SCADA environment.', '2025-12-31 13:10:04'),
(5, 1, 272, 5, NULL, NULL, '2025-12-31 13:10:04'),
(6, 2, 274, 1, NULL, NULL, '2025-12-31 13:43:07'),
(7, 2, 275, 2, 'Analysis of Malicious Code Execution on Developer Systems', '# Malicious Code Execution on Developer Systems\n\n## Context\nFollowing the phishing attempts through weaponized job offers, the adversary has successfully executed malicious code on the targeted developer systems. This report analyzes the initial compromise and provides insights into the malware tactics used.\n\n## Key Findings\n- **Delivery Method**: The phishing emails contained attachments disguised as job descriptions, which, once opened, executed a macro to download a secondary payload.\n- **Payload Details**: The malware used is a variant of the Lazarus Group’s known toolkit, designed to evade traditional antivirus solutions and persist within compromised systems.\n- **Immediate Impact**: Initial indicators suggest that the malware is harvesting credentials and establishing communication with command-and-control (C2) servers.\n\n## Recommendations\n- **Immediate Actions**: Isolate affected systems and perform a full forensic analysis to identify all compromised endpoints.\n- **Preventive Measures**: Conduct security awareness training focusing on phishing detection and enforce strict email attachment policies.', '2025-12-31 13:43:07'),
(8, 2, 276, 3, 'Establishing Persistence and Lateral Movement within the Network', '# Establishing Persistence and Lateral Movement\n\n## Context\nPost-malicious code execution, the adversary is moving laterally within the network, aiming to establish persistence across multiple systems. This report delves into the techniques used by the Lazarus Group for lateral movement and persistence.\n\n## Key Findings\n- **Techniques Used**: The attackers are leveraging compromised credentials and exploiting existing vulnerabilities to move laterally within the organization’s network.\n- **Persistence Mechanisms**: The group is using scheduled tasks and registry modifications to maintain access to compromised systems.\n- **Targeted Assets**: Key systems identified include cryptocurrency wallets and financial transaction servers.\n\n## Recommendations\n- **Network Segmentation**: Strengthen network segmentation to limit lateral movement.\n- **Monitoring and Detection**: Implement enhanced monitoring for unusual login activities and unauthorized access attempts.', '2025-12-31 13:43:07'),
(9, 2, 277, 4, 'Cryptocurrency Exfiltration Tactics and Laundering Channels', '# Cryptocurrency Exfiltration and Laundering\n\n## Context\nWith persistence established, the Lazarus Group is actively exfiltrating cryptocurrency assets, utilizing complex laundering channels to obfuscate the funds\' origins. This report provides insights into the exfiltration processes and laundering mechanisms employed.\n\n## Key Findings\n- **Exfiltration Process**: The attackers are using custom scripts to automate the transfer of cryptocurrency from compromised wallets to intermediary accounts.\n- **Laundering Channels**: Funds are being funneled through a series of mixer services and exchanged across multiple cryptocurrency platforms to obscure the trail.\n- **Evasion Tactics**: The group employs rapid transfer sequences and leverages decentralized exchanges to minimize traceability.\n\n## Recommendations\n- **Transaction Monitoring**: Enhance transaction monitoring to identify unusual patterns and large transfers out of normal business hours.\n- **Collaboration with Exchanges**: Work closely with cryptocurrency exchanges and financial institutions to flag and freeze suspicious transactions.', '2025-12-31 13:43:07'),
(10, 3, 278, 1, 'Analysis of Malicious Code Execution', '### Background\nFollowing the detection of a compromised update package, forensic analysis has confirmed the execution of malicious code on affected systems. This report delves into the mechanisms employed by APT41 to activate their payload upon deployment of the infected update.\n\n### Key Findings\n- **Initial Execution**: The malicious DLL is designed to execute upon the initialization of the server management software.\n- **Obfuscation Techniques**: APT41 has employed advanced obfuscation techniques to avoid detection by traditional antivirus software.\n- **Payload Functionality**: The primary functions include system reconnaissance and the establishment of backdoor access for further exploitation.\n\n### Next Steps\nMitigation should focus on the identification and isolation of compromised hosts. Enhanced monitoring for unusual system activity is recommended to detect further malicious behavior.', '2025-12-31 13:45:44'),
(11, 3, 279, 2, 'Persistence Mechanisms and Countermeasures', '### Overview\nAPT41 has been observed establishing persistence on compromised systems following the execution of their payload. This report outlines the persistence techniques used and suggests countermeasures to neutralize this threat.\n\n### Persistence Techniques\n- **Registry Modifications**: Alterations to the Windows Registry to ensure the malware runs on system startup.\n- **Scheduled Tasks**: Creation of scheduled tasks to execute malware at specified intervals.\n\n### Recommended Countermeasures\n- **Registry Auditing**: Regular audits of the registry for unauthorized changes.\n- **Task Scheduler Monitoring**: Implement alerts for the creation of new scheduled tasks.\n\n### Conclusion\nNeutralizing persistence is critical to prevent further exploitation and lateral movement within the network.', '2025-12-31 13:45:44'),
(12, 3, 280, 3, 'Lateral Movement and Data Exfiltration Insights', '### Incident Summary\nPost-establishment of persistence, APT41 has initiated lateral movement to expand its foothold within the network and commenced data exfiltration activities. This report provides insights into these operations and their implications.\n\n### Lateral Movement Tactics\n- **Credential Dumping**: Use of tools to extract login credentials from compromised systems.\n- **Remote Services**: Exploitation of remote desktop and SMB services for network traversal.\n\n### Data Exfiltration\n- **Command and Control (C2) Channels**: Data is being exfiltrated using encrypted C2 channels to evade detection.\n- **Volume and Target Data**: Focus on intellectual property and financial records.\n\n### Recommendations\n- **Network Segmentation**: Implement stringent network segmentation to contain the spread.\n- **Data Loss Prevention (DLP)**: Deploy DLP solutions to monitor and block unauthorized data transfers.\n\n### Conclusion\nProactive measures are essential to detect and thwart further lateral movement and data theft by the adversary.', '2025-12-31 13:45:44'),
(13, 3, 281, 4, NULL, NULL, '2025-12-31 13:45:44'),
(14, 4, 285, 1, 'Analysis of Malicious Domain Infrastructure', '### Overview\nFollowing the detection of a spear-phishing email campaign targeting political organizations, further analysis has led to the identification of a network of malicious domains. These domains are linked to APT28\'s credential harvesting activities.\n\n### Findings\n- **Domain Patterns:** The domains employ similar naming conventions, often mimicking legitimate services to deceive targets.\n- **Hosting and IP Details:** The infrastructure is hosted across several countries, complicating attribution and takedown efforts.\n- **SSL/TLS Certificates:** Many domains utilize Let\'s Encrypt certificates, providing a false sense of security.\n\n### Recommendations\n- **Monitoring and Blocking:** Implement domain monitoring for known malicious patterns and block identified domains at the network level.\n- **User Education:** Enhance awareness training focused on recognizing phishing attempts related to these domains.', '2025-12-31 15:17:10'),
(15, 4, 286, 2, 'Investigation into OAuth Token Abuse', '### Overview\nSubsequent to the discovery of malicious domains, evidence of OAuth token abuse has been detected. This technique is being used to maintain persistent access to compromised accounts within targeted organizations.\n\n### Findings\n- **Scope of Abuse:** Multiple accounts within political organizations have been accessed using OAuth tokens, bypassing traditional authentication.\n- **Attack Vectors:** Tokens are likely being obtained through previously identified spear-phishing campaigns.\n- **Impact:** Abused tokens allow threat actors to conduct operations with legitimate access, making detection difficult.\n\n### Recommendations\n- **Token Revocation:** Immediate revocation of suspicious OAuth tokens is critical.\n- **Enhanced Monitoring:** Deploy advanced monitoring to detect anomalous token usage patterns.\n- **User Awareness:** Educate users on the risks of OAuth token misuse and encourage cautious application authorization.', '2025-12-31 15:17:10'),
(16, 4, 287, 3, 'Disinformation Campaign Planning Insights', '### Overview\nIntelligence has surfaced regarding the planning of a disinformation campaign by APT28, aimed at influencing public perception during the national election period.\n\n### Findings\n- **Tactics and Channels:** The campaign plans to utilize social media platforms and fake news websites to disseminate false narratives.\n- **Target Audience:** Efforts are focused on swaying undecided voters and amplifying societal divisions.\n- **Coordination:** Activities appear to be coordinated with other malicious operations, potentially leveraging stolen credentials and OAuth access.\n\n### Recommendations\n- **Collaboration:** Work with social media companies to identify and remove fake accounts and content.\n- **Public Awareness:** Launch public awareness initiatives to educate voters on identifying disinformation.\n- **Intel Sharing:** Foster information sharing among national and international partners to enhance detection and response efforts.', '2025-12-31 15:17:10'),
(17, 4, 288, 4, NULL, NULL, '2025-12-31 15:17:10'),
(18, 5, 289, 1, 'Analysis of Phishing Email Attack Vector', '### Overview\nThe phishing email was identified as the initial attack vector used by the Wizard Spider APT group. The email, disguised as an urgent communication from a trusted medical supplier, contained a malicious link to a counterfeit login page.\n\n### Technical Details\n- **Sender Email Address**: spoofed@trustedmedical.com\n- **Subject Line**: \'Immediate Action Required: Update Your Credentials\'\n- **Date/Time Detected**: 2023-10-15 09:45 UTC\n- **Malicious URL**: hxxp://update-credentials[.]secure-med[.]com\n\n### Next Steps\nThe detection of this phishing email suggests the potential for further malicious activity. Vigilance is advised for indicators of TrickBot malware, commonly used by Wizard Spider after initial entry.', '2025-12-31 15:22:50'),
(19, 5, 290, 2, 'TrickBot Malware Execution Analysis', '### Overview\nTrickBot malware was executed following the successful phishing attack, marking the transition from initial access to establishing a foothold within the hospital network.\n\n### Technical Details\n- **Malware Type**: TrickBot variant\n- **Execution Path**: C:\\\\Users\\\\Public\\\\updater.exe\n- **Date/Time Detected**: 2023-10-15 10:15 UTC\n- **Command and Control (C2) Server**: 192.168.1.100\n\n### Persistence Mechanisms\nThe malware is known to deploy persistence mechanisms to maintain access. Monitoring for scheduled tasks or registry changes is crucial as we anticipate these activities to follow.', '2025-12-31 15:22:50'),
(20, 5, 291, 3, 'Persistence Mechanism Identification', '### Overview\nPersistence mechanisms were identified, confirming the adversary\'s intent to maintain long-term access to the hospital\'s network.\n\n### Technical Details\n- **Registry Key Modification**: HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\n- **Scheduled Task Created**: \'SystemUpdater\' running updater.exe\n- **Date/Time Detected**: 2023-10-15 11:00 UTC\n\n### Indicator of Lateral Movement\nThe presence of persistence mechanisms suggests the next likely phase is lateral movement. Cobalt Strike, a common tool for such activities, should be anticipated.', '2025-12-31 15:22:50'),
(21, 5, 292, 4, 'Cobalt Strike Beacon Detection', '### Overview\nA Cobalt Strike beacon was detected, indicating the adversary\'s progression to lateral movement within the network.\n\n### Technical Details\n- **Beacon IP Address**: 192.168.1.101\n- **Beacon Port**: 4444\n- **Date/Time Detected**: 2023-10-15 11:45 UTC\n- **Communication Method**: HTTPS\n\n### Implications\nThis activity signifies an imminent threat of ransomware deployment. Immediate action is required to isolate affected systems and prevent the final stage of ransomware encryption.', '2025-12-31 15:22:50'),
(22, 5, 293, 5, NULL, NULL, '2025-12-31 15:22:50'),
(23, 6, 294, 1, 'Report: Analysis of Initial Access via Spear Phishing Campaign', '### Overview\nThe spear phishing campaign executed by the Carbanak/FIN7 group was highly targeted, focusing on banking personnel with access to critical systems. The phishing emails were crafted to appear as legitimate internal communications, increasing the probability of successful compromise.\n\n### Key Indicators\n- **Email Subject:** \'Urgent Security Update Required\'\n- **Sender Domain:** spoofed from `security-update@bankinginternal.com`\n- **Attachment:** Malicious XLS file named `Security_Update.xls`\n\n### Next Steps\nThe next phase involves deploying malware to harvest credentials. It is critical to monitor for anomalies in user behavior and system access patterns to mitigate further compromise.', '2025-12-31 15:23:56'),
(24, 6, 295, 2, 'Report: Malware Execution and Credential Harvesting Analysis', '### Overview\nFollowing the initial spear phishing attack, the Carbanak/FIN7 group deployed a sophisticated malware payload. This malware is designed to execute stealthily and harvest credentials from compromised systems.\n\n### Malware Characteristics\n- **Type:** Remote Access Trojan (RAT)\n- **Capabilities:** Keylogging, screen capture, credential dumping\n- **Persistence Mechanism:** Scheduled Tasks and Registry modifications\n\n### Next Steps\nAttention should be directed towards detecting and isolating instances of lateral movement within the network. Implement robust network segmentation and monitor for unauthorized access attempts to critical systems.', '2025-12-31 15:23:56'),
(25, 6, 296, 3, 'Report: Lateral Movement and Network Exploitation Techniques', '### Overview\nCarbanak/FIN7 have initiated lateral movement across the network, leveraging harvested credentials to escalate privileges and access sensitive systems.\n\n### Techniques Observed\n- **Credential Reuse:** Exploiting weak password policies\n- **Pass-the-Hash:** Utilizing NTLM hashes to authenticate\n- **Exploitation of Vulnerable Services:** Targeting unpatched systems for entry\n\n### Next Steps\nThe final stage involves manipulation of ATM withdrawal limits and exploitation of SWIFT gateways. Enhance monitoring of financial transaction systems and initiate real-time alerts for unusual transaction patterns.', '2025-12-31 15:23:56'),
(26, 6, 297, 4, NULL, NULL, '2025-12-31 15:23:56'),
(27, 7, 304, 1, 'Analysis of Spear Phishing Email Detected', '## Overview\nThe initial spear phishing email was detected targeting key personnel within the IT department of the multinational energy corporation. The email contained a malicious attachment disguised as a financial report.\n\n## Details\n- **Sender**: An email address mimicking a known supplier.\n- **Subject Line**: \'Urgent: Q3 Financial Summary Required\'\n- **Attachment**: A macro-enabled Excel file designed to execute a PowerShell script upon opening.\n\n## Next Steps\nMonitoring for any execution of scripts related to this email is crucial to prevent further compromise. Pay special attention to any PowerShell activities that may be triggered as a result of this email.', '2026-01-02 04:27:59'),
(28, 7, 305, 2, 'Investigation into Suspicious PowerShell Execution', '## Overview\nFollowing the detection of the spear phishing email, a suspicious PowerShell script execution was identified on the workstation of a targeted employee.\n\n## Details\n- **Script Purpose**: The PowerShell script was designed to establish a remote connection with command-and-control (C2) servers operated by APT34.\n- **Indicators**: Execution logs show obfuscation techniques to evade detection.\n\n## Insights\nThis execution suggests the attackers are attempting to gain a foothold within the network. Immediate measures should be taken to isolate the affected system and prevent the establishment of persistence mechanisms.', '2026-01-02 04:27:59'),
(29, 7, 306, 3, 'Identification of Persistence Mechanism Established', '## Overview\nAPT34 has successfully established a persistence mechanism within the compromised systems, leveraging scheduled tasks for recurring execution of malicious scripts.\n\n## Details\n- **Technique**: Creation of scheduled tasks to execute scripts at regular intervals.\n- **Tools Used**: Commonly used Windows utilities to create and modify tasks.\n\n## Strategic Implications\nThe persistence indicates a strategic intention to maintain long-term access. This necessitates a thorough review of scheduled tasks across all systems to pinpoint and neutralize unauthorized entries.', '2026-01-02 04:27:59'),
(30, 7, 307, 4, 'Detection of Unauthorized Lateral Movement', '## Overview\nAnomalous activity indicating unauthorized lateral movement within the corporate network was detected, suggesting the attackers are expanding their access.\n\n## Details\n- **Method**: Use of stolen credentials to access additional systems.\n- **Targets**: Systems containing sensitive geological data.\n\n## Recommendations\nStrengthen monitoring of privileged accounts and implement network segmentation to hinder further lateral movement. It\'s critical to review access logs to understand the attack path and prevent data exfiltration attempts.', '2026-01-02 04:27:59'),
(31, 7, 308, 5, NULL, NULL, '2026-01-02 04:27:59'),
(32, 8, 319, 1, 'Phishing Email Analysis', '### Overview\nThe initial alert identified a **suspicious email** likely associated with a phishing attempt. This is often the first step in APT10\'s strategy to deliver malicious payloads.\n\n### Detailed Analysis\n- **Sender\'s Email:** The email originated from a domain resembling a known vendor, indicating a possible **spear-phishing** attempt.\n- **Content:** The email contained a link to a compromised website designed to harvest credentials.\n- **Attachment:** A malicious document file was attached, likely containing a macro to execute malware upon opening.\n\n### Next Steps\n- **Containment:** Block the sender\'s domain and similar variants.\n- **Awareness:** Educate employees on identifying phishing attempts.\n- **Monitoring:** Increase surveillance on network activities for any unauthorized application executions, which could indicate successful malware deployment.', '2026-01-02 20:23:41'),
(33, 8, 320, 2, 'Malware Execution Insight', '### Overview\nFollowing the phishing incident, an alert was triggered for **unauthorized application execution**. This suggests that the malware embedded in the phishing email has been activated.\n\n### Detailed Analysis\n- **Execution Path:** The malware was executed from a temporary directory, consistent with initial payload delivery tactics.\n- **Detection:** Antivirus logs show the execution of a file named `loader.exe`, indicative of a dropper or loader.\n- **Behavior:** The malware attempts to establish a connection with a known C2 server used by APT10.\n\n### Next Steps\n- **Containment:** Isolate the affected system to prevent further spread.\n- **Forensics:** Capture memory and disk images for analysis.\n- **Monitoring:** Watch for attempts to establish persistence mechanisms, which could solidify the presence of the threat.', '2026-01-02 20:23:41'),
(34, 8, 321, 3, 'Persistence Mechanism Investigation', '### Overview\nThe detection of a **persistence mechanism** indicates that the attackers are attempting to maintain access to the compromised system.\n\n### Detailed Analysis\n- **Registry Changes:** The malware modified registry keys to ensure execution upon startup.\n- **Scheduled Tasks:** A new scheduled task was created to execute the malware at regular intervals.\n- **Service Installation:** A new service, disguised as a legitimate application, was installed to run the malware.\n\n### Next Steps\n- **Containment:** Disable the scheduled tasks and services related to the malware.\n- **Forensics:** Analyze registry changes to understand the full scope.\n- **Monitoring:** Prepare for potential lateral movement attempts, as attackers may try to extend control over the network.', '2026-01-02 20:23:41'),
(35, 8, 322, 4, 'Lateral Movement Analysis', '### Overview\nThe alert for **lateral movement** suggests that APT10 is attempting to expand its foothold within the network.\n\n### Detailed Analysis\n- **Tools Used:** The attackers utilized tools such as `PsExec` and `WMI` to move laterally.\n- **Compromised Accounts:** Credentials from privileged accounts were used, indicating possible credential dumping.\n- **Targets:** Lateral movement attempts were detected towards servers hosting critical data.\n\n### Next Steps\n- **Containment:** Reset passwords for compromised accounts and enhance MFA enforcement.\n- **Forensics:** Conduct a thorough audit of account activities and access logs.\n- **Monitoring:** Be vigilant for data exfiltration attempts, as the attackers might next attempt to extract sensitive information.', '2026-01-02 20:23:41'),
(36, 8, 323, 5, NULL, NULL, '2026-01-02 20:23:41'),
(37, 9, 324, 1, NULL, NULL, '2026-01-02 20:29:44'),
(38, 9, 325, 2, 'Analysis of Malicious Firmware Update', '### Executive Summary\nAfter detecting suspicious network traffic suggesting initial access, a detailed analysis of the firmware update process revealed an unauthorized update to the firewall\'s SPI flash memory.\n\n### Technical Details\n- **Firmware Image**: The firmware image checksum did not match the expected value, indicating tampering.\n- **Analysis Tools**: Utilized Binwalk and Firmware Mod Kit to dissect the firmware.\n- **Findings**: Embedded payload designed for remote command execution.\n\n### Next Steps\nInvestigate persistence mechanisms that may have been established through this malicious firmware.', '2026-01-02 20:29:44'),
(39, 9, 326, 3, 'Investigation of Persistence Mechanism', '### Executive Summary\nA persistence mechanism was detected, ensuring the malicious firmware\'s survival across reboots.\n\n### Technical Details\n- **Method**: The implant modified bootloader scripts to reload the malicious payload.\n- **Detection Tools**: Compared bootloader script with known good configurations.\n\n### Next Steps\nMonitoring for signs of lateral movement within the network.', '2026-01-02 20:29:44'),
(40, 9, 327, 4, 'Signs of Lateral Movement within Network', '### Executive Summary\nThe compromised firewall is being used as a pivot point for lateral movement within the network.\n\n### Technical Details\n- **Indicators of Compromise (IoCs)**: Multiple unusual authentication attempts logged.\n- **Network Zones Affected**: Activity detected in the DMZ and internal subnet.\n\n### Next Steps\nEstablish containment measures to prevent further spread and identify C2 communication channels.', '2026-01-02 20:29:44'),
(41, 9, 328, 5, 'Command and Control Channel Analysis', '### Executive Summary\nA command and control channel has been established, facilitating remote administration of the compromised system.\n\n### Technical Details\n- **C2 Protocol**: Detected use of DNS tunneling for stealthy communication.\n- **Frequency**: Regular beaconing every 5 minutes.\n\n### Next Steps\nImplement measures to block C2 communication and monitor for data exfiltration attempts.', '2026-01-02 20:29:44'),
(42, 9, 329, 6, 'Detection of Data Exfiltration Attempt', '### Executive Summary\nA data exfiltration attempt was intercepted, aimed at extracting sensitive information from the network.\n\n### Technical Details\n- **Method**: Data packaged in compressed archives, sent over HTTPS.\n- **Volume**: Approximately 500MB of data targeted.\n\n### Next Steps\nInvestigate for signs of privilege escalation that may have facilitated the exfiltration.', '2026-01-02 20:29:44'),
(43, 9, 330, 7, 'Privilege Escalation Analysis', '### Executive Summary\nPrivilege escalation attempts have been detected, likely to gain higher-level access for further exploitation.\n\n### Technical Details\n- **Vector**: Exploitation of known vulnerability in outdated software.\n- **Detection**: Log analysis showed unauthorized changes to system files and configurations.\n\n### Next Steps\nExamine logs and configurations for attempts to cover tracks and evade defenses.', '2026-01-02 20:29:44'),
(44, 9, 331, 8, 'Defense Evasion Tactics Observed', '### Executive Summary\nAttempts to cover tracks and evade defense mechanisms were observed following privilege escalation.\n\n### Technical Details\n- **Tactics**: Deletion of log files, disabling of security tools.\n- **Detection Tools**: Anomaly detection in SIEM highlighted these activities.\n\n### Next Steps\nConduct internal reconnaissance to determine the target assets and finalize response strategies.', '2026-01-02 20:29:44'),
(45, 9, 332, 9, 'Internal Reconnaissance Activities', '### Executive Summary\nInternal reconnaissance activities have been detected, indicating preparation for final data extraction.\n\n### Technical Details\n- **Techniques Used**: Network scanning and mapping of critical systems.\n- **Tools Detected**: Use of custom scripts mimicking legitimate admin tools.\n\n### Next Steps\nPrepare for potential final data extraction and reinforce monitoring on critical assets.', '2026-01-02 20:29:44'),
(46, 9, 333, 10, 'Final Data Extraction Attempt Analysis', '### Executive Summary\nA final data extraction attempt was detected, marking the culmination of the attack chain.\n\n### Technical Details\n- **Targeted Data**: High-value intellectual property and customer data.\n- **Method**: Attempted exfiltration via cloud-based storage services.\n\n### Conclusion\nThe attack cycle is complete. Immediate containment and remediation actions should be prioritized to prevent future breaches.', '2026-01-02 20:29:44'),
(47, 10, 334, 1, 'Analysis of Obfuscated JavaScript Payload', '### Overview\nFollowing the detection of the compromised website, analysts have identified a suspicious JavaScript payload designed to execute upon a user\'s visit. This script is heavily obfuscated, suggesting advanced techniques employed by APT32 to avoid detection.\n\n### Observations\n- **Obfuscation Techniques:** The script uses multiple layers of encoding and dynamic code generation.\n- **Execution Trigger:** The payload is triggered when specific conditions are met, such as user agent matching and referrer checks.\n\n### Recommendations\n- **Immediate Action:** Set up sandbox environments to safely deobfuscate and analyze the script.\n- **Further Investigation:** Monitor network traffic for any anomalous patterns indicative of further payload execution.', '2026-01-02 20:31:37'),
(48, 10, 335, 2, 'Custom Backdoor Analysis', '### Overview\nUpon successful execution of the obfuscated JavaScript, a custom backdoor is installed on macOS systems. This backdoor is unique to APT32 and provides persistent access to infected devices.\n\n### Key Features\n- **Persistence Mechanism:** The backdoor uses Launch Daemons for persistence, ensuring it runs at startup.\n- **Capabilities:** Allows remote access, file manipulation, and execution of arbitrary commands.\n\n### Recommendations\n- **Detection:** Implement host-based rules to detect known persistence techniques used by this backdoor.\n- **Mitigation:** Advise users to update macOS and employ endpoint protection solutions.', '2026-01-02 20:31:37'),
(49, 10, 336, 3, 'Command and Control Communication Analysis', '### Overview\nThe custom backdoor begins communicating with a Command and Control (C2) server once installed. This stage marks the lateral movement phase, where the attacker maintains control over the compromised devices.\n\n### Observations\n- **C2 Channels:** Utilizes HTTPS for encrypted communication, making detection challenging.\n- **Behavioral Patterns:** Regular check-ins with the server and potential data upload activity.\n\n### Recommendations\n- **Network Monitoring:** Deploy advanced monitoring to identify atypical HTTPS traffic patterns.\n- **Threat Intelligence:** Leverage threat intelligence feeds to flag known APT32 infrastructure.', '2026-01-02 20:31:37'),
(50, 10, 337, 4, 'Data Exfiltration Attempt Detected', '### Overview\nThe final stage of the attack involves attempts to exfiltrate sensitive data from the compromised organization. This represents a significant threat to the confidentiality of human rights advocacy efforts.\n\n### Observations\n- **Exfiltration Tactics:** Use of compressed archives sent over encrypted channels.\n- **Data Types Targeted:** Email communications, internal documents, and contact databases.\n\n### Recommendations\n- **Data Loss Prevention (DLP):** Implement DLP solutions to monitor and block unauthorized data transfers.\n- **Incident Response:** Engage incident response teams to contain and mitigate the impact of exfiltration attempts.', '2026-01-02 20:31:37'),
(51, 10, 338, 5, NULL, NULL, '2026-01-02 20:31:37'),
(52, 11, 339, 1, 'Web Shell Deployment Detected', '### Overview\nFollowing the initial access via ProxyLogon Zero-Day exploit, our systems have identified the deployment of a web shell, specifically **China Chopper**.\n\n### Details\n- **Web Shell Name**: China Chopper\n- **Behavior**: Provides attackers with remote access and control over the compromised server.\n- **Indicators of Compromise (IoCs)**: Presence of unusual web application files.\n\n### Next Steps\nFocus on identifying the source of the web shell and potential attackers. Prepare for potential credential theft attempts, which are commonly executed following web shell deployment.', '2026-01-03 00:04:00'),
(53, 11, 340, 2, 'Credential Harvesting Detected', '### Overview\nAfter the deployment of China Chopper, there are signs of credential harvesting using **Mimikatz**.\n\n### Details\n- **Tool Used**: Mimikatz\n- **Purpose**: Extracting user credentials from the compromised system.\n- **Indicators**: Unauthorized access attempts, suspicious processes running on the server.\n\n### Next Steps\nMonitor for lateral movement attempts within the network, as attackers may use harvested credentials to propagate.', '2026-01-03 00:04:00'),
(54, 11, 341, 3, 'Lateral Movement Activity Observed', '### Overview\nCredential harvesting has led to lateral movement through SMB protocol, indicating an attempt to propagate within the network.\n\n### Details\n- **Protocol Used**: SMB (Server Message Block)\n- **Objective**: Gain access to additional systems using harvested credentials.\n- **Indicators**: Unusual login attempts across network nodes.\n\n### Next Steps\nPrepare for potential reconnaissance activities by the attackers, as they seek to map the network and identify valuable data.', '2026-01-03 00:04:00'),
(55, 11, 342, 4, 'Reconnaissance Activity Detected', '### Overview\nFollowing lateral movement, attackers are executing reconnaissance commands to gather information about the network.\n\n### Details\n- **Commands Used**: Network mapping tools, system enumeration commands.\n- **Purpose**: Identify critical systems and data of interest.\n- **Indicators**: Unusual network scans and command executions.\n\n### Next Steps\nAnticipate data collection attempts for exfiltration. Implement monitoring to detect unusual data access patterns.', '2026-01-03 00:04:00'),
(56, 11, 343, 5, 'Data Collection Identified', '### Overview\nReconnaissance has led to data collection activities, likely preparing for exfiltration.\n\n### Details\n- **Activity**: Access and aggregation of sensitive data.\n- **Objective**: Prepare data for exfiltration.\n- **Indicators**: Large data access events, unusual file movements.\n\n### Next Steps\nExpect attempts to exfiltrate data via HTTP POST or other channels. Enhance monitoring on outbound traffic.', '2026-01-03 00:04:00'),
(57, 11, 344, 6, 'Data Exfiltration Attempt Detected', '### Overview\nData exfiltration is underway, with attackers using HTTP POST requests to transmit collected data.\n\n### Details\n- **Method**: HTTP POST\n- **Target**: External servers\n- **Indicators**: Unusual outbound traffic patterns, large amounts of data being sent out.\n\n### Next Steps\nPrepare for potential cleanup operations by attackers. Strengthen defenses to prevent further exfiltration and identify any remaining web shells or backdoors.', '2026-01-03 00:04:00'),
(58, 11, 345, 7, 'Defense Evasion Activity Noted', '### Overview\nAttackers are attempting to clean up and remove indicators of their presence to evade detection.\n\n### Details\n- **Activities**: Deleting logs, removing malware traces, altering system settings.\n- **Objective**: Obfuscate attack traces and maintain persistence.\n- **Indicators**: Missing logs, altered system configurations.\n\n### Next Steps\nConduct a thorough forensic analysis to recover deleted logs and identify any remaining indicators. Implement stronger endpoint monitoring to detect future attempts.', '2026-01-03 00:04:00'),
(59, 11, 346, 8, NULL, NULL, '2026-01-03 00:04:00'),
(60, 12, 347, 1, 'Analysis of Initial Access via Spear Phishing', '# Initial Access via Spear Phishing\n\n## Summary\nFollowing the detection of spear phishing attempts, analysis of intercepted emails reveals the use of legitimate-looking diplomatic communications as a lure. The phishing emails were tailored to the targeted individuals using publicly available information.\n\n## Details\n- **Sender**: The emails appear to originate from trusted diplomatic entities.\n- **Payload**: The emails contain malicious attachments that exploit vulnerabilities in document readers.\n- **Target**: Individuals within diplomatic networks.\n\n## Next Steps\nThe successful spear phishing attack sets the stage for the execution of a Remote Access Tool (RAT), which is likely the next step in the adversary\'s playbook.\n\n## Recommendations\n- Increase awareness and training for diplomatic personnel regarding spear phishing tactics.\n- Implement email filtering and sandboxing solutions to detect and block malicious attachments.', '2026-01-03 00:37:55'),
(61, 12, 348, 2, 'Execution of Remote Access Tool (RAT) Analysis', '# Execution of Remote Access Tool\n\n## Summary\nAfter gaining initial access, the adversaries executed a Remote Access Tool (RAT) on compromised systems. This RAT allows them to remotely control the infected machines and facilitates further exploitation.\n\n## Details\n- **RAT Capabilities**: File transfer, command execution, and keylogging.\n- **Persistence**: The RAT is configured to start at system boot, ensuring continuous access.\n- **Communication**: The tool communicates with command and control (C2) servers using encrypted channels to evade detection.\n\n## Next Steps\nDeployment of a rootkit is anticipated to establish deeper persistence and stealth, likely the next phase in the attack.\n\n## Recommendations\n- Monitor network traffic for anomalous connections to known or suspected C2 domains.\n- Conduct thorough endpoint scans to identify and neutralize the RAT.', '2026-01-03 00:37:55'),
(62, 12, 349, 3, 'Rootkit Deployment and Persistence Mechanism', '# Rootkit Deployment for Persistence\n\n## Summary\nThe adversaries have deployed a sophisticated rootkit to ensure persistent access to compromised systems. This rootkit is designed to operate silently and evade detection by traditional security tools.\n\n## Details\n- **Rootkit Features**: Kernel-level access, anti-debugging techniques, and hidden file storage.\n- **Impact**: The rootkit grants long-term control over the system and masks malicious activities.\n- **Detection**: Difficult to detect without specialized tools due to its deep integration.\n\n## Next Steps\nWith rootkit persistence established, the attackers are likely to move laterally within the network, exploiting hijacked credentials to expand their reach.\n\n## Recommendations\n- Deploy advanced endpoint detection and response (EDR) solutions to identify unusual behavior.\n- Perform regular integrity checks of system files and settings.', '2026-01-03 00:37:55'),
(63, 12, 350, 4, 'Lateral Movement and Credential Access', '# Lateral Movement via Hijacked Credentials\n\n## Summary\nUtilizing hijacked credentials, the adversaries are expanding their presence across the network. This lateral movement allows them to access additional systems and data.\n\n## Details\n- **Credential Theft**: Credentials were harvested using keyloggers and memory scraping techniques.\n- **Access Points**: Compromised accounts are used to access shared drives, email servers, and other critical systems.\n- **Objective**: Broader network infiltration to locate valuable intelligence.\n\n## Next Steps\nThe adversaries will likely use hijacked satellite links to exfiltrate sensitive data, masking their C2 locations and avoiding detection.\n\n## Recommendations\n- Implement multi-factor authentication (MFA) to reduce the risk of credential misuse.\n- Monitor for unusual login patterns and access attempts to critical systems.', '2026-01-03 00:37:55'),
(64, 12, 351, 5, NULL, NULL, '2026-01-03 00:37:55'),
(65, 13, 352, 1, 'Analysis of Initial Network Breach', '### Summary\nFollowing the alert on suspicious access to the university network, further investigation has revealed that APT40 utilized spear-phishing emails to target university staff, leading to credential theft. These credentials were then used to access the university\'s internal network.\n\n### Detailed Findings\n- **Phishing Campaign**: APT40 crafted emails with attachments masquerading as legitimate maritime research documents, luring victims into opening them.\n- **Credential Harvesting**: Upon opening, malicious scripts captured login credentials, which were then used in lateral movement attempts.\n\n### Next Steps\nMonitor for signs of malware execution, as this is the typical progression post-initial access in APT40 operations.', '2026-01-03 00:42:39'),
(66, 13, 353, 2, 'Detection of Custom Malware Execution', '### Summary\nSubsequent to the initial breach, custom malware was detected executing within the compromised network. This malware is designed to blend with legitimate maritime research applications, making detection challenging.\n\n### Malware Profile\n- **Custom Build**: The malware shows characteristics unique to APT40, including obfuscated code and modular functionality.\n- **Capabilities**: It can execute commands, capture keystrokes, and exfiltrate data.\n\n### Recommendations\n- **Increased Monitoring**: Implement advanced monitoring for web shell installations as APT40 typically progresses to establishing persistence following malware execution.', '2026-01-03 00:42:39'),
(67, 13, 354, 3, 'Establishing Persistence via Web Shell', '### Summary\nAPT40 has been observed deploying web shells to maintain persistence within the compromised university network. These web shells provide ongoing access even if the initial breach is discovered and remediated.\n\n### Web Shell Indicators\n- **File Names and Locations**: Web shells are hidden within legitimate directories under misleading names.\n- **Command and Control**: Use of HTTP/S protocols to communicate with external servers.\n\n### Countermeasures\n- **File Integrity Monitoring**: Deploy monitoring solutions to detect unauthorized file changes or additions.\n- **Network Traffic Analysis**: Watch for anomalous outbound traffic indicative of data staging or exfiltration.', '2026-01-03 00:42:39'),
(68, 13, 355, 4, 'Lateral Movement to Secure Data Sources', '### Summary\nAPT40 has successfully moved laterally within the network, gaining access to secure data sources including databases containing sensitive maritime research.\n\n### Lateral Movement Tactics\n- **Credential Stuffing**: Utilization of harvested credentials to access different network segments.\n- **Remote Desktop Protocol (RDP)**: Exploiting RDP to move between systems and access secured data.\n\n### Next Steps\nPrepare for potential data exfiltration activities by analyzing network logs for large outbound data transfers, especially focusing on sonar technology schematics.', '2026-01-03 00:42:39'),
(69, 13, 356, 5, NULL, NULL, '2026-01-03 00:42:39'),
(70, 14, 357, 1, 'Analysis of Initial Compromise Vector', '### Overview\nFollowing the detection of suspicious web traffic attributed to a drive-by download, further analysis reveals the presence of a malicious downloader script embedded within a compromised website. This script is responsible for initiating the subsequent malicious activities.\n\n### Technical Details\n- **Infection Vector**: Compromised website hosting a malicious JavaScript file.\n- **Observed Behavior**: The script attempts to download and execute a secondary payload, likely a PowerShell script.\n\n### Next Steps\nMonitor for execution of PowerShell scripts, which may indicate the deployment of additional malware components or the initiation of further malicious actions.', '2026-01-03 00:50:36'),
(71, 14, 358, 2, 'PowerShell Script Analysis', '### Overview\nAfter the execution of a malicious PowerShell script, an in-depth investigation reveals its purpose in establishing persistence and facilitating further attacks.\n\n### Technical Details\n- **Script Functionality**: The script modifies registry keys to ensure the persistence of malware across system reboots.\n- **Indicators of Compromise**: Registry modifications detected in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`.\n\n### Next Steps\nMonitor registry activity for additional modifications and prepare for potential credential theft attempts.', '2026-01-03 00:50:36'),
(72, 14, 359, 3, 'Persistence Mechanism and Impact', '### Overview\nThe persistence mechanism has been successfully established via registry modifications, allowing the malicious payload to survive system restarts.\n\n### Technical Details\n- **Impact**: Ensures the continued operation of malicious processes.\n- **Associated Risks**: Increased likelihood of credential dumping tools being deployed to harvest sensitive information.\n\n### Next Steps\nInitiate enhanced monitoring for credential theft activities, such as the use of Mimikatz or similar tools.', '2026-01-03 00:50:36'),
(73, 14, 360, 4, 'Credential Dumping Detection and Mitigation', '### Overview\nThe detection of credential dumping attempts using Mimikatz indicates an escalation in the attack, with the adversary aiming to harvest user credentials.\n\n### Technical Details\n- **Detected Activity**: Execution of Mimikatz binary or similar tools.\n- **Potential Exposure**: Compromise of user and administrative credentials.\n\n### Mitigation Steps\nImmediately rotate all credentials identified as potentially compromised and enforce multi-factor authentication (MFA) across the network.', '2026-01-03 00:50:36'),
(74, 14, 361, 5, 'Suspicious File Transfer Analysis', '### Overview\nSuspicious file transfers over SMB traffic have been detected, potentially indicating lateral movement or exfiltration activities.\n\n### Technical Details\n- **Observed Traffic**: Unusual SMB connections and file transfer patterns.\n- **Potential Objectives**: Data staging for exfiltration or deployment of ransomware payloads.\n\n### Next Steps\nIsolate affected systems and review transferred files for signs of ransomware payloads or sensitive data.', '2026-01-03 00:50:36'),
(75, 14, 362, 6, 'Data Encryption Activity and Ransom Note', '### Overview\nActive ransomware encryption processes have been detected, indicating the adversary\'s final objective to encrypt and hold data for ransom.\n\n### Technical Details\n- **Encryption Process**: Rapid file encryption observed across multiple directories.\n- **Ransom Note**: A note demanding payment in cryptocurrency for decryption keys has been identified.\n\n### Response Actions\nInitiate incident response protocols to contain the spread of encryption, engage in negotiation simulations, and explore decryption options without payment.', '2026-01-03 00:50:36'),
(76, 14, 363, 7, NULL, NULL, '2026-01-03 00:50:36'),
(77, 15, 364, 1, 'Analysis of Anomalous PowerShell Activity', '### Overview\nFollowing the detection of a suspicious web shell on the IIS server, further investigation has revealed anomalous PowerShell activities. These activities indicate that the attacker may be attempting to execute scripts remotely to escalate their privileges or install additional payloads.\n\n### Key Indicators\n- **PowerShell Execution Logs**: Multiple instances of PowerShell command execution were logged, originating from the compromised server.\n- **Obfuscation Techniques**: The commands were heavily obfuscated, a common technique used to evade detection.\n\n### Recommendations\n- **Immediate Review**: Conduct a thorough review of PowerShell logs across all servers.\n- **Restrict PowerShell Usage**: Implement restrictive policies to limit PowerShell script execution to trusted users only.', '2026-01-03 00:54:31'),
(78, 15, 365, 2, 'Discovery of Hidden Scheduled Task', '### Overview\nAfter observing anomalous PowerShell activity, a hidden scheduled task was discovered on the compromised server. This task is likely set up to ensure the attacker maintains persistence within the network.\n\n### Details\n- **Task Name**: The task was found under a misleading name resembling a legitimate system update.\n- **Execution Timing**: Scheduled to execute during off-peak hours to avoid detection.\n\n### Recommendations\n- **Task Audit**: Conduct a comprehensive audit of scheduled tasks on all critical systems.\n- **Security Policies**: Strengthen policies to alert on the creation of new scheduled tasks without proper authorization.', '2026-01-03 00:54:31');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(79, 15, 366, 3, 'Unauthorized Network Map Access Detected', '### Overview\nThe creation of a hidden scheduled task led to an incident where unauthorized access to the telecom network map was detected. This access suggests the attacker is preparing for lateral movement within the network.\n\n### Indicators\n- **Access Logs**: The logs show access by an unauthorized user account, possibly compromised through credential theft.\n- **Network Map Utility**: The access was directed at a utility used specifically by network engineers.\n\n### Recommendations\n- **Account Review**: Immediately review access permissions and enforce multi-factor authentication for all sensitive accounts.\n- **Monitor Tools**: Increase monitoring on network management tools to detect unusual access patterns.', '2026-01-03 00:54:31'),
(80, 15, 367, 4, 'Exfiltration of Call Detail Records', '### Overview\nThe final stage of the intrusion was marked by the exfiltration of call detail records (CDRs), confirming the adversary\'s objective.\n\n### Exfiltration Details\n- **Data Transfer**: Significant outbound data transfers were recorded, consistent with the volume of CDRs.\n- **Destination IP**: Transfers were directed towards an external server that has been linked to previous Gallium APT activities.\n\n### Recommendations\n- **Data Loss Prevention**: Implement DLP solutions to monitor and block unauthorized data transfers.\n- **Incident Response**: Initiate a full incident response procedure to assess the extent of the breach and remediate affected systems.', '2026-01-03 00:54:31'),
(81, 15, 368, 5, NULL, NULL, '2026-01-03 00:54:31'),
(82, 16, 369, 1, NULL, NULL, '2026-01-03 23:52:02'),
(83, 16, 370, 2, 'Macro Execution Insight', '### Context:\nUpon the detection of a suspicious macro-enabled document, further investigation revealed that the document contained obfuscated macro code designed to execute a malicious script. This script initiates the download of additional payloads, leading to the execution phase.\n\n### Next Steps:\nMonitor for unusual script executions and network traffic indicative of further payload downloads.', '2026-01-03 23:52:02'),
(84, 16, 371, 3, 'POWERSTATS Backdoor Analysis', '### Context:\nThe malicious script executed by the macro has installed the POWERSTATS backdoor, which is known for persistence mechanisms that allow attackers to maintain access to the system. This backdoor is commonly used by MuddyWater for further command execution and data exfiltration.\n\n### Next Steps:\nEnsure endpoint detection systems are updated to identify and block POWERSTATS activity.', '2026-01-03 23:52:02'),
(85, 16, 372, 4, 'C2 Communication Detected', '### Context:\nEncrypted communications have been detected with a known MuddyWater command and control (C2) server. This indicates active C2 communication, allowing for remote control and data exfiltration.\n\n### Next Steps:\nIsolate the infected systems to prevent further C2 interactions and gather network traffic logs for analysis.', '2026-01-03 23:52:02'),
(86, 16, 373, 5, 'Lateral Movement Patterns', '### Context:\nThere has been an attempt to move laterally across the network, likely using compromised credentials and exploiting network shares. This movement aims to expand the attack footprint within the agency\'s infrastructure.\n\n### Next Steps:\nConduct a thorough investigation of access logs and isolate affected network segments to prevent further lateral movement.', '2026-01-03 23:52:02'),
(87, 16, 374, 6, 'Credential Dumping Tactics', '### Context:\nCredential dumping activities have been identified, suggesting the use of tools like Mimikatz. This is a precursor for lateral movement and privilege escalation within the network.\n\n### Next Steps:\nInitiate a password reset for potentially compromised accounts and enhance monitoring for atypical login attempts.', '2026-01-03 23:52:02'),
(88, 16, 375, 7, 'Exfiltration Activity Alert', '### Context:\nFile transfer activities to an external server have been detected, indicating potential data exfiltration efforts by the attackers. This is a critical phase of the attack lifecycle.\n\n### Next Steps:\nBlock outbound connections to the identified external IPs and assess the types of data potentially exfiltrated.', '2026-01-03 23:52:02'),
(89, 16, 376, 8, 'Wiper Logic Activation', '### Context:\nThe execution of wiper logic has been detected, signaling the attacker\'s intent to destroy data and disrupt operations under the guise of ransomware.\n\n### Next Steps:\nInitiate backup restoration procedures and ensure data integrity checks are performed to verify the completeness of recovered data.', '2026-01-03 23:52:02'),
(90, 16, 377, 9, 'Forensic Artifact Analysis', '### Context:\nForensic artifact recovery has begun to understand the attack vector and methods used by MuddyWater. This is crucial for identifying weaknesses and preventing future attacks.\n\n### Next Steps:\nCollaborate with forensic experts to analyze recovered artifacts and compile an incident report for strategic improvements.', '2026-01-03 23:52:02'),
(91, 16, 378, 10, 'Mitigation and Remediation Summary', '### Context:\nComprehensive mitigation and remediation measures have been implemented, focusing on patching vulnerabilities, enhancing monitoring, and reinforcing security protocols.\n\n### Next Steps:\nConduct a post-incident review to evaluate the effectiveness of response actions and update security policies accordingly.', '2026-01-03 23:52:02'),
(92, 17, 379, 1, 'Analysis of Malicious Payload Execution', '# Analysis of Malicious Payload Execution\n\nFollowing the detection of a phishing email, a detailed investigation has identified the execution of a malicious payload on the target system. This payload, typically a Remote Access Trojan (RAT), allows the attacker to gain control over the infected system.\n\n## Key Findings:\n- **Payload Type:** The executed payload is consistent with APT1\'s known use of RATs to establish remote access.\n- **Execution Method:** The payload was executed via a script embedded in a seemingly benign document delivered through the phishing email.\n- **Next Steps:** Close monitoring is required to detect any persistence mechanisms that may be established by the attacker to maintain access.', '2026-01-04 00:59:40'),
(93, 17, 380, 2, 'Insight into Persistence Mechanisms', '# Insight into Persistence Mechanisms\n\nAfter executing the malicious payload, the attacker has likely installed a persistence mechanism to ensure continued access to the compromised system.\n\n## Key Techniques:\n- **Registry Modifications:** Changes to the system registry to enable the payload to execute upon system startup.\n- **Scheduled Tasks:** Creation of scheduled tasks that regularly trigger the payload.\n- **Service Creation:** Establishment of new services that run the malicious code in the background.\n\n## Implications:\nThe presence of these mechanisms suggests a strategic attempt to maintain long-term access. Monitoring for credential dumping is advised as the next phase in the attack lifecycle.', '2026-01-04 00:59:40'),
(94, 17, 381, 3, 'Credential Dumping Activity Overview', '# Credential Dumping Activity Overview\n\nThe persistence mechanisms have paved the way for the attacker to perform credential dumping, a technique used to extract user credentials from the compromised system.\n\n## Techniques Observed:\n- **LSASS Memory Dumping:** Access to Local Security Authority Subsystem Service (LSASS) memory to extract credentials.\n- **SAM Database Extraction:** Copying the Security Account Manager (SAM) database for offline analysis.\n- **Tools Used:** Use of known tools like Mimikatz to facilitate credential dumping.\n\n## Recommendations:\nImmediate action is required to prevent lateral movement within the network. Look out for data exfiltration attempts as potential next steps.', '2026-01-04 00:59:40'),
(95, 17, 382, 4, 'Data Exfiltration Attempt Analysis', '# Data Exfiltration Attempt Analysis\n\nFollowing credential dumping, the attacker has attempted to exfiltrate data from the target network.\n\n## Exfiltration Methods:\n- **Encrypted Channels:** Use of encrypted channels (e.g., HTTPS, VPN) to hide data transfer.\n- **Cloud Services:** Leveraging cloud storage services to exfiltrate data without arousing suspicion.\n- **FTP/SFTP:** Use of file transfer protocols to move data out of the network.\n\n## Detected Indicators:\n- Sudden spikes in outbound traffic.\n- Unusual access to cloud storage services.\n\n## Conclusion:\nThe detected data exfiltration attempt underscores the need for enhanced monitoring and response protocols to mitigate data loss and further unauthorized access.', '2026-01-04 00:59:40'),
(96, 17, 383, 5, NULL, NULL, '2026-01-04 00:59:40'),
(97, 18, 384, 1, 'Investigation of Spear Phishing Email', '### Overview\nThe initial access vector was identified as a spear phishing email targeting key personnel within the organization. The email contained a seemingly legitimate attachment that, once opened, executed a hidden script.\n\n### Analysis\n- **Sender:** The email originated from a spoofed address resembling a trusted partner.\n- **Content:** The attachment was a weaponized document with macros that, when enabled, triggered the download of a malicious payload.\n\n### Next Steps\n- **Immediate Action:** Advise recipients of similar emails to report and delete them without opening.\n- **Preparation for Next Alert:** Monitor systems for signs of script execution and unusual network activity.', '2026-01-04 02:06:57'),
(98, 18, 385, 2, 'Detection of Malicious PowerShell Activity', '### Overview\nFollowing the execution of the spear phishing attack, a malicious PowerShell script was detected. This script is designed to further compromise the network.\n\n### Analysis\n- **Script Functionality:** The script attempts to download additional payloads and establish a connection back to the attacker\'s command and control server.\n- **Indicators of Compromise (IoCs):** Unusual PowerShell commands observed, including obfuscated and encoded scripts.\n\n### Next Steps\n- **Mitigation:** Disable PowerShell scripting for non-administrative users and review execution logs.\n- **Preparation for Next Alert:** Monitor registry changes as the attacker may attempt to establish persistence.', '2026-01-04 02:06:57'),
(99, 18, 386, 3, 'Detection of Registry Modifications', '### Overview\nThe attacker has modified the registry to maintain persistence on targeted systems. This tactic ensures the malicious presence is sustained even after a reboot.\n\n### Analysis\n- **Registry Changes:** Specific keys related to startup and session management have been altered, pointing to unauthorized scripts.\n- **Persistence Mechanism:** Use of Run and RunOnce registry keys to ensure the script executes at startup.\n\n### Next Steps\n- **Immediate Action:** Restore original registry settings and remove unauthorized entries.\n- **Preparation for Next Alert:** Monitor for credential access attempts, which may indicate lateral movement.', '2026-01-04 02:06:57'),
(100, 18, 387, 4, 'Credential Dumping Activity Detected', '### Overview\nThe attacker is attempting lateral movement through credential dumping techniques. This is a critical phase where compromised credentials could lead to further infiltration.\n\n### Analysis\n- **Techniques Used:** Tools like Mimikatz have been detected, indicating attempts to extract credentials from memory.\n- **Targets:** Domain controllers and high-value systems are primary targets for credential harvesting.\n\n### Next Steps\n- **Mitigation:** Isolate affected systems and change all credentials for compromised accounts.\n- **Preparation for Next Alert:** Monitor network for encrypted traffic patterns indicating data exfiltration.', '2026-01-04 02:06:57'),
(101, 18, 388, 5, NULL, NULL, '2026-01-04 02:06:57'),
(102, 19, 389, 1, 'Analysis of APT10\'s Initial Access Techniques', '### Overview\nFollowing the alert of initial access through compromised MSP credentials, further analysis reveals that APT10 leveraged a combination of social engineering and spear-phishing attacks to acquire the necessary credentials. \n\n### Detailed Findings\n- **Phishing Campaign**: Targeted emails were sent to MSP employees, masquerading as official communications.\n- **Credential Harvesting**: APT10 used fake login portals to capture login details.\n\n### Next Steps\nFocus shifts to potential execution methods, with particular attention to DLL side-loading techniques known to be favored by APT10.', '2026-01-04 02:14:19'),
(103, 19, 390, 2, 'APT10\'s Use of DLL Side-Loading for Execution', '### Overview\nPost-execution analysis indicates that APT10 utilized DLL side-loading to run malicious code within trusted applications, bypassing security protocols.\n\n### Detailed Findings\n- **Target Application**: A legitimate aerospace CAD application was identified as the host for the side-loaded DLL.\n- **Malware Characteristics**: The malicious DLL was designed to trigger upon application start-up, ensuring seamless execution.\n\n### Next Steps\nInvestigations will now focus on how persistence is established post-execution, particularly through backdoor implants.', '2026-01-04 02:14:19'),
(104, 19, 391, 3, 'Establishing Persistence: Backdoor Implant Tactics', '### Overview\nAPT10\'s strategy for persistence involves deploying a stealthy backdoor implant that ensures ongoing access to the compromised systems.\n\n### Detailed Findings\n- **Backdoor Implant**: The implant is disguised as a legitimate system process, making detection challenging.\n- **Communication Channels**: The implant communicates with C2 servers using encrypted channels to evade detection.\n\n### Next Steps\nFocus will shift to identifying APT10\'s lateral movement techniques to access critical design servers within the aerospace network.', '2026-01-04 02:14:19'),
(105, 19, 392, 4, 'Lateral Movement: Accessing Design Servers', '### Overview\nAPT10 has successfully moved laterally within the network, reaching sensitive design servers crucial to aerospace projects.\n\n### Detailed Findings\n- **Credential Reuse**: Stolen credentials were used to authenticate with minimal detection.\n- **Network Mapping**: APT10 employed advanced network discovery tools to map the internal network architecture.\n\n### Next Steps\nAttention will now focus on how APT10 collects data from CAD repositories, preparing for exfiltration.', '2026-01-04 02:14:19'),
(106, 19, 393, 5, 'Data Collection from CAD Repositories', '### Overview\nAPT10 has begun the systematic collection of sensitive data from CAD repositories, focusing on proprietary designs and technologies.\n\n### Detailed Findings\n- **Data Targets**: High-value CAD files related to aerospace technologies were prioritized.\n- **Automated Scripts**: Custom scripts were used to streamline the data collection process.\n\n### Next Steps\nThe operation will now monitor the methods APT10 uses to exfiltrate the collected data, emphasizing the use of encrypted channels.', '2026-01-04 02:14:19'),
(107, 19, 394, 6, 'Exfiltration via Encrypted Channels', '### Overview\nAPT10 is in the process of exfiltrating the collected CAD data using encrypted channels to avoid detection by standard security measures.\n\n### Detailed Findings\n- **Encryption Protocols**: Utilized strong encryption to secure data in transit.\n- **Exfiltration Paths**: Data is being sent to overseas servers known to be associated with APT10.\n\n### Next Steps\nThe final phase will assess APT10\'s efforts to clean up and cover their tracks, focusing on defensive evasion techniques.', '2026-01-04 02:14:19'),
(108, 19, 395, 7, NULL, NULL, '2026-01-04 02:14:19'),
(109, 20, 396, 1, 'Execution of Malicious Script - Unlocked', '### Overview\nFollowing the detection of suspicious network activity, further investigation has revealed the execution of a potentially malicious script on multiple network endpoints. The script appears to connect to external command and control (C2) servers, indicating the possibility of an advanced persistent threat (APT) operation.\n\n### Key Findings\n- **Script Origin**: The script was deployed from an external IP address linked to known malicious activity.\n- **C2 Communication**: Established connections with C2 servers observed in previous Whitefly APT campaigns.\n- **Potential Impact**: If left unchecked, the script could allow attackers to execute further malicious activities within the network.\n\n### Recommendations\n- Conduct endpoint analysis to identify all systems affected by the script.\n- Isolate compromised systems to prevent further execution and communication with C2 servers.', '2026-01-04 02:15:53'),
(110, 20, 397, 2, 'Vcrodat Malware Persistence Mechanism - Unlocked', '### Overview\nThe investigation has progressed to identifying the persistence mechanisms employed by the Vcrodat malware identified in the healthcare network. Persistence is a key tactic used by the malware to maintain unauthorized access over an extended period.\n\n### Key Findings\n- **Registry Alterations**: Changes in the system registry to ensure malware execution upon startup.\n- **Scheduled Tasks**: Creation of hidden scheduled tasks to trigger the malware at specific intervals.\n- **System Services**: Manipulation of existing services to load malicious components.\n\n### Recommendations\n- Review and audit system registry and scheduled tasks for unauthorized entries.\n- Implement monitoring of system services to detect anomalies related to persistence mechanisms.', '2026-01-04 02:15:53'),
(111, 20, 398, 3, 'Compromised Open-Source Tool Identified - Unlocked', '### Overview\nDuring the analysis of persistence mechanisms, it was discovered that Whitefly APT has compromised an open-source tool widely used within the organization. This tool has been modified to evade defense mechanisms and facilitate lateral movement.\n\n### Key Findings\n- **Tool Modification**: Alterations to the source code to include backdoor functionality.\n- **Evasion Techniques**: The tool appears benign but contains hidden capabilities to bypass detection.\n- **Impact on Infrastructure**: The tool is deployed across several critical systems, amplifying the threat landscape.\n\n### Recommendations\n- Perform a comprehensive audit of open-source tools and validate their integrity.\n- Educate users on potential risks associated with unverified open-source software.', '2026-01-04 02:15:53'),
(112, 20, 399, 4, 'Unauthorized Credentials Accessed - Unlocked', '### Overview\nThe compromised open-source tool has facilitated unauthorized access to sensitive credentials, enabling lateral movement within the network. This breach exposes critical systems to further exploitation.\n\n### Key Findings\n- **Credential Dumping**: Use of the tool to extract login credentials from memory and secured storage.\n- **Privileged Access**: Attacker gained administrative privileges on several key systems.\n- **Lateral Movement**: Access used to pivot across the network to other high-value targets.\n\n### Recommendations\n- Implement multi-factor authentication to mitigate unauthorized access.\n- Regularly update and change credentials, especially for privileged accounts.', '2026-01-04 02:15:53'),
(113, 20, 400, 5, 'Unusual Data Access Patterns Detected - Unlocked', '### Overview\nA pattern of unusual data access has been identified, indicating potential data collection activities by the threat actor. The access patterns suggest targeted extraction of sensitive information.\n\n### Key Findings\n- **Data Queries**: High-frequency access to patient records and financial data.\n- **Anomalous Behavior**: Access occurring outside normal operating hours and from unexpected locations.\n- **Data Volume**: Significant increase in data retrieval activities, consistent with data staging for exfiltration.\n\n### Recommendations\n- Enhance data access monitoring and alerting capabilities.\n- Conduct data integrity checks to ensure no unauthorized modifications have occurred.', '2026-01-04 02:15:53'),
(114, 20, 401, 6, 'Data Exfiltration Attempt Blocked - Unlocked', '### Overview\nA data exfiltration attempt has been detected and successfully blocked. The perpetrators attempted to transfer sensitive data to external locations using encrypted channels.\n\n### Key Findings\n- **Exfiltration Vector**: Attempts made through secure HTTP channels to obfuscate activities.\n- **Blocked Channels**: Network defenses successfully identified and halted suspicious data transfers.\n- **Threat Actor Tactics**: Use of encryption and compression to mask data exfiltration attempts.\n\n### Recommendations\n- Strengthen perimeter defenses and encryption detection mechanisms.\n- Conduct a full review of attempted exfiltration activities to identify any potential gaps in security.', '2026-01-04 02:15:53'),
(115, 20, 402, 7, NULL, NULL, '2026-01-04 02:15:53'),
(116, 21, 403, 1, 'Analysis of Suspicious Email Attachment', '### Context and Analysis\n\nAfter detecting a suspicious email attachment, it was identified as a malicious document containing macros designed to execute a remote script. This script aims to install a malicious browser extension, providing attackers with a foothold for further operations.\n\n### Recommendations\n- **Immediate Action:** Block and quarantine the email and any similar ones identified in the network.\n- **User Awareness:** Conduct an awareness campaign focusing on recognizing phishing emails and suspicious attachments.\n\n### Next Steps\nMonitoring network traffic for unusual patterns that may indicate the installation of unauthorized browser extensions.', '2026-01-04 02:18:47'),
(117, 21, 404, 2, 'Malicious Browser Extension Installation', '### Context and Analysis\n\nPost-installation of the malicious browser extension, communication with known command and control (C2) servers was observed. The extension is designed to capture user credentials and session cookies, feeding them back to the attackers.\n\n### Recommendations\n- **Immediate Action:** Remove any unauthorized extensions from all systems, and conduct a security review of all browser extensions.\n- **Network Defense:** Implement network monitoring to detect unusual data flows to external servers.\n\n### Next Steps\nInvestigate potential execution of additional payloads, such as BabyShark VBS scripts, from the compromised host.', '2026-01-04 02:18:47'),
(118, 21, 405, 3, 'Execution of BabyShark VBS Script', '### Context and Analysis\n\nThe BabyShark VBS script has been executed, establishing persistence on the compromised systems. This script allows for continuous monitoring and data collection without detection, targeting sensitive information related to nuclear policy.\n\n### Recommendations\n- **Immediate Action:** Isolate affected systems to prevent further spread.\n- **System Hardening:** Review and enhance endpoint security measures to detect VBS script execution.\n\n### Next Steps\nConduct a thorough investigation into unauthorized network access attempts, focusing on lateral movement across the internal network.', '2026-01-04 02:18:47'),
(119, 21, 406, 4, 'Detection of Unauthorized Network Access', '### Context and Analysis\n\nEvidence of lateral movement within the network has been detected. The adversaries are leveraging compromised credentials to access sensitive areas of the network, specifically targeting documents and communications related to nuclear policy.\n\n### Recommendations\n- **Immediate Action:** Revoke compromised credentials and enforce a network-wide password reset.\n- **Network Segmentation:** Implement tighter access controls and segment sensitive data to limit unauthorized access.\n\n### Next Steps\nPrepare for potential data exfiltration attempts by enhancing monitoring of outgoing traffic and securing data transfer protocols.', '2026-01-04 02:18:47'),
(120, 21, 407, 5, NULL, NULL, '2026-01-04 02:18:47'),
(121, 22, 408, 1, 'Analysis of Supply Chain Compromise', '### Overview\nAPT41 has initiated the operation with a sophisticated supply chain attack. This initial access highlights their capability to infiltrate trusted third-party vendors, leveraging them as conduits into the primary target infrastructure. \n\n### Key Indicators\n- **Compromised Vendor**: Evidence suggests a vulnerability in the vendor\'s software update mechanism was exploited.\n- **Payload Delivery**: Malicious payload embedded within legitimate updates.\n\n### Next Steps\nPrepare for potential **Malware Deployment** as the adversary typically uses the established foothold to inject backdoor malware into the compromised systems.', '2026-01-04 02:21:52'),
(122, 22, 409, 2, 'Backdoor Malware Deployment Detected', '### Overview\nFollowing the supply chain compromise, APT41 has deployed backdoor malware to maintain clandestine access to the systems. This malware is likely custom-built and designed to evade detection.\n\n### Malware Characteristics\n- **Type**: Custom backdoor with advanced evasion features.\n- **Command and Control**: Utilizes encrypted communications to a remote server.\n\n### Next Steps\nThe focus will likely shift to **Establishing Persistence**. Anticipate techniques such as rootkit deployment to ensure long-term access and stealth.', '2026-01-04 02:21:52'),
(123, 22, 410, 3, 'Persistence Mechanism through Rootkit Deployment', '### Overview\nAPT41 has successfully established persistence by installing a rootkit. This rootkit operates at a low level, providing the attackers with the ability to maintain access and conceal their activities effectively.\n\n### Rootkit Details\n- **Capabilities**: Hides files, processes, and network connections.\n- **Installation**: Likely implanted through escalated privileges gained via malware.\n\n### Next Steps\nPrepare for **Lateral Movement** as the attackers might attempt to access sensitive databases, including those containing Personally Identifiable Information (PII).', '2026-01-04 02:21:52'),
(124, 22, 411, 4, 'Lateral Movement Towards PII Databases', '### Overview\nAPT41 has progressed to lateral movement, targeting databases containing PII. This phase involves exploiting compromised credentials and leveraging them to navigate through the network.\n\n### Techniques Observed\n- **Credential Dumping**: Use of tools to extract credentials from memory.\n- **Network Scanning**: Mapping out network architecture to identify PII storage.\n\n### Next Steps\nExpect imminent **Data Exfiltration** of gaming source code and PII. Implement network monitoring and data leakage prevention measures immediately.', '2026-01-04 02:21:52'),
(125, 22, 412, 5, NULL, NULL, '2026-01-04 02:21:52'),
(126, 23, 413, 1, 'In-Depth Analysis: Supply Chain Compromise', '### Overview\nThe recent detection of a **Supply Chain Compromise** indicates a sophisticated attempt to infiltrate our network through third-party software or services. This method is commonly employed by APT41 to bypass traditional security measures by embedding malicious code within trusted updates or applications.\n\n### Indicators of Compromise (IoCs)\n- Newly introduced DLL files in application directories.\n- Unusual outbound traffic patterns from software update services.\n\n### Recommended Actions\n- Conduct a comprehensive review of all third-party software sources.\n- Isolate compromised systems and initiate a forensic investigation.\n- Enhance monitoring on network traffic associated with supply chain services.\n\n### Next Steps\nPrepare for potential **Suspicious Script Execution**, as attackers might leverage compromised software to execute malicious scripts.', '2026-01-04 04:11:48'),
(127, 23, 414, 2, 'Investigation: Suspicious Script Execution Patterns', '### Overview\nFollowing the supply chain compromise, a **Suspicious Script Execution** has been detected. APT41 often utilizes scripts to automate the deployment of their payloads and establish a foothold in the network.\n\n### Key Findings\n- Scripts attempting to execute PowerShell commands with obfuscation techniques.\n- Log entries indicating unauthorized script activity during off-peak hours.\n\n### Recommendations\n- Implement script-blocking policies at the endpoint level.\n- Increase audit logging of PowerShell and other script execution frameworks.\n- Conduct user awareness training on recognizing phishing attempts that may lead to script execution.\n\n### Next Steps\nRemain vigilant for **Persistence Mechanism Activation**, as attackers may seek to maintain access to the compromised systems.', '2026-01-04 04:11:48'),
(128, 23, 415, 3, 'Insight: Persistence Mechanism Activation', '### Overview\nThe detection of a **Persistence Mechanism Activation** suggests that attackers are attempting to maintain long-term access to the compromised environment. APT41 may use various methods such as registry modifications or scheduled tasks.\n\n### Key Indicators\n- Creation of new registry keys pointing to unknown executables.\n- Scheduled tasks set to execute at irregular intervals.\n\n### Mitigation Strategies\n- Audit and clean registry entries associated with unauthorized applications.\n- Review and disable suspicious scheduled tasks.\n- Deploy Endpoint Detection and Response (EDR) tools to monitor persistence techniques.\n\n### Next Steps\nPrepare to intercept **Lateral Movement**, as attackers may attempt to expand their access across the network.', '2026-01-04 04:11:48'),
(129, 23, 416, 4, 'Analysis: Lateral Movement Detected', '### Overview\n**Lateral Movement** has been detected, indicating that the attackers are attempting to spread their foothold within the network. APT41 often uses stolen credentials and exploits to navigate through systems.\n\n### Evidence Collected\n- Unauthorized access attempts on multiple networked devices.\n- Usage of compromised credentials to access sensitive systems.\n\n### Defensive Measures\n- Implement network segmentation to limit lateral movement capabilities.\n- Conduct a full credential reset, prioritizing high-privilege accounts.\n- Utilize honeypots to detect unauthorized movement attempts.\n\n### Next Steps\nFocus on preventing **Data Exfiltration Attempts**, as attackers may attempt to extract valuable data before detection.', '2026-01-04 04:11:48'),
(130, 23, 417, 5, NULL, NULL, '2026-01-04 04:11:48'),
(131, 24, 418, 1, 'Insight into Initial Access through Phishing', '### Overview\nThe phishing email detected in the initial alert utilized a well-crafted spear-phishing technique targeting employees with access to critical systems.\n\n### Details\n- **Sender:** masqueraded as a trusted vendor.\n- **Subject Line:** \"Urgent Invoice Request\"\n- **Payload:** Attachment containing a malicious macro.\n\n### Recommendations\n- Conduct an organization-wide phishing awareness training.\n- Implement an email filtering system to detect and quarantine suspicious emails.\n\n### Next Steps\nMonitor for any execution of malware associated with this phishing attempt.', '2026-01-04 04:13:57'),
(132, 24, 419, 2, 'Analysis of Malware Execution', '### Overview\nFollowing the phishing incident, malware execution was detected on the targeted employee\'s workstation.\n\n### Details\n- **Type of Malware:** Cobalt Strike\n- **Execution Method:** Macro within Excel document\n- **Impact:** Established a command and control (C2) channel.\n\n### Recommendations\n- Isolate the affected workstation immediately.\n- Deploy endpoint detection and response (EDR) solutions to prevent further spread.\n\n### Next Steps\nInvestigate persistence mechanisms that may have been employed by the malware.', '2026-01-04 04:13:57'),
(133, 24, 420, 3, 'Detection of Persistence Mechanisms', '### Overview\nThe malware has established persistence to survive system reboots and maintain access.\n\n### Details\n- **Persistence Technique:** Registry run keys\n- **Additional Observations:** Scheduled tasks were also modified.\n\n### Recommendations\n- Review and clean registry entries.\n- Analyze scheduled tasks for unauthorized modifications.\n\n### Next Steps\nMonitor for unusual administrative access that may indicate lateral movement within the network.', '2026-01-04 04:13:57'),
(134, 24, 421, 4, 'Unauthorized Admin Access Detected', '### Overview\nAnomalous administrative access was detected, indicating potential lateral movement by the threat actor.\n\n### Details\n- **Account Compromised:** Admin account \"sysadmin\"\n- **Access Point:** Remote desktop protocol (RDP)\n- **Time of Access:** 03:45 AM\n\n### Recommendations\n- Immediately reset credentials for all admin accounts.\n- Implement multi-factor authentication (MFA) for critical accounts.\n\n### Next Steps\nInvestigate and monitor for any signs of data exfiltration attempts.', '2026-01-04 04:13:57'),
(135, 24, 422, 5, NULL, NULL, '2026-01-04 04:13:57'),
(136, 25, 423, 1, 'Phishing Email Analysis', '### Initial Findings\n\nThe phishing email detected contained a malicious attachment disguised as an invoice. The email was sent from a seemingly legitimate domain but upon further inspection, the domain was registered only days prior to the attack. The email header analysis revealed multiple red flags including mismatched sender information and a peculiar routing path through compromised servers.\n\n### Next Steps\n\n1. **Immediate Action:** Isolate the user account that received and interacted with the email.\n2. **Investigation:** Conduct a deeper analysis of the attachment to determine the specific exploit used.\n3. **Preparation:** Anticipate potential execution attempts via scripts and monitor PowerShell activity closely.', '2026-01-04 04:25:30'),
(137, 25, 424, 2, 'PowerShell Script Execution Insights', '### Script Analysis\n\nThe suspicious PowerShell script executed on the compromised endpoint was obfuscated to evade detection. The script attempted to download additional payloads from a remote server using encoded commands. This behavior is consistent with the initial stages of malware deployment.\n\n### Mitigation Steps\n\n1. **Isolation:** Disconnect the affected machine from the network immediately.\n2. **Forensic Analysis:** Capture a memory dump for further investigation.\n3. **Monitoring:** Enhance monitoring on PowerShell logs and network traffic to detect other possible execution attempts.\n\n### Preparing for Persistence\n\nBe vigilant for signs of persistence mechanisms, such as unusual changes in registry keys or scheduled tasks.', '2026-01-04 04:25:33'),
(138, 25, 425, 3, 'Persistence Mechanism Investigation', '### Observations\n\nPersistence was established through registry modifications and the creation of hidden scheduled tasks. Additionally, the malware created a startup entry to ensure execution upon system reboot.\n\n### Countermeasures\n\n1. **Registry Audit:** Conduct a full audit of recent registry changes, focusing on keys related to startup programs.\n2. **Scheduled Task Review:** Identify and remove unauthorized tasks.\n3. **User Education:** Reinforce training on recognizing and reporting phishing attempts.\n\n### Preparing for Lateral Movement\n\nMonitor RDP connections and unusual authentication attempts across the network.', '2026-01-04 04:25:33'),
(139, 25, 426, 4, 'Lateral Movement and Exfiltration Threat Analysis', '### Lateral Movement Detection\n\nThe adversary utilized Remote Desktop Protocol (RDP) to move laterally within the network. This was facilitated by previously compromised credentials.\n\n### Immediate Actions\n\n1. **Credential Review:** Reset passwords for all affected accounts and enforce MFA.\n2. **RDP Restrictions:** Limit RDP access to only essential personnel and monitor for unauthorized attempts.\n\n### Preparing for Data Exfiltration\n\nAs exfiltration is likely the next stage, enhance monitoring of outbound network traffic and inspect large data transfers for legitimacy. Employ DLP solutions to prevent unauthorized data transfers.', '2026-01-04 04:25:33'),
(140, 25, 427, 5, NULL, NULL, '2026-01-04 04:25:33'),
(141, 26, 428, 1, 'Analysis of Initial Access Vector', '### Overview\nAfter detecting the spear phishing email, our analysis has identified key elements within the email structure that are consistent with Cl0p\'s tactics. The email contained a seemingly legitimate attachment designed to deceive the recipient into executing it.\n\n### Email Characteristics\n- **Sender Address:** Spoofed domain closely resembling a known partner.\n- **Subject Line:** Urgent action required to avoid account suspension.\n- **Attachment:** A compressed file containing a malicious script.\n\n### Next Steps\nThe focus will now shift to monitoring potential execution vectors, particularly any script execution resulting from this phishing attempt.', '2026-01-04 04:38:04'),
(142, 26, 429, 2, 'Malicious Script Execution Confirmed', '### Overview\nA malicious script linked to the previously detected spear phishing email was executed on the target system. This script has been identified as a custom PowerShell script, a common tool in Cl0p\'s arsenal.\n\n### Script Analysis\n- **Payload:** The script downloads and executes additional payloads.\n- **Obfuscation Techniques:** Heavy use of string obfuscation to evade detection.\n- **Target System Impact:** Initial dropper for further malware deployment.\n\n### Next Steps\nOur priority is to determine how the attacker is establishing persistence. Monitoring registry changes and other system modifications will be critical.', '2026-01-04 04:38:04'),
(143, 26, 430, 3, 'Persistence Mechanism Detected', '### Overview\nPersistence has been established via registry modification, a tactic often utilized by Cl0p to maintain access to compromised systems.\n\n### Details of Modification\n- **Registry Key Altered:** HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n- **Malware Executable:** Set to launch a secondary payload on system startup.\n\n### Implications\nThis persistence method suggests a long-term intent to maintain control over the system.\n\n### Next Steps\nFocus will now be on detecting lateral movement attempts, particularly through credential dumping activities that may follow.', '2026-01-04 04:38:04'),
(144, 26, 431, 4, 'Credential Dumping Detected', '### Overview\nCredential dumping activity has been identified, indicating an attempt to escalate privileges and move laterally within the network.\n\n### Tools and Techniques\n- **Tool Utilized:** Mimikatz, a known tool for credential extraction.\n- **Target:** Local Security Authority Subsystem Service (LSASS) process.\n\n### Security Implications\nCompromised credentials could allow access to critical systems and sensitive data.\n\n### Next Steps\nImmediate attention is required to monitor for data exfiltration attempts, especially through encrypted channels, a known Cl0p tactic.', '2026-01-04 04:38:04'),
(145, 26, 432, 5, NULL, NULL, '2026-01-04 04:38:04'),
(146, 27, 433, 1, 'Analysis of Suspicious Login Attempts', '## Context:\nFollowing the detection of suspicious login attempts indicating potential password spraying, further analysis is required to determine the risk level and potential targets.\n\n### Summary:\n- **Targets Identified:** Diplomatic personnel accounts.\n- **IP Patterns:** Multiple IP addresses originating from known threat landscapes.\n- **Recommendations:**\n  - Implement multi-factor authentication (MFA).\n  - Increase monitoring on login attempts from suspicious IPs.\n  - Educate users on recognizing phishing attempts.\n\n### Next Steps:\nMonitoring should continue to detect any unusual token usage, potentially indicating token theft.', '2026-01-04 23:55:22'),
(147, 27, 434, 2, 'Unusual Token Usage Analysis', '## Context:\nFollowing the detection of unusual token usage patterns, this report delves deeper into potential token theft activities.\n\n### Summary:\n- **Token Characteristics:**\n  - Tokens used outside of normal geographic locations.\n  - Access requests for sensitive diplomatic documents.\n- **Attack Vector:** Possible exploitation of application vulnerabilities.\n- **Mitigation Measures:**\n  - Revoke compromised tokens.\n  - Reset affected accounts.\n  - Strengthen token issuance policies.\n\n### Next Steps:\nVigilance is required for any unauthorized OAuth applications that may be created, leveraging stolen tokens.', '2026-01-04 23:55:22'),
(148, 27, 435, 3, 'Unauthorized OAuth Application Creation Alert', '## Context:\nDetection of unauthorized OAuth applications suggests potential abuse aimed at gaining persistent access to sensitive resources.\n\n### Summary:\n- **Applications Identified:** Several OAuth applications mimicking legitimate services.\n- **Impacted Resources:** Access to email, cloud storage, and internal communication tools.\n- **Countermeasures:**\n  - Immediate removal of unauthorized applications.\n  - Conduct a thorough review of existing OAuth permissions.\n  - Tighten OAuth application approval processes.\n\n### Next Steps:\nMonitor for signs of lateral movement within the cloud environment to preempt further exploitation.', '2026-01-04 23:55:22'),
(149, 27, 436, 4, 'Lateral Movement and Cloud Exploitation Insights', '## Context:\nDetection of lateral movement within the cloud environment indicates potential exploitation following OAuth abuse.\n\n### Summary:\n- **Patterns Observed:**\n  - Access to multiple cloud services using compromised identities.\n  - Unusual escalation of privileges within cloud platforms.\n- **Threat Actors:** Likely linked to known APT groups targeting diplomatic entities.\n- **Defensive Actions:**\n  - Audit and restrict permissions on sensitive resources.\n  - Employ behavior analytics to detect anomalies.\n\n### Next Steps:\nRemain vigilant for any signs of data exfiltration, which may be the next phase of the attack.', '2026-01-04 23:55:22'),
(150, 27, 437, 5, NULL, NULL, '2026-01-04 23:55:22'),
(151, 28, 438, 1, 'Analysis of PowerShell Execution Patterns', '### Context\nFollowing the detection of unusual PowerShell execution, a detailed analysis was conducted to understand the patterns and motives behind this activity.\n\n### Findings\n- **Command Execution**: The PowerShell script was executed with obfuscated commands, suggesting an attempt to evade detection.\n- **Objective**: Initial analysis indicates the possibility of reconnaissance activities, potentially setting up for persistence mechanisms.\n\n### Recommendations\n- **Monitoring**: Enhance logging of PowerShell activities and implement real-time alerts for suspicious command patterns.\n- **Mitigation**: Implement PowerShell script block logging and transcription to capture detailed execution data.\n\n### Next Steps\nPrepare for potential persistence mechanisms, as suggested by the nature of the PowerShell activity. Stay vigilant for suspicious WMI activity.', '2026-01-04 23:57:10'),
(152, 28, 439, 2, 'Investigation into Suspicious WMI Activity', '### Context\nPost detection of suspicious WMI activity, an investigation was launched to determine the scope and impact of this persistence strategy.\n\n### Findings\n- **WMI Usage**: The attacker leveraged WMI to establish persistence, likely by creating event subscriptions to execute malicious scripts upon specific triggers.\n- **Scope**: This activity is consistent with tactics used by Volt Typhoon, indicating a sophisticated threat actor.\n\n### Recommendations\n- **Hardening**: Disable unnecessary WMI services and restrict access to only authorized personnel.\n- **Detection**: Employ advanced monitoring to detect new WMI event subscriptions or alterations to existing ones.\n\n### Next Steps\nPrepare for potential lateral movement, as WMI activity often precedes such actions. Monitor for changes in network configurations or unusual remote access attempts.', '2026-01-04 23:57:10'),
(153, 28, 440, 3, 'Security Implications of Anomalous netsh Configuration', '### Context\nAnomalous changes in netsh configuration were observed, indicating potential lateral movement efforts by the threat actor.\n\n### Findings\n- **Configuration Changes**: The attacker appears to have modified firewall rules and network configurations to facilitate lateral movement within the infrastructure.\n- **Intent**: Such changes are typically employed to bypass network security controls or to establish covert communication channels.\n\n### Recommendations\n- **Review**: Conduct a comprehensive review of all recent netsh configuration changes and validate against security policies.\n- **Prevention**: Implement strict access controls and regular audits on network configuration tools.\n\n### Next Steps\nMonitor for unusual remote desktop protocol (RDP) sessions, which may be utilized for further lateral movement across the network.', '2026-01-04 23:57:10'),
(154, 28, 441, 4, 'Detection of Unusual RDP Sessions', '### Context\nThe detection of unexpected RDP sessions suggests an ongoing lateral movement effort by the attacker within the network.\n\n### Findings\n- **RDP Activity**: Multiple unauthorized RDP sessions were initiated, likely to access sensitive systems and further compromise the infrastructure.\n- **Patterns**: The sessions were conducted using compromised credentials, indicating the threat actor\'s success in credential theft.\n\n### Recommendations\n- **Access Controls**: Enhance RDP access controls and enforce multi-factor authentication for remote access.\n- **Surveillance**: Implement continuous monitoring of RDP sessions and alert on any deviations from normal patterns.\n\n### Next Steps\nRemain alert for potential exfiltration attempts, as attackers may leverage newly gained access to exfiltrate data through encrypted channels.', '2026-01-04 23:57:10'),
(155, 28, 442, 5, NULL, NULL, '2026-01-04 23:57:10'),
(156, 29, 443, 1, 'Analysis of Phishing Email Tactics', '## Overview\nThe phishing email detected appears to be part of a coordinated campaign by Charming Kitten, targeting journalists. The email contains a malicious link disguised as a legitimate news article.\n\n## Detailed Analysis\n- **Sender Details**: The email masquerades as coming from a known media organization, using a spoofed domain closely resembling the legitimate one.\n- **Content**: The email body uses urgent language to entice the recipient to click on the link, promising exclusive content.\n\n## Recommendations\n- **User Awareness**: Encourage recipients to verify the sender\'s email address.\n- **Security Measures**: Implement email filtering and flagging for known malicious domains.\n\n## Next Steps\nPrepare for potential follow-up attacks through other communication channels such as WhatsApp.', '2026-01-04 23:59:37'),
(157, 29, 444, 2, 'Malicious WhatsApp Message Dissection', '## Overview\nFollowing the phishing email, a malicious WhatsApp message was detected, indicating a multi-channel social engineering approach by Charming Kitten.\n\n## Detailed Analysis\n- **Message Content**: The message contains a shortened URL leading to a website hosting the DownPaper backdoor.\n- **Social Engineering Aspect**: The message pretends to be a continuation of the email conversation, increasing credibility.\n\n## Recommendations\n- **User Training**: Advise targets to verify unexpected messages, particularly those with links.\n- **Technical Measures**: Enhance monitoring on communication apps for known malicious URLs.\n\n## Next Steps\nAnticipate potential malware execution if the DownPaper payload is delivered successfully.', '2026-01-04 23:59:37'),
(158, 29, 445, 3, 'DownPaper Backdoor Execution Analysis', '## Overview\nThe DownPaper backdoor has been executed on a system, confirming the delivery method was successful through the malicious WhatsApp message.\n\n## Detailed Analysis\n- **Payload Functionality**: The backdoor establishes a connection to a command and control server, allowing remote access.\n- **Indicators of Compromise**: Look for unusual network traffic and processes related to DownPaper.\n\n## Recommendations\n- **Immediate Action**: Isolate the affected system to prevent further compromise.\n- **Detection Enhancement**: Update endpoint protection to identify DownPaper signatures.\n\n## Next Steps\nMonitor for lateral movement attempts within the network.', '2026-01-04 23:59:37'),
(159, 29, 446, 4, 'Lateral Movement and Data Exfiltration Readiness', '## Overview\nAfter executing the DownPaper backdoor, attempts to move laterally across the network have been detected.\n\n## Detailed Analysis\n- **Movement Techniques**: The attackers are exploiting known vulnerabilities in network protocols to move between systems.\n- **Target Identification**: Critical systems and databases appear to be the focus of these movements.\n\n## Recommendations\n- **Network Segmentation**: Implement stricter segmentation to limit lateral movement.\n- **Patch Management**: Ensure all systems are up-to-date with the latest security patches.\n\n## Next Steps\nPrepare for possible data exfiltration attempts by monitoring outgoing traffic for anomalies.', '2026-01-04 23:59:37'),
(160, 29, 447, 5, NULL, NULL, '2026-01-04 23:59:37'),
(161, 30, 448, 1, 'Initial Access Analysis: VPN Anomaly', '### VPN Login Anomaly\n\nAfter the detection of a suspicious VPN login from an unusual location, further investigation revealed that the credentials used were valid, suggesting potential credential compromise. The login originated from an IP address associated with known malicious activity. Analysts are advised to monitor for any further signs of unauthorized access.\n\n#### Recommendations\n- Immediately reset compromised credentials.\n- Implement geo-restriction policies on VPN access.\n- Increase logging and monitoring on VPN devices.', '2026-01-05 00:02:38');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(162, 30, 449, 2, 'Execution Tactics: Web Shell Deployment', '### Web Shell Detected on VPN Device\n\nA web shell has been detected on the compromised VPN device, indicating execution of potentially malicious code. The web shell allows remote execution of commands and could be used to further infiltrate the network.\n\n#### Recommendations\n- Isolate impacted VPN devices immediately.\n- Conduct a thorough inspection for additional web shells.\n- Patch any vulnerabilities in the VPN firmware.', '2026-01-05 00:02:38'),
(163, 30, 450, 3, 'Lateral Movement Insights: Network Traffic Anomalies', '### Unusual Network Traffic Patterns\n\nPost web shell deployment, there has been unusual network traffic from the VPN device to multiple internal servers. This traffic suggests lateral movement attempts within the network, potentially targeting critical systems or domain controllers.\n\n#### Recommendations\n- Capture and analyze network traffic logs.\n- Deploy network segmentation to limit lateral movement.\n- Increase IDS/IPS sensitivity to detect anomalous traffic.', '2026-01-05 00:02:38'),
(164, 30, 451, 4, 'Persistence Analysis: Domain Controller Access Attempt', '### Unauthorized Domain Controller Access\n\nAn unauthorized access attempt was detected on the domain controller, suggesting efforts to establish persistence. The attacker likely seeks to maintain long-term access to the network.\n\n#### Recommendations\n- Audit domain controller access logs for anomalies.\n- Implement two-factor authentication for sensitive systems.\n- Regularly review and harden domain controller configurations.', '2026-01-05 00:02:38'),
(165, 30, 452, 5, 'Credential Harvesting: Mimikatz Activity', '### Mimikatz Detected on Domain Controller\n\nMimikatz, a tool used for credential harvesting, was detected running on the domain controller. This indicates that the attacker is attempting to extract credentials to escalate privileges and expand access.\n\n#### Recommendations\n- Revoke and reset compromised credentials immediately.\n- Implement endpoint detection and response solutions.\n- Conduct a full security audit of domain controller systems.', '2026-01-05 00:02:38'),
(166, 30, 453, 6, 'Exfiltration Alert: Data Movement from Domain Controller', '### Data Exfiltration Detected\n\nSignificant data exfiltration activity has been detected from the domain controller. This suggests that sensitive information has been compromised and potentially transferred outside the network.\n\n#### Recommendations\n- Identify and secure the data exfiltration point.\n- Implement data loss prevention tools.\n- Notify relevant stakeholders and legal entities as per compliance requirements.', '2026-01-05 00:02:38'),
(167, 30, 454, 7, NULL, NULL, '2026-01-05 00:02:38'),
(168, 32, 455, 1, 'Post-Compromise Analysis: Third-Party Library Breach', '### Overview\nThe initial alert identified a compromise via a third-party library, suggesting a supply chain attack. This indicates a breach at the level of software dependencies, commonly exploited by Magecart groups.\n\n### Technical Details\n- **Vulnerable Library**: The breach originated from a popular JavaScript library commonly used for e-commerce platforms.\n- **Attack Vector**: The attackers injected malicious code into the library before distribution, affecting all sites utilizing the compromised version.\n\n### Recommendations\n- **Immediate Actions**: Remove the compromised library version from your systems and monitor for any unusual activity.\n- **Long-term Strategy**: Implement a robust dependency tracking system and regularly audit third-party code for vulnerabilities.\n\n### Next Steps\nPrepare for potential **Code Injection** activities, as malicious scripts are likely to be executed on compromised websites.', '2026-01-05 00:07:01'),
(169, 32, 456, 2, 'Execution of Obfuscated JavaScript: Code Injection Analysis', '### Overview\nFollowing the supply chain compromise, obfuscated JavaScript has been detected executing within the affected websites. This is a classic Magecart tactic aimed at capturing sensitive user data.\n\n### Technical Details\n- **Obfuscation Method**: The JavaScript code uses advanced obfuscation techniques to avoid detection by standard security tools.\n- **Functionality**: The script is designed to skim credit card information entered on checkout pages and store it temporarily before exfiltration.\n\n### Recommendations\n- **Immediate Actions**: Deploy advanced threat detection tools capable of de-obfuscating and analyzing JavaScript code in real-time.\n- **Mitigation Strategy**: Harden your Content Security Policy (CSP) to restrict unauthorized script execution.\n\n### Next Steps\nPrepare for **Data Exfiltration** as the attackers will attempt to transfer skimmed data to their drop servers. Monitor outgoing network traffic for anomalies.', '2026-01-05 00:07:01'),
(170, 32, 457, 3, NULL, NULL, '2026-01-05 00:07:01'),
(171, 33, 458, 1, 'Initial Access Analysis: Vendor Login Anomaly', '## Investigation Summary\nThe suspicious vendor login detected indicates potential unauthorized access to the retail network. The login was traced back to an IP address known for previous cyber activities linked to the FIN6 group.\n\n## Incident Details\n- **Date & Time**: [Timestamp]\n- **Source IP**: [Suspicious IP Address]\n- **Affected System**: Vendor portal\n\n## Recommendations\n- Immediately review access logs for the vendor portal.\n- Implement multi-factor authentication for vendor accounts.\n- Conduct a security audit of all vendor credentials.\n\n## Next Steps\nPrepare for potential escalation of activities, such as malware deployment, given historical patterns of FIN6 operations.', '2026-01-05 00:10:13'),
(172, 33, 459, 2, 'Trinity Malware Deployment on POS Systems', '## Incident Overview\nFollowing the initial access, Trinity malware has been deployed across multiple POS systems. This malware is engineered to scrape sensitive credit card data.\n\n## Key Indicators\n- **Malware Signature**: Trinity (v2.5)\n- **Affected Systems**: POS terminals at multiple retail locations\n- **Detection Method**: Anomalous network traffic and unusual process activity\n\n## Containment Measures\n- Isolate affected POS systems from the network.\n- Begin forensic imaging of compromised systems for deeper analysis.\n\n## Next Steps\nFocus on understanding the method of persistence that the attackers may employ to maintain access within the network.', '2026-01-05 00:10:13'),
(173, 33, 460, 3, 'Persistence Mechanisms: Ensuring Long-term Access', '## Persistence Tactics\nFollowing the Trinity malware deployment, evidence suggests the attackers are establishing persistence mechanisms to secure long-term access.\n\n## Observations\n- **Backdoor Installations**: Detected across several POS systems.\n- **Registry Alterations**: Unusual changes consistent with persistence techniques.\n- **Scheduled Tasks**: Newly created tasks that execute malicious scripts.\n\n## Recommendations\n- Perform a comprehensive review of system startup entries and scheduled tasks.\n- Remove unauthorized backdoors and restore registry settings to default.\n\n## Next Steps\nMonitor for lateral movement attempts as attackers may seek to expand their foothold within the network.', '2026-01-05 00:10:13'),
(174, 33, 461, 4, 'Lateral Movement Detected: Expanding Attack Surface', '## Movement Patterns\nUnauthorized lateral movement has been detected, suggesting an expansion of the attack surface by FIN6 operatives.\n\n## Indicators of Compromise\n- **Credential Harvesting**: Attempts to access additional systems using compromised credentials.\n- **Network Scanning**: Scans targeting lateral movement pathways.\n- **Unauthorized Access**: Attempts to access HR and financial systems.\n\n## Containment Strategies\n- Implement network segmentation to restrict unauthorized access.\n- Reset credentials for all potentially compromised accounts.\n\n## Next Steps\nPrepare for potential data exfiltration attempts, focusing particularly on sensitive financial data.', '2026-01-05 00:10:13'),
(175, 33, 462, 5, NULL, NULL, '2026-01-05 00:10:13'),
(176, 34, 463, 1, 'Execution of Embedded VBScript Backdoor Uncovered', '### Overview\nFollowing the initial access achieved through a weaponized Word document, further investigation has revealed the execution of an embedded VBScript backdoor. This backdoor is activated as soon as the document is opened by the target, exploiting vulnerabilities in VBScript execution.\n\n### Technical Details\nThe VBScript is designed to run in the background, establishing persistent access to the compromised system. It leverages Windows Management Instrumentation (WMI) to execute commands and maintain a foothold.\n\n### Indicators of Compromise (IOCs)\n- Unusual network traffic originating from the affected host.\n- Creation of scheduled tasks or registry entries linked to VBScript execution.\n\n### Recommendations\n- Implement strict email filtering to block potentially malicious attachments.\n- Educate personnel on recognizing phishing attempts and suspicious document behaviors.', '2026-01-05 02:59:34'),
(177, 34, 464, 2, 'Data Exfiltration via Encrypted Channels Identified', '### Overview\nThe previously identified VBScript backdoor has facilitated data exfiltration activities. Our analysis indicates that sensitive information is being transmitted through encrypted channels, making detection more challenging.\n\n### Technical Details\nThe data exfiltration process involves packaging sensitive files into encrypted archives, which are then transmitted to remote servers controlled by the threat actors. The use of HTTPS and other encrypted protocols obscures the content from standard monitoring tools.\n\n### Indicators of Compromise (IOCs)\n- Outbound connections to unfamiliar IP addresses using HTTPS.\n- Unusual data transfer volumes at odd hours.\n\n### Recommendations\n- Deploy network anomaly detection systems to identify unusual patterns in encrypted traffic.\n- Conduct regular audits of data access and transfer logs to spot unauthorized activities.\n- Strengthen endpoint security measures to detect and block unauthorized encryption tools.', '2026-01-05 02:59:34'),
(178, 34, 465, 3, NULL, NULL, '2026-01-05 02:59:34'),
(179, 35, 466, 1, 'Insight into Initial Access: Trojanized Software Update', '### Contextual Analysis\n\nFollowing the detection of the **trojanized software update**, our investigation reveals that the compromise occurred through a sophisticated supply chain attack. The malicious update originates from a compromised vendor responsible for developing ICS software used widely in the energy sector.\n\n### Key Observations:\n- **Vendor Breach**: Initial analysis suggests that the vendor\'s software distribution infrastructure was breached approximately 3 months ago.\n- **Malware Characteristics**: The trojanized update includes a payload designed to install a Remote Access Trojan (RAT) known as \'Havex\'.\n\n### Next Steps:\n- **Monitor for RAT Deployment**: Be vigilant for signs of \'Havex\' RAT installation and execution across affected systems.\n- **Vendor Communication**: Engage with the software vendor to confirm breach details and remediation plans.', '2026-01-05 03:02:42'),
(180, 35, 467, 2, 'Execution of \'Havex\' RAT: Command and Control Infrastructure', '### Incident Overview\n\nPost-deployment of the **\'Havex\' RAT**, communication with its command and control (C2) servers has been observed. This RAT allows adversaries remote control over infected machines, enabling further reconnaissance and exploitation.\n\n### Key Indicators:\n- **C2 Domains**: Infected systems connect to multiple C2 domains, some of which have been newly registered and others linked to known threat actor infrastructure.\n- **RAT Capabilities**: The \'Havex\' RAT is capable of gathering system information, executing commands, and facilitating lateral movement.\n\n### Actionable Intelligence:\n- **Registry Monitoring**: Prepare to detect persistence mechanisms, particularly involving registry modifications.\n- **Network Segmentation**: Implement stricter network segmentation to limit RAT communication and lateral movement.', '2026-01-05 03:02:42'),
(181, 35, 468, 3, 'Persistence Mechanism: Registry Modifications Detected', '### Persistence Analysis\n\nThe adversary has employed **registry modifications** to ensure the \'Havex\' RAT remains active. This persistence mechanism involves altering system configurations to execute the RAT upon system startup.\n\n### Technical Details:\n- **Registry Keys Altered**: Modifications have been observed in key areas responsible for startup execution, specifically within `HKEY_LOCAL_MACHINE` and `HKEY_CURRENT_USER` paths.\n- **Stealth Tactics**: The changes are subtle, designed to evade typical detection methods by mimicking legitimate entries.\n\n### Recommendations:\n- **Conduct Integrity Checks**: Regularly verify registry integrity against known good baselines.\n- **Prepare for Lateral Movement**: Anticipate network reconnaissance activities, specifically anomalies in SMB traffic.', '2026-01-05 03:02:42'),
(182, 35, 469, 4, 'Lateral Movement: SMB Traffic Anomaly and Network Reconnaissance', '### Network Activity Review\n\nUnusual **SMB traffic patterns** indicate ongoing **lateral movement** and reconnaissance activities. This phase involves mapping the network to identify high-value targets for data exfiltration.\n\n### Traffic Analysis:\n- **Suspicious Connections**: Multiple SMB connections initiated from compromised hosts targeting administrative shares.\n- **Reconnaissance Tools**: Use of known tools such as `PsExec` and `WMIC` to explore network topology and access additional systems.\n\n### Defensive Measures:\n- **Anomaly Detection**: Enhance monitoring for unusual SMB traffic and lateral movement activities.\n- **Data Exfiltration Monitoring**: Prepare to intercept unauthorized data transfers, particularly those involving sensitive operational data.', '2026-01-05 03:02:42'),
(183, 35, 470, 5, NULL, NULL, '2026-01-05 03:02:42'),
(184, 36, 471, 1, 'Unsigned Software Update Detected', '## Overview\nFollowing the detection of suspicious Wi-Fi network activity, a potential threat has been identified involving an unsigned software update. This update appears to be disguised as a legitimate system or application update targeting luxury hotel executives.\n\n## Details\n- **Type of Threat:** Tapaoux malware\n- **Method of Delivery:** Wi-Fi network masquerading as a trusted access point\n- **Target:** Executives of luxury hotels\n\n## Recommendations\n- **Network Monitoring:** Enhance monitoring of Wi-Fi networks for unauthorized access points.\n- **Software Verification:** Ensure all updates are signed and verified before installation.\n\n## Next Steps\nInvestigate the execution phase to determine if the malware has been successfully deployed onto target systems.', '2026-01-05 03:04:49'),
(185, 36, 472, 2, 'Tapaoux Malware Persistence Mechanism', '## Overview\nAfter identifying the unsigned software update, further investigation reveals the Tapaoux malware has established persistence mechanisms in the target systems.\n\n## Details\n- **Persistence Techniques:** The malware modifies startup scripts and registry keys to ensure it executes upon system reboot.\n- **Stealth Tactics:** It employs obfuscation techniques to evade detection by traditional antivirus solutions.\n\n## Recommendations\n- **System Hardening:** Regularly review and limit startup scripts and registry changes.\n- **Advanced Threat Protection:** Deploy solutions capable of detecting obfuscated code.\n\n## Next Steps\nExamine potential unauthorized credential access attempts as the malware may be moving laterally within the network.', '2026-01-05 03:04:49'),
(186, 36, 473, 3, 'Unauthorized Credential Access Attempt', '## Overview\nFollowing the establishment of persistence by Tapaoux malware, there have been attempts to access credentials within the compromised systems.\n\n## Details\n- **Credential Harvesting:** The malware attempts to extract cached credentials from browsers and network authentication processes.\n- **Potential Targets:** Emails, financial applications, and internal corporate networks.\n\n## Recommendations\n- **Credential Management:** Enforce multi-factor authentication and regular credential updates.\n- **Incident Response:** Conduct a thorough review of access logs to identify any anomalies.\n\n## Next Steps\nMonitor for potential exfiltration of sensitive data, which could indicate further stages of the attack.', '2026-01-05 03:04:49'),
(187, 36, 474, 4, 'Exfiltration of Sensitive Data', '## Overview\nAs anticipated, there is evidence of data exfiltration following the unauthorized credential access attempts. Sensitive information has been transferred out of the network.\n\n## Details\n- **Data Types:** Financial records, personal information of executives, and proprietary business data.\n- **Exfiltration Channels:** Utilization of encrypted channels and cloud services to circumvent detection.\n\n## Recommendations\n- **Data Loss Prevention:** Implement solutions to monitor and block unauthorized data transfers.\n- **Forensic Analysis:** Conduct a comprehensive forensic analysis to understand the scale and impact of the data breach.\n\n## Next Steps\nInitiate containment procedures to prevent further data loss and begin remediation efforts to secure the network.', '2026-01-05 03:04:49'),
(188, 36, 475, 5, NULL, NULL, '2026-01-05 03:04:49'),
(189, 37, 476, 1, 'Analysis of Malicious Payload Execution via RoyalRoad Exploit', '### Overview\nFollowing the detection of a suspicious email containing a malicious RTF attachment, further investigation reveals the exploitation of the RoyalRoad vulnerability. The RoyalRoad exploit has been utilized to execute a malicious payload on the target system.\n\n### Technical Details\n- **Exploit Method**: The RTF attachment leverages a known vulnerability in Microsoft Office to execute arbitrary code.\n- **Payload**: The payload includes scripts that prepare the environment for further exploitation.\n\n### Implications\nThe successful execution of this payload indicates a sophisticated attack vector likely aiming to establish deeper system access.\n\n### Next Steps\n- Monitor for any signs of persistence mechanisms being established.\n- Conduct a detailed forensic analysis of the affected systems.', '2026-01-05 03:08:29'),
(190, 37, 477, 2, 'Persistence Mechanism via Aria-body Backdoor', '### Overview\nFollowing the execution of the RoyalRoad exploit, analysis identifies the installation of the Aria-body backdoor. This backdoor is designed to maintain persistent access to the compromised systems.\n\n### Technical Details\n- **Backdoor Functionality**: The Aria-body backdoor allows the attacker to maintain a foothold in the network and execute commands remotely.\n- **Persistence Method**: The backdoor is embedded within legitimate system processes, making detection challenging.\n\n### Implications\nEstablishing persistence is a critical step for the attacker to facilitate further actions, including lateral movement.\n\n### Recommendations\n- Implement enhanced monitoring for unusual network activities.\n- Initiate a comprehensive review of system logs to identify any signs of lateral movement.', '2026-01-05 03:08:29'),
(191, 37, 478, 3, 'Lateral Movement Analysis Across Internal Network', '### Overview\nInvestigation into the Aria-body backdoor has unveiled signs of lateral movement within the internal network. The attacker appears to be exploring the network to identify valuable targets.\n\n### Technical Details\n- **Movement Techniques**: The attacker utilizes legitimate credentials and tools to access other systems within the network.\n- **Targets Identified**: Several high-value systems have been accessed, indicating a targeted approach.\n\n### Implications\nThe lateral movement poses a significant risk as it suggests the attacker is positioning themselves for data exfiltration.\n\n### Countermeasures\n- Conduct a thorough audit of user accounts and permissions.\n- Isolate affected systems to prevent further unauthorized access.', '2026-01-05 03:08:29'),
(192, 37, 479, 4, 'Data Exfiltration to Command and Control Server', '### Overview\nSubsequent to the lateral movement activities, evidence of data exfiltration has been detected. Data is being transmitted to an external Command and Control (C2) server.\n\n### Technical Details\n- **Exfiltration Method**: The data is being exfiltrated over encrypted channels to evade detection.\n- **Type of Data**: Preliminary analysis suggests sensitive organizational data is being targeted.\n\n### Implications\nData exfiltration represents a critical breach of security and potential disclosure of sensitive information.\n\n### Immediate Actions\n- Block known C2 server IPs and domains.\n- Initiate an incident response protocol to contain and mitigate the breach.\n- Notify relevant stakeholders and begin a post-incident analysis to prevent future occurrences.', '2026-01-05 03:08:29'),
(193, 37, 480, 5, NULL, NULL, '2026-01-05 03:08:29'),
(194, 39, 481, 1, 'Unauthorized CMS Article Publication: Initial Access and Indicators', '### Overview\nUpon detecting a suspicious login, further analysis revealed unauthorized activity within the CMS. This activity is characterized by the creation and publication of articles containing misleading information.\n\n### Details\n- **Entry Point**: Exploitation of CMS vulnerabilities allowing remote access.\n- **Indicators of Compromise (IoCs)**: Abnormal login times, unfamiliar IP addresses, and modifications to content templates.\n\n### Recommendations\n- Immediate review and audit of CMS access logs.\n- Implementation of multi-factor authentication for CMS access.\n- Increase monitoring of content changes and publication activities.', '2026-01-05 03:22:52'),
(195, 39, 482, 2, 'Backdoor Account Creation: Ensuring Persistence', '### Overview\nFollowing the unauthorized publication of articles, further investigation uncovered the creation of backdoor accounts within the CMS to maintain persistent access.\n\n### Details\n- **Objective**: Establish long-term access to manipulate media content.\n- **Method**: Accounts created using compromised credentials or exploiting CMS administrative functions.\n\n### Indicators\n- New accounts with administrative privileges created without authorization.\n- Unusual account activity patterns.\n\n### Recommendations\n- Conduct a thorough review of all CMS accounts and privileges.\n- Enforce stricter user access controls and regular audits.', '2026-01-05 03:22:52'),
(196, 39, 483, 3, 'Social Media Amplification Detected: Expanding Influence', '### Overview\nWith the establishment of persistence via backdoor accounts, the operation has moved to social media platforms to amplify misinformation.\n\n### Details\n- **Tactics**: Use of bot networks and sockpuppet accounts to spread content.\n- **Platforms Targeted**: Prominent social media platforms where misinformation can quickly gain traction.\n\n### Indicators\n- Spike in social media activity related to the published misinformation.\n- Rapid increase in shares and likes from newly created or suspicious accounts.\n\n### Recommendations\n- Collaborate with social media platforms to identify and suspend malicious accounts.\n- Deploy AI-based tools to detect and mitigate bot-driven amplification.', '2026-01-05 03:22:52'),
(197, 39, 484, 4, 'Data Exfiltration Attempt Detected: Protecting Sensitive Information', '### Overview\nFollowing the amplification of misinformation, attempts have been made to exfiltrate sensitive data, potentially to leverage for further influence operations or blackmail.\n\n### Details\n- **Objective**: Extract sensitive data from compromised systems.\n- **Methods**: Use of encrypted channels and covert data transfer techniques.\n\n### Indicators\n- Unusual outbound data traffic patterns detected.\n- Use of unapproved encryption tools and protocols.\n\n### Recommendations\n- Immediate lockdown of affected systems to prevent further data loss.\n- Conduct a comprehensive forensic analysis to understand the scope of the breach.\n- Enhance data loss prevention mechanisms and user training on data security.', '2026-01-05 03:22:52'),
(198, 39, 485, 5, NULL, NULL, '2026-01-05 03:22:52'),
(199, 40, 486, 1, 'Compromised Supplier Network: Initial Access Analysis', '### Background\n\nFollowing the initial alert of a **Supply Chain Compromise**, intelligence indicates that APT41 has infiltrated a key supplier network within the gaming industry. This breach was achieved through the exploitation of a vulnerable third-party software component.\n\n### Implications\n\n- **Potential Threat**: The compromised supplier can act as a distribution point for malicious payloads like ShadowPad.\n- **Scope of Access**: Initial entry points can provide adversaries with broad access to the target\'s supply chain, making subsequent attacks more stealthy and impactful.\n\n### Recommendations\n\n- **Immediate Action**: Initiate a full review of all supplier network access points and enhance monitoring for abnormal activity.\n- **Preventive Measures**: Strengthen supplier security standards and conduct regular security audits.', '2026-01-05 03:26:48'),
(200, 40, 487, 2, 'Code Injection Detection in Build Environment', '### Overview\n\nFollowing the **Code Injection** alert, it has been detected that APT41 executed malicious code within the build environment of a key gaming application.\n\n### Details of the Attack\n\n- **Vector**: The adversary leveraged the compromised supplier credentials to inject malicious scripts into the build server.\n- **Target**: This code aims to facilitate the deployment of ShadowPad, enabling further infiltration.\n\n### Impact\n\n- **Integrity Risk**: Code integrity is compromised, potentially affecting all downstream applications.\n- **Propagation**: The injected code can propagate malicious payloads to end-user devices.\n\n### Mitigation Steps\n\n- **Immediate Scrutiny**: Conduct a thorough audit of the build environment for unauthorized changes.\n- **Verification**: Validate integrity of application updates before deployment.', '2026-01-05 03:26:48'),
(201, 40, 488, 3, 'ShadowPad Backdoor Installation and Persistence', '### Situation Update\n\nPost the execution phase, APT41 has successfully established persistence through the installation of the **ShadowPad backdoor**.\n\n### Mechanism of Persistence\n\n- **Backdoor Features**: ShadowPad is known for its modular architecture, allowing dynamic loading of plugins for various malicious functions.\n- **Stealth Techniques**: Utilizes encrypted communication and masquerades as legitimate software processes.\n\n### Strategic Implications\n\n- **Long-Term Access**: Persistent access enables ongoing espionage and potential sabotage.\n- **Network Vulnerability**: Ongoing risk of lateral movement within the network.\n\n### Defensive Measures\n\n- **Enhanced Monitoring**: Deploy behavioral analytics to detect abnormal patterns indicative of backdoor activity.\n- **System Hardening**: Apply security patches and restrict administrative privileges.', '2026-01-05 03:26:48'),
(202, 40, 489, 4, 'Credential Dumping and Lateral Movement', '### Current Threat Landscape\n\nAs the operation progresses, APT41 has initiated **Lateral Movement** across the player networks by exploiting dumped credentials.\n\n### Attack Dynamics\n\n- **Credential Access**: Utilizing stolen credentials, adversaries gain access to additional systems within the network.\n- **Movement Strategy**: Focused on reaching high-value targets and exfiltrating sensitive data.\n\n### Consequences\n\n- **Increased Exposure**: Compromised credentials lead to expanded access and control over network resources.\n- **Data Breach Risk**: Heightened risk of sensitive player data being accessed and exfiltrated.\n\n### Countermeasures\n\n- **Credential Hygiene**: Enforce password complexity and regular changes.\n- **Access Controls**: Implement multi-factor authentication and continuous monitoring of user activities.', '2026-01-05 03:26:48'),
(203, 40, 490, 5, NULL, NULL, '2026-01-05 03:26:48'),
(204, 41, 491, 1, 'Follow-up on Suspicious Email Attachment', '## Overview\nUpon detection of a suspicious email attachment, further analysis revealed that the email originated from a compromised server known to be associated with the Lazarus Group. This server previously engaged in spear-phishing campaigns targeting defense contractors.\n\n## Key Findings\n- **Sender Information**: The email appeared to be sent from a legitimate contact within the organization, suggesting email spoofing techniques were employed.\n- **Attachment Details**: The attachment was a macro-enabled Excel document designed to execute a malicious payload upon opening.\n\n## Recommendations\n- **Immediate Action**: Instruct recipients to delete the email without opening the attachment.\n- **Preventive Measures**: Enhance email gateway security to filter out similar threats.', '2026-01-05 04:01:18'),
(205, 41, 492, 2, 'DTrack Payload Execution Analysis', '## Overview\nThe execution of the DTrack malware payload marks a significant escalation in the attack, indicating a shift from reconnaissance to active exploitation.\n\n## Key Findings\n- **Payload Behavior**: DTrack is known for its ability to perform file operations, execute commands, and communicate with command and control (C2) servers.\n- **C2 Communication**: Encrypted traffic was detected heading to known Lazarus Group-controlled IP addresses.\n\n## Recommendations\n- **Immediate Action**: Quarantine affected systems to prevent further spread.\n- **Forensic Analysis**: Conduct a detailed forensic analysis of infected machines to understand the extent of compromise.', '2026-01-05 04:01:18'),
(206, 41, 493, 3, 'Persistence Mechanism - DLL Hijacking', '## Overview\nThe attackers are leveraging DLL hijacking to maintain persistence on compromised systems, a technique commonly used by the Lazarus Group to ensure their presence remains undetected.\n\n## Key Findings\n- **DLL Injection**: Malicious DLLs are injected into commonly used applications, allowing them to execute under the guise of legitimate processes.\n- **Registry Modifications**: Changes in registry keys have been detected, redirecting legitimate application paths to malicious DLLs.\n\n## Recommendations\n- **Immediate Action**: Review and restore altered registry keys to their original state.\n- **Monitoring**: Implement enhanced monitoring of DLL loads across critical systems.', '2026-01-05 04:01:18'),
(207, 41, 494, 4, 'Lateral Movement via Pass-the-Hash', '## Overview\nThe attack has progressed to lateral movement within the network using Pass-the-Hash techniques, indicating a high level of sophistication and access.\n\n## Key Findings\n- **Credential Abuse**: Compromised credentials were used to authenticate across multiple systems without the need for password cracking.\n- **Targeted Systems**: High-value targets such as servers containing sensitive defense schematics have been identified as primary targets.\n\n## Recommendations\n- **Immediate Action**: Invalidate all compromised credentials and enforce password resets.\n- **Network Segmentation**: Implement network segmentation to limit lateral movement capabilities.', '2026-01-05 04:01:18'),
(208, 41, 495, 5, NULL, NULL, '2026-01-05 04:01:18'),
(209, 42, 496, 1, 'Analysis of Initial Access via Suspicious Domain', '### Context\nFollowing the detection of suspicious domain access, further investigation reveals that the domains in question are linked to a known CopyKittens infrastructure. These domains have been associated with phishing campaigns targeting government entities.\n\n### Findings\n- **Domain Characteristics**: The domains exhibit patterns typical of CopyKittens, such as misspelled names of legitimate organizations.\n- **Vector Analysis**: Initial access is likely achieved through spear-phishing emails containing malicious links or attachments.\n\n### Recommendations\n- Implement enhanced email filtering rules to detect and block phishing attempts.\n- Conduct employee training on recognizing phishing emails.', '2026-01-05 04:03:11'),
(210, 42, 497, 2, 'Matryoshka RAT Execution and Behavioral Indicators', '### Context\nAfter the execution of the Matryoshka RAT, telemetry data indicates the deployment of the RAT on compromised systems.\n\n### Findings\n- **Execution Patterns**: The RAT is executed using script-based loaders, often leveraging PowerShell or JavaScript.\n- **Persistence Mechanisms**: Scheduled tasks and registry modifications have been identified as methods to ensure persistence.\n\n### Recommendations\n- Conduct system-wide scans for registry anomalies and unauthorized scheduled tasks.\n- Implement application whitelisting to prevent the execution of unauthorized scripts.', '2026-01-05 04:03:13'),
(211, 42, 498, 3, 'DNS Tunneling Activity and Persistence Tactics', '### Context\nThe identification of DNS tunneling activity signifies an attempt by the attackers to maintain a covert communication channel with the compromised systems.\n\n### Findings\n- **Tunneling Details**: Encoded DNS queries and responses are used to bypass traditional network monitoring.\n- **Infrastructure**: Analysis shows multiple subdomains dynamically resolving to various IP addresses, indicating a sophisticated command and control (C2) setup.\n\n### Recommendations\n- Deploy DNS monitoring solutions to identify and block tunneling activities.\n- Implement strict outbound DNS policies to prevent unauthorized queries.', '2026-01-05 04:03:13'),
(212, 42, 499, 4, 'Lateral Movement Indicators and Network Traffic Analysis', '### Context\nUnusual network traffic patterns suggest lateral movement within the network as attackers attempt to access sensitive systems.\n\n### Findings\n- **Traffic Anomalies**: High-volume data transfers and unusual port activity have been observed.\n- **Compromised Credentials**: Evidence suggests the use of harvested credentials to access additional systems.\n\n### Recommendations\n- Enhance network segmentation to limit lateral movement potential.\n- Conduct a thorough audit of user accounts and implement multi-factor authentication (MFA).', '2026-01-05 04:03:13'),
(213, 42, 500, 5, NULL, NULL, '2026-01-05 04:03:13'),
(214, 43, 501, 1, 'Profile Analysis of Unverified Facebook Account', '### Overview\nThe suspicious Facebook profile involved in the initial alert appears to have been created recently, lacking personal details and typical user activity. This is indicative of a potential fake persona used for social engineering.\n\n### Details\n- **Profile Name:** John Doe\n- **Creation Date:** 2 weeks ago\n- **Mutual Connections:** 0\n- **Activity:** Minimal posts, all generic\n\n### Analysis\nThis profile likely serves as a vector for social engineering, aimed at establishing trust with targets within aerospace firms. Recommend monitoring for further interactions and cross-referencing with other suspicious profiles.', '2026-01-06 01:24:23'),
(215, 43, 502, 2, 'Phishing Attempt via Direct Message', '### Overview\nA phishing attempt was identified following the interaction with the suspicious Facebook profile. An employee received a direct message containing a malicious link, masquerading as an industry-related article.\n\n### Details\n- **Sender:** Unverified Facebook Profile\n- **Message Content:** \'Check out this article on latest aerospace innovations\' with a shortened link.\n- **Intended Target:** Senior Engineer in R&D\n\n### Recommendations\n- **Immediate Action:** Block sender and delete message.\n- **Awareness Training:** Reinforce phishing awareness among staff, emphasizing caution with unsolicited messages.', '2026-01-06 01:24:23'),
(216, 43, 503, 3, 'Detection of \'Gholee\' Malware Execution', '### Overview\nThe execution of the \'Gholee\' malware was detected on a compromised system within the aerospace firm\'s network. The malware was likely deployed following the successful phishing attempt.\n\n### Details\n- **Affected System:** Workstation of Senior Engineer\n- **Malware Characteristics:** Known for data harvesting and creating backdoors\n- **Detection Method:** Anomaly detection via endpoint security solution\n\n### Recommendations\n- **Containment:** Isolate affected systems immediately.\n- **Forensic Analysis:** Conduct a detailed analysis to understand entry points and potential data affected.', '2026-01-06 01:24:23'),
(217, 43, 504, 4, 'Persistence Mechanisms Established by \'Gholee\'', '### Overview\nFurther analysis revealed that \'Gholee\' malware has established persistence mechanisms, ensuring its survival through system reboots and security updates.\n\n### Details\n- **Persistence Techniques:** \n  - Registry key modifications\n  - Scheduled tasks creation\n  - DLL injection into legitimate processes\n\n### Countermeasures\n- **Immediate Actions:** Remove persistence mechanisms by restoring registry keys and disabling scheduled tasks.\n- **Monitoring:** Enhance system logging to detect future persistence attempts.', '2026-01-06 01:24:23'),
(218, 43, 505, 5, 'Lateral Movement Across Network', '### Overview\nFollowing the establishment of persistence, lateral movement was detected across the network, likely aimed at accessing sensitive data and escalating privileges.\n\n### Details\n- **Techniques Used:**\n  - Pass-the-Hash\n  - Remote Desktop Protocol exploitation\n- **Affected Systems:** Multiple workstations and servers in the R&D department\n\n### Recommendations\n- **Network Segmentation:** Implement stricter segmentation to limit lateral movement.\n- **Credential Management:** Enforce strong, unique passwords and regular changes.\n- **Incident Response:** Conduct a full network sweep to identify and neutralize further threats.', '2026-01-06 01:24:23'),
(219, 43, 506, 6, NULL, NULL, '2026-01-06 01:24:23'),
(220, 44, 507, 1, 'Analysis of Malicious Code Execution', '## Context\nAfter the initial breach detected via EternalBlue, the adversary has executed malicious code on the compromised system. This report delves into the observed remote code execution (RCE) activities.\n\n## Findings\n- **Payload Analyzed**: The executed payload is identified as a variant of the WannaCry ransomware, designed to encrypt files on the infected machines.\n- **Execution Method**: The payload is executed using the exploitation of the SMBv1 vulnerability, allowing for unauthenticated remote code execution.\n- **Immediate Actions**: Mitigation strategies should include disabling SMBv1 and ensuring robust network segmentation to limit the damage of any further RCE attempts.', '2026-01-06 01:34:24'),
(221, 44, 508, 2, 'Persistence Mechanisms in Place', '## Overview\nFollowing the execution of malicious code, the ransomware has established persistence to survive system reboots and maintain control over the infected systems.\n\n## Details\n- **Techniques Used**: The ransomware modifies registry keys and schedules tasks to trigger on startup, ensuring its presence on the system.\n- **Potential Countermeasures**: Immediate actions include reviewing and cleaning registry keys and scheduled tasks, and implementing endpoint detection and response (EDR) solutions to monitor for persistence attempts.', '2026-01-06 01:34:24'),
(222, 44, 509, 3, 'SMB Propagation Analysis', '## Introduction\nThe ransomware is now actively propagating through the network using SMB protocol vulnerabilities. This report outlines the observed lateral movement patterns.\n\n## Observations\n- **Propagation Method**: Utilizes the EternalBlue exploit to spread to other vulnerable machines within the network.\n- **Network Mapping**: The ransomware scans the network for other vulnerable hosts, exponentially increasing its reach.\n- **Recommendations**: Immediate patching of all systems against SMBv1 vulnerabilities and isolation of affected subnets are critical to contain the spread.', '2026-01-06 01:34:24'),
(223, 44, 510, 4, 'Kill-Switch Domain Investigation', '## Summary\nA potential kill-switch domain has been identified, which could deactivate the ransomware if successfully queried.\n\n## Investigation\n- **Domain Analysis**: The domain has been hardcoded into the malware as a potential stop mechanism.\n- **Actionable Steps**: Conduct DNS sinkholing experiments to assess the feasibility of activating the kill-switch. Consider collaborating with global ISPs for widespread DNS monitoring.', '2026-01-06 01:34:24'),
(224, 44, 511, 5, 'Encryption Logic Breakdown', '## Overview\nThe ransomware has begun encrypting files on compromised systems. This report provides an analysis of its encryption logic.\n\n## Technical Details\n- **Encryption Algorithm**: Utilizes a combination of RSA and AES to encrypt files, ensuring robustness and difficulty in decryption without the private key.\n- **File Types Targeted**: Focuses on commonly used document and multimedia file formats.\n- **Countermeasures**: Regular backups and data recovery plans are essential. Evaluate the feasibility of deploying decryption tools if available.', '2026-01-06 01:34:24'),
(225, 44, 512, 6, 'Data Exfiltration Attempt Analysis', '## Context\nAs the ransomware encrypts data, it is also attempting to exfiltrate sensitive information from the compromised systems.\n\n## Key Insights\n- **Exfiltration Channels**: Observed usage of non-standard ports and encrypted protocols for data exfiltration attempts.\n- **Data Types at Risk**: Includes personally identifiable information (PII) and corporate intellectual property.\n- **Defense Strategies**: Immediate network traffic analysis and blocking suspicious outbound connections can mitigate data loss. Implement data loss prevention (DLP) solutions to monitor sensitive data movement.', '2026-01-06 01:34:24'),
(226, 44, 513, 7, 'Ransom Note Deployment and Impact', '## Summary\nThe deployment of ransom notes signifies the completion of the ransomware\'s encryption cycle and the demand for payment.\n\n## Insights\n- **Demand Details**: The ransom note typically demands payment in cryptocurrency, providing instructions for victims.\n- **Psychological Impact**: The presence of the ransom note induces urgency and panic, often leading to hasty decision-making.\n- **Recommendations**: Encourage organizations to have a clear incident response plan and avoid paying the ransom. Leverage law enforcement and cybersecurity partnerships for support.', '2026-01-06 01:34:24'),
(227, 44, 514, 8, NULL, NULL, '2026-01-06 01:34:24'),
(228, 45, 515, 1, 'In-Depth Analysis of Supply Chain Compromise', '### Overview\nThe initial alert indicates a compromised software update, typical of a supply chain attack. This technique is often employed to distribute malicious payloads widely and stealthily.\n\n### Key Findings\n- **Vendor Involvement**: The compromised update originated from a trusted vendor, indicating possible unauthorized access to their infrastructure.\n- **Distribution Scope**: Initial analysis suggests a widespread distribution affecting multiple sectors.\n\n### Recommendations\n- **Immediate Patch Review**: Verify the integrity of all recent updates and patches from associated vendors.\n- **Network Segmentation**: Implement network segmentation to contain any potential spread of malicious activity.\n\n### Next Steps\nWe anticipate potential destructive activities following the introduction of malicious components. Monitor for unusual disk activity, which may indicate MBR overwriting.', '2026-01-06 01:37:06'),
(229, 45, 516, 2, 'MBR Overwriting Detected: Sandworm\'s Signature', '### Overview\nFollowing the compromised software update, we have observed Master Boot Record (MBR) overwriting activity. This is a destructive action characteristic of Sandworm\'s tactics.\n\n### Key Indicators\n- **MBR Modification**: Unauthorized changes to the MBR have been logged, leading to potential system boot failures.\n- **System Recovery**: Attempts to recover the MBR have been partially successful, but full restoration is uncertain.\n\n### Recommendations\n- **Immediate System Backups**: Ensure that all critical data is backed up and secure.\n- **Forensic Analysis**: Engage forensic teams to analyze the altered MBR and identify further threats.\n\n### Next Steps\nGiven past Sandworm operations, expect potential credential harvesting as the next phase of the attack. Monitor for suspicious credential access activities.', '2026-01-06 01:37:06'),
(230, 45, 517, 3, 'Credential Harvesting via Mimikatz: A Deeper Threat', '### Overview\nCredential harvesting has been detected utilizing Mimikatz, a known tool for extracting account credentials from compromised systems.\n\n### Key Indicators\n- **Unauthorized Access Attempts**: Multiple failed and successful login attempts from unusual locations.\n- **Privileged Account Targeting**: Specific focus on accounts with elevated privileges.\n\n### Recommendations\n- **Account Lockdowns**: Immediately lockdown and reset passwords for compromised accounts.\n- **Multi-Factor Authentication**: Implement MFA to secure access to critical systems.\n\n### Next Steps\nPrepare for potential lateral movement within the network as the attacker leverages harvested credentials to propagate. Enhance monitoring for unusual internal network activity.', '2026-01-06 01:37:06'),
(231, 45, 518, 4, 'Lateral Movement and Data Exfiltration: Identifying the Attack Progression', '### Overview\nRapid lateral movement within the network has been identified, coupled with attempts to exfiltrate data.\n\n### Key Indicators\n- **Unusual Traffic Patterns**: High volumes of data transfers to external IPs not previously associated with the organization.\n- **Network Scanning**: Evidence of network scanning activities to identify further targets.\n\n### Recommendations\n- **Network Isolation**: Isolate affected segments to prevent further spread.\n- **Data Loss Prevention**: Strengthen DLP solutions to monitor and block unauthorized data transfers.\n\n### Conclusion\nThe operation has reached a critical stage with the potential for significant data loss. Immediate containment and remediation efforts are essential to minimize impact.', '2026-01-06 01:37:06'),
(232, 45, 519, 5, NULL, NULL, '2026-01-06 01:37:06'),
(233, 46, 520, 1, 'Investigation into Suspicious Network Traffic', '### Summary\nFollowing the detection of suspicious network traffic linked to a potential drive-by download, our team has initiated a comprehensive analysis to identify the source and nature of the traffic.\n\n### Findings\n- **Traffic Source**: The suspicious traffic originated from IP addresses associated with compromised websites known to distribute fake Adobe Flash updates.\n- **Payload Analysis**: Initial investigations suggest the payload is part of a phishing campaign aimed at delivering ransomware.\n\n### Next Steps\nContinue monitoring for further network anomalies and prepare for potential execution of malicious software as indicated by the observed traffic patterns.', '2026-01-06 01:39:37'),
(234, 46, 521, 2, 'Analysis of Unverified Flash Update Execution', '### Summary\nAn unverified Adobe Flash update has been executed on several endpoints. This execution is suspected to be part of the Callisto Group\'s ransomware campaign.\n\n### Findings\n- **Execution Method**: The update bypassed standard security checks, indicating sophisticated evasion techniques.\n- **Code Review**: Preliminary code analysis shows similarities with known ransomware families, suggesting the dropper is used to deploy DiskCryptor.\n\n### Next Steps\nConduct a detailed reverse engineering of the executed file to confirm its capabilities and potential payloads. Prepare defenses against ransomware activation.', '2026-01-06 01:39:37'),
(235, 46, 522, 3, 'DiskCryptor Ransomware Persistence Strategy', '### Summary\nDiskCryptor ransomware has been detected, indicating the persistence phase of the attack.\n\n### Findings\n- **Ransomware Behavior**: The ransomware has encrypted local drives and is configured to activate upon system reboot.\n- **Persistence Mechanism**: Utilizes bootloader modification to ensure ransomware executes at system startup.\n\n### Next Steps\nIsolate infected systems to prevent further spread. Begin decryption efforts and analyze the persistence mechanisms to develop countermeasures.', '2026-01-06 01:39:37'),
(236, 46, 523, 4, 'Investigation into Unauthorized SMB Traffic', '### Summary\nUnauthorized SMB traffic has been observed, suggesting lateral movement within the network.\n\n### Findings\n- **Propagation Method**: Ransomware is leveraging SMB protocol to spread across network shares.\n- **Targeted Systems**: Systems with outdated SMB configurations are particularly vulnerable.\n\n### Next Steps\nImplement network segmentation to contain the spread. Initiate internal audits to identify and patch vulnerable systems. Prepare for potential data exfiltration attempts.', '2026-01-06 01:39:37'),
(237, 46, 524, 5, NULL, NULL, '2026-01-06 01:39:37'),
(238, 47, 525, 1, 'Unauthorized Network Access: Initial Analysis', '### Overview\nThe initial breach was detected at 03:45 UTC, involving unauthorized access to the network managing the Olympic ceremony systems. Our analysis indicates the use of stolen credentials to bypass security protocols.\n\n### Details\n- **Entry Point**: Compromised VPN credentials likely obtained through phishing.\n- **Affected Systems**: Early identification shows infiltration in user authentication servers.\n\n### Next Steps\nInvestigation will focus on identifying the origin of the breach and monitoring for any further unauthorized activities. Anticipate potential execution of malicious scripts as attackers establish foothold.', '2026-01-06 01:44:46');
INSERT INTO `operation_alerts` (`id`, `operation_id`, `alert_id`, `sequence_order`, `intel_report_title`, `intel_report_content`, `created_at`) VALUES
(239, 47, 526, 2, 'Malicious Script Execution: Compromise Analysis', '### Overview\nFollowing the initial breach, malicious scripts were executed on ceremony systems, indicating an escalation in the attack. These scripts aim to disrupt key functionalities during the event.\n\n### Details\n- **Execution Method**: Scripts were deployed via PowerShell to modify system configurations.\n- **Impact**: Disruption in media streaming services and live event broadcasting.\n\n### Insights\nThe attackers are utilizing tools consistent with known Sandworm TTPs, suggesting a sophisticated operation. Next, we will analyze for signs of persistence mechanisms being established.', '2026-01-06 01:44:46'),
(240, 47, 527, 3, 'Persistence Mechanisms: Backdoor Installation', '### Overview\nThe attackers have installed multiple backdoors to ensure continued access and control over the compromised systems.\n\n### Details\n- **Backdoor Types**: Custom RATs detected, allowing remote command execution.\n- **Installation Method**: Leveraged administrative privileges obtained from initial breach.\n\n### Next Steps\nWith persistence achieved, the threat actors are expected to attempt lateral movement to spread through critical infrastructure. Monitoring lateral traffic and securing adjacent systems is crucial.', '2026-01-06 01:44:46'),
(241, 47, 528, 4, 'Lateral Movement: Internal Threat Expansion', '### Overview\nThe attackers are actively moving laterally within the network, targeting critical systems essential for ceremony operations.\n\n### Details\n- **Techniques Used**: SMB protocol exploitation and credential dumping observed.\n- **Targets**: Focus on database servers and event coordination systems.\n\n### Insights\nTheir movement patterns suggest a high level of network knowledge, potentially indicating insider collaboration. The next phase may involve data exfiltration, aiming at sensitive information related to event operations and personnel.', '2026-01-06 01:44:46'),
(242, 47, 529, 5, NULL, NULL, '2026-01-06 01:44:46'),
(243, 48, 530, 1, NULL, NULL, '2026-01-06 02:36:36'),
(244, 48, 531, 2, 'Malicious Payload Deployment Analysis', '## Malicious Payload Deployment Analysis\n\n**Overview:**\nFollowing the initial access via the ASUS Update Utility compromise, threat actors have successfully deployed a malicious payload across affected systems. This payload is designed to execute upon installation of the compromised update.\n\n**Key Findings:**\n- The payload targets systems immediately after the ASUS Live Update installation.\n- Analysis indicates the payload includes a dropper that installs additional malware components.\n- The dropper executes with administrative privileges, allowing it to bypass user account controls.\n\n**Recommendations:**\n- Conduct a thorough scan of all systems for known indicators of compromise.\n- Employ behavioral analysis to detect unusual process execution linked to the update utility.\n\n**Next Steps:**\nFocus on understanding the persistence mechanisms established post-payload execution to maintain threat actor presence.', '2026-01-06 02:36:36'),
(245, 48, 532, 3, 'Backdoor Access and Persistence', '## Backdoor Access and Persistence\n\n**Overview:**\nPost-execution, the threat actors have established backdoor access, ensuring persistent presence on compromised systems. This allows them to maintain control and facilitate further exploitation.\n\n**Key Findings:**\n- A new service is created to run at startup, linked to the malicious payload.\n- Registry modifications detected to ensure backdoor persistence.\n- Backdoor communications are encrypted, complicating detection efforts.\n\n**Recommendations:**\n- Monitor for creation of unauthorized services and registry changes.\n- Implement endpoint detection and response (EDR) solutions to track anomalous behaviors.\n\n**Next Steps:**\nInvestigate potential lateral movement patterns and credentials that may have been compromised.', '2026-01-06 02:36:36'),
(246, 48, 533, 4, 'Lateral Movement and Credential Dumping', '## Lateral Movement and Credential Dumping\n\n**Overview:**\nWith established persistence, the threat actors are moving laterally within the network, harvesting credentials to gain access to additional systems.\n\n**Key Findings:**\n- Use of legitimate tools like Mimikatz to dump credentials from memory.\n- Compromised accounts exhibit unusual login patterns and access attempts.\n- Network traffic analysis reveals attempts to authenticate across multiple systems.\n\n**Recommendations:**\n- Reset credentials for impacted accounts and enforce multi-factor authentication.\n- Deploy network segmentation to limit the spread of lateral movement.\n\n**Next Steps:**\nFocus on identifying and mitigating data exfiltration attempts as attackers access sensitive information.', '2026-01-06 02:36:36'),
(247, 48, 534, 5, 'Data Harvesting and Exfiltration', '## Data Harvesting and Exfiltration\n\n**Overview:**\nThreat actors are actively harvesting sensitive data from compromised systems, preparing for exfiltration to external servers.\n\n**Key Findings:**\n- Large volumes of data being compressed and staged for transfer.\n- Use of encrypted channels to conceal data movement from detection.\n- Targeted data includes intellectual property and user credentials.\n\n**Recommendations:**\n- Monitor outbound traffic for anomalies and block unauthorized data transfers.\n- Implement data loss prevention (DLP) solutions to identify and protect sensitive data.\n\n**Next Steps:**\nDetermine the specific targets based on MAC addresses to understand threat actor intentions.', '2026-01-06 02:36:36'),
(248, 48, 535, 6, 'Targeted MAC Address Identification', '## Targeted MAC Address Identification\n\n**Overview:**\nInvestigation reveals that threat actors are targeting systems with specific MAC addresses, indicating a highly selective attack strategy.\n\n**Key Findings:**\n- Analysis of compromised systems shows a pattern of MAC address targeting.\n- Threat actors appear to prioritize high-value targets within the network.\n- This targeted approach minimizes detection and maximizes impact on selected assets.\n\n**Recommendations:**\n- Identify and isolate systems with targeted MAC addresses to prevent further compromise.\n- Conduct a detailed audit of affected systems to understand the scope of the breach.\n\n**Next Steps:**\nExamine ongoing command and control communications to gain insight into threat actor objectives.', '2026-01-06 02:36:36'),
(249, 48, 536, 7, 'Command and Control Communication Analysis', '## Command and Control Communication Analysis\n\n**Overview:**\nThreat actors maintain command and control communications to coordinate their activities across compromised systems.\n\n**Key Findings:**\n- Use of custom C2 protocols to evade detection by standard network defenses.\n- Communication patterns indicate periodic updates and tasking from external servers.\n- C2 infrastructure is resilient, leveraging multiple domains and IPs for redundancy.\n\n**Recommendations:**\n- Block known C2 domains and IP addresses identified during the investigation.\n- Employ network intrusion detection systems (NIDS) to monitor for C2 communication patterns.\n\n**Next Steps:**\nInvestigate any anti-forensic techniques employed by threat actors to cover their tracks and hinder analysis.', '2026-01-06 02:36:36'),
(250, 48, 537, 8, 'Cleanup and Anti-Forensic Techniques', '## Cleanup and Anti-Forensic Techniques\n\n**Overview:**\nAfter completing their objectives, threat actors are employing anti-forensic techniques to erase evidence and hinder investigation efforts.\n\n**Key Findings:**\n- Use of secure delete utilities to remove traces of malware and logs.\n- Manipulation of timestamps and metadata to obscure activity timelines.\n- Disabling of logging and monitoring tools on compromised systems.\n\n**Recommendations:**\n- Recover deleted files using advanced forensic tools to piece together the attack timeline.\n- Strengthen logging and monitoring capabilities to detect future anti-forensic activities.\n\n**Conclusion:**\nConduct a post-incident review to enhance defenses and reduce the likelihood of similar attacks in the future.', '2026-01-06 02:36:36'),
(251, 49, 538, 1, 'Analysis of Suspicious Cloud Service Access Patterns', '### Overview\nFollowing the detection of suspicious cloud service access, further analysis has identified anomalous login patterns from IP addresses linked to known Inception APT activities.\n\n### Findings\n- **Unusual Login Times:** Access attempts were recorded during non-business hours, consistent with tactics used by Inception APT to remain undetected.\n- **Geolocation:** The IP addresses originate from regions with a known Inception APT presence, notably within Eastern European countries.\n- **Access Attempts:** Credentials appear to have been compromised, as multiple failed login attempts were observed before successful access.\n\n### Recommendations\n- **Immediate Response:** Enforce multi-factor authentication for all cloud service accounts.\n- **Monitoring:** Increase monitoring of access logs for unusual patterns, particularly IP addresses from suspicious regions.\n- **User Awareness Training:** Conduct a security awareness program focusing on phishing and credential security.', '2026-01-07 22:29:04'),
(252, 49, 539, 2, 'Detection and Mitigation of Cloud Atlas Malware Execution', '### Overview\nThe execution of the Cloud Atlas malware was confirmed, marking a critical phase in the attack lifecycle. The malware has been detected in the network environment of Eastern European diplomatic entities.\n\n### Technical Details\n- **Malware Characteristics:** The Cloud Atlas malware uses DLL side-loading techniques to evade detection by traditional antivirus solutions.\n- **Execution Path:** The malware was executed via a trojanized document file, likely delivered through spear-phishing emails targeting diplomatic personnel.\n- **Command and Control (C2):** Evidence of C2 communication attempts to external IP addresses associated with Inception APT infrastructure was identified.\n\n### Recommended Actions\n- **Containment:** Isolate affected systems immediately and conduct a thorough forensic analysis to determine the extent of the compromise.\n- **Malware Removal:** Deploy endpoint detection and response (EDR) tools specifically configured to detect and remove Cloud Atlas malware.\n- **Network Hardening:** Implement strict egress filtering to block unauthorized C2 communications and review firewall rules to prevent similar incidents.', '2026-01-07 22:29:04'),
(253, 49, 540, 3, NULL, NULL, '2026-01-07 22:29:04'),
(254, 50, 541, 1, 'Analysis of Initial Access: Unauthorized Entry', '### Unauthorized Access Detected\nAfter detecting initial unauthorized access to the systems, analysis reveals that attackers exploited a known vulnerability in the VPN software used by the target organization. This vulnerability allowed the attackers to bypass authentication mechanisms and gain entry into the network.\n\n#### Key Findings:\n- **Exploitation Method**: Use of a zero-day vulnerability in the VPN software.\n- **Tools Used**: Custom scripts to automate the exploitation process.\n- **Entry Point**: Compromised credentials were used in conjunction with the exploit.\n\n#### Next Steps:\nPrepare to monitor for any execution of malicious payloads as attackers establish foothold.', '2026-01-07 22:29:58'),
(255, 50, 542, 2, 'Decoding the Execution Phase: Malicious Payload Activation', '### Execution of Malicious Payload\nUpon unauthorized access, attackers proceeded to deploy a malicious payload designed to serve as an initial beacon back to their command and control (C2) servers.\n\n#### Key Findings:\n- **Payload Type**: Custom malware designed to evade detection by common antivirus solutions.\n- **Execution Method**: Utilizes PowerShell scripts embedded within legitimate software updates.\n- **Objective**: Ensure continued access and prepare for installation of a more permanent backdoor.\n\n#### Next Steps:\nFocus on identifying any backdoor mechanisms being established for persistence in the system.', '2026-01-07 22:29:58'),
(256, 50, 543, 3, 'Establishing Persistence: Backdoor Deployment', '### Establishing Backdoor for Persistence\nThe attackers have successfully deployed a backdoor within the target\'s network, ensuring their ability to maintain access over an extended period.\n\n#### Key Findings:\n- **Backdoor Type**: Custom-developed Trojan with rootkit capabilities.\n- **Persistence Mechanism**: Installation of services that auto-start with the system.\n- **Command and Control**: Encrypted communications with C2 servers to avoid detection.\n\n#### Next Steps:\nPrepare for potential lateral movement as attackers explore the network to identify valuable targets.', '2026-01-07 22:29:58'),
(257, 50, 544, 4, 'Stealthy Lateral Movement: Network Exploration', '### Stealthy Lateral Movement\nThe attackers have begun moving laterally within the network, utilizing compromised credentials obtained in earlier stages.\n\n#### Key Findings:\n- **Movement Techniques**: Use of compromised RDP sessions and pass-the-hash attacks.\n- **Target Exploration**: Scanning for sensitive data repositories and high-value systems.\n- **Evasion Tactics**: Use of legitimate administrative tools to mask activities.\n\n#### Next Steps:\nAnticipate and monitor for potential data exfiltration attempts as attackers aim to extract sensitive information.', '2026-01-07 22:29:58'),
(258, 50, 545, 5, NULL, NULL, '2026-01-07 22:29:58'),
(259, 51, 546, 1, 'Unauthorized Code Execution Detected: Analysis and Implications', '## Overview\nUpon receiving the alert for a suspicious email attachment, further investigation revealed unauthorized code execution on the target system. This suggests that the initial access was leveraged to deploy a malicious payload, likely part of the Equation Group\'s toolkit.\n\n## Technical Details\n- **Payload Analysis**: The attachment contained a heavily obfuscated script, which upon execution, triggered a series of PowerShell commands.\n- **MD5 Collisions**: The payload\'s hash matches known Equation Group signatures, indicating potential use of MD5 collision techniques to disguise malicious binaries.\n\n## Implications\nThe execution of this code marks the transition from initial access to active compromise, setting the stage for persistent foothold establishment.', '2026-01-07 22:33:18'),
(260, 51, 547, 2, 'Malware Persistence Mechanism Activated: Deep Dive', '## Overview\nFollowing the unauthorized code execution, a persistence mechanism was activated, ensuring the malware\'s continuity post-reboot.\n\n## Technical Details\n- **Registry Keys**: Modification of registry keys was detected, a common technique used by Equation Group to maintain persistence.\n- **Advanced Techniques**: The malware employs advanced tactics such as DLL injection and the creation of scheduled tasks.\n\n## Insights\nThis persistence ensures that even if the system is restarted or the initial payload is removed, the malware remains operational, allowing for continued espionage activities and data collection.', '2026-01-07 22:33:18'),
(261, 51, 548, 3, 'Lateral Movement: Anomalous Network Activity Analysis', '## Overview\nPost-persistence, anomalous network activity was detected, indicating lateral movement within the network, a hallmark of sophisticated cyber espionage operations.\n\n## Technical Details\n- **Credential Dumping**: Tools associated with the Equation Group were used to harvest credentials, facilitating movement between systems.\n- **Network Traffic Analysis**: Unusual patterns were observed, including SMB connections and RPC calls to multiple endpoints.\n\n## Implications\nThis lateral movement allows the attacker to expand their reach within the network, accessing additional resources and potentially compromising further systems.', '2026-01-07 22:33:18'),
(262, 51, 549, 4, 'Sensitive Data Exfiltration: Monitoring and Mitigation', '## Overview\nThe final stage observed was the exfiltration of sensitive data, a critical concern in espionage operations attributed to the Equation Group.\n\n## Technical Details\n- **Data Transfer Methods**: The exfiltration was conducted using encrypted channels, masking the data flow from standard monitoring tools.\n- **Targets Identified**: Files related to strategic communications and proprietary technologies were specifically targeted.\n\n## Recommendations\n- **Immediate Response**: Implement network segmentation and enhanced monitoring to mitigate further exfiltration.\n- **Long-term Strategy**: Develop and deploy advanced anomaly detection systems to identify potential threats earlier in the attack chain.', '2026-01-07 22:33:18'),
(263, 51, 550, 5, NULL, NULL, '2026-01-07 22:33:18'),
(264, 52, 551, 1, 'Analysis of Spear Phishing Attack Vector', '### Overview\nAfter detecting suspicious initial access via spear phishing, further analysis reveals that targeted emails contained malicious attachments designed to exploit vulnerabilities in email clients.\n\n### Key Details\n- **Targeted Industries:** Manufacturing and Energy sectors.\n- **Attachments:** Utilized a mix of macros and embedded scripts.\n- **Exploited Vulnerabilities:** CVE-2023-XXXX, affecting older email client versions.\n\n### Recommendations\n- Immediate update of email clients to patch known vulnerabilities.\n- Conduct user training on identifying phishing attempts.\n\n### Next Steps\nPrepare for potential malicious code execution as attackers aim to gain deeper system access.', '2026-01-07 22:35:14'),
(265, 52, 552, 2, 'Malicious Code Execution Analysis', '### Overview\nFollowing the execution of malicious code, system logs indicate the deployment of advanced payloads targeting industrial control systems.\n\n### Key Findings\n- **Payload Delivery:** Delivered through exploited email attachments.\n- **Target:** Focused on PLC firmware, aiming to disrupt operational processes.\n- **Observed Behavior:** Attempts to modify system configurations and interfere with normal operations.\n\n### Recommendations\n- Isolate affected machines to prevent further damage.\n- Implement network segmentation to limit exposure.\n\n### Next Steps\nFocus on rootkit persistence mechanisms that ensure continued attacker presence.', '2026-01-07 22:35:14'),
(266, 52, 553, 3, 'Rootkit Persistence Mechanism Identified', '### Overview\nThe rootkit deployed has established a robust persistence mechanism, enabling it to survive system reboots and evade standard detection.\n\n### Detailed Insights\n- **Persistence Techniques:** Utilizes bootkit components and modifies boot sectors.\n- **Evasion Tactics:** Employs anti-forensic techniques to avoid detection by security tools.\n- **Target Impact:** Continuous monitoring and disruption of PLC operations.\n\n### Recommendations\n- Conduct a thorough forensic analysis of boot sectors.\n- Employ specialized tools for rootkit detection and removal.\n\n### Next Steps\nMonitor for lateral movement as attackers attempt to expand their foothold.', '2026-01-07 22:35:14'),
(267, 52, 554, 4, 'Lateral Movement and Credential Dumping', '### Overview\nLateral movement detected suggests attackers are expanding their reach within the network by dumping credentials and leveraging compromised accounts.\n\n### Key Indicators\n- **Tools Used:** Mimikatz and custom scripts for credential extraction.\n- **Movement Patterns:** Transition from initial points of compromise to critical infrastructure nodes.\n- **Objective:** Gain control over additional systems and facilitate data exfiltration.\n\n### Recommendations\n- Reset compromised credentials immediately.\n- Deploy additional monitoring on critical systems to detect unauthorized access.\n\n### Next Steps\nPrepare to identify and mitigate data exfiltration attempts as attackers seek to extract sensitive information.', '2026-01-07 22:35:14'),
(268, 52, 555, 5, NULL, NULL, '2026-01-07 22:35:14'),
(269, 53, 556, 1, NULL, NULL, '2026-01-07 22:39:53'),
(270, 53, 557, 2, 'SUNBURST Backdoor Activation Analysis', '### Overview\nAfter initial access via the compromised SolarWinds update, the SUNBURST backdoor activates on the affected systems. This report delves into the mechanisms behind the activation.\n\n### Key Observations\n- **Activation Timing**: SUNBURST is designed to delay its execution to avoid raising immediate suspicion.\n- **Execution Methods**: Utilizes a combination of Windows processes to blend in with legitimate operations.\n\n### Recommendations\n- Conduct a thorough review of system logs during the initial days of compromise to identify unusual process behaviors.\n\n### Next Steps\nPrepare for potential persistence mechanisms adopted by SUNBURST to maintain foothold.', '2026-01-07 22:39:53'),
(271, 53, 558, 3, 'SUNBURST Persistence Mechanisms', '### Overview\nUpon activation, SUNBURST establishes persistence to ensure its continued presence on compromised systems.\n\n### Key Observations\n- **Registry Alterations**: Modifies registry keys to launch at startup.\n- **Scheduled Tasks**: Creates tasks that mimic valid system operations for periodic execution.\n\n### Recommendations\n- Audit registry changes and scheduled tasks for anomalies.\n\n### Next Steps\nInvestigate command and control (C2) communication methods utilized by SUNBURST.', '2026-01-07 22:39:53'),
(272, 53, 559, 4, 'C2 Communication via Domain Generation Algorithm', '### Overview\nSUNBURST employs a highly sophisticated domain generation algorithm (DGA) for its C2 communications, making detection challenging.\n\n### Key Observations\n- **Dynamic Domain Generation**: Regularly updates potential C2 domains, reducing the efficacy of static blocking.\n- **Encrypted Traffic**: Uses HTTPS for C2 communications to blend in with normal traffic.\n\n### Recommendations\n- Implement anomaly-based detection systems to flag unusual domain communications.\n\n### Next Steps\nFocus on identifying credential harvesting activities designed for lateral movement within the network.', '2026-01-07 22:39:53'),
(273, 53, 560, 5, 'Credential Harvesting and Lateral Movement', '### Overview\nWith a foothold established, APT29 utilizes SUNBURST to harvest credentials and facilitate lateral movement across networks.\n\n### Key Observations\n- **Credential Dumping Tools**: SUNBURST deploys tools to extract credentials from memory and secure storage.\n- **Lateral Movement Tactics**: Utilizes harvested credentials to access other systems, expanding its reach.\n\n### Recommendations\n- Monitor authentication logs for unusual access patterns and failed login attempts.\n\n### Next Steps\nPrepare for potential deployment of second-stage payloads following successful lateral movement.', '2026-01-07 22:39:53'),
(274, 53, 561, 6, 'Deployment of Second-Stage Payloads', '### Overview\nFollowing lateral movement, second-stage payloads are deployed to fulfill specific objectives of the operation.\n\n### Key Observations\n- **Payload Types**: Range from data collection tools to further exploitation utilities.\n- **Stealth Techniques**: Employs various methods to remain undetected, including fileless malware tactics.\n\n### Recommendations\n- Employ endpoint detection and response (EDR) solutions to identify and mitigate payload deployment.\n\n### Next Steps\nFocus on identifying data exfiltration methods utilized by the attackers.', '2026-01-07 22:39:53'),
(275, 53, 562, 7, 'Data Exfiltration via Stealth Channels', '### Overview\nAPT29 exfiltrates sensitive data using stealth channels to avoid detection.\n\n### Key Observations\n- **Stealth Channels**: Utilizes encrypted channels and legitimate services to mask data exfiltration.\n- **Data Types Targeted**: Includes intellectual property, sensitive communications, and credentials.\n\n### Recommendations\n- Implement data loss prevention (DLP) solutions to monitor and block unauthorized data transfers.\n\n### Next Steps\nInvestigate techniques used by APT29 to cover tracks and evade defenses.', '2026-01-07 22:39:53'),
(276, 53, 563, 8, 'Covering Tracks and Cleanup', '### Overview\nAs the operation concludes, APT29 employs various techniques to cover tracks and evade detection.\n\n### Key Observations\n- **Log Manipulation**: Alters or deletes logs to erase traces of their activities.\n- **File Removal**: Removes malware files and tools to prevent forensic analysis.\n\n### Recommendations\n- Regularly back up and secure logs offsite to prevent tampering.\n\n### Conclusion\nUnderstanding these techniques provides insight into APT29\'s strategies, aiding in future prevention and detection efforts.', '2026-01-07 22:39:53'),
(277, 54, 564, 1, 'Post-Phishing Attack Analysis', '### Context\nAfter the initial access was gained via a phishing attack, it\'s crucial to understand the tactics used by Lazarus Group to deliver the malicious payload.\n\n### Key Points\n- **Phishing Techniques**: The attackers utilized spear-phishing emails targeting specific employees at Sony Pictures.\n- **Email Content**: Emails included attachments or links leading to malicious sites.\n- **Employee Targets**: Employees with access to sensitive data were prioritized.\n\n### Next Steps\nPrepare for the possible deployment of malware, specifically the Destover malware, which is known to be used by Lazarus Group post-phishing.', '2026-01-07 22:40:38'),
(278, 54, 565, 2, 'Destover Malware Deployment Analysis', '### Context\nFollowing the phishing attack, Destover malware was executed within Sony Pictures\' network.\n\n### Key Points\n- **Malware Characteristics**: Destover is designed to wipe data and damage systems.\n- **Deployment Method**: Dropped via malicious email attachments or links.\n- **Initial Impact**: Systems were compromised, and data began to be wiped.\n\n### Next Steps\nPrepare for potential backdoor installations as attackers seek to establish persistence within the network.', '2026-01-07 22:40:38'),
(279, 54, 566, 3, 'Backdoor Installation and Persistence', '### Context\nWith the execution of the Destover malware, the attackers focus on maintaining access to the network.\n\n### Key Points\n- **Backdoor Tools**: Custom tools used by Lazarus Group to create persistent backdoors.\n- **Network Persistence**: Aim to maintain long-term access to the compromised systems.\n- **Detection and Evasion**: Techniques to evade detection by security systems.\n\n### Next Steps\nMonitor for signs of lateral movement as attackers map out the internal network.', '2026-01-07 22:40:38'),
(280, 54, 567, 4, 'Internal Network Reconnaissance', '### Context\nWith persistence established, the attackers began exploring the internal network of Sony Pictures.\n\n### Key Points\n- **Reconnaissance Tactics**: Use of legitimate credentials to move laterally.\n- **Target Identification**: Identification of high-value assets and data.\n- **Network Mapping**: Creation of a detailed map of the network\'s structure.\n\n### Next Steps\nFocus on identifying signs of data exfiltration activities, particularly through proxy chains.', '2026-01-07 22:40:38'),
(281, 54, 568, 5, 'Data Theft and Exfiltration Methods', '### Context\nAfter internal reconnaissance, the attackers initiated data exfiltration operations.\n\n### Key Points\n- **Exfiltration Techniques**: Data sent through encrypted channels and proxy chains to obfuscate origin.\n- **Target Data**: Intellectual property, confidential emails, and employee data.\n- **Stealth Tactics**: Use of legitimate network tools to blend with normal traffic.\n\n### Next Steps\nAnticipate attempts at log deletion to cover tracks and hinder forensic analysis.', '2026-01-07 22:40:38'),
(282, 54, 569, 6, 'Log Deletion and Evidence Destruction', '### Context\nAs data exfiltration concluded, the attackers shifted focus to destroying evidence.\n\n### Key Points\n- **Log Deletion**: System logs were systematically targeted and deleted.\n- **Forensic Challenges**: Hindered efforts to trace activities and attackers.\n- **Recovery Methods**: Possible methods to recover deleted logs for analysis.\n\n### Next Steps\nConduct a comprehensive analysis of the geopolitical motivations behind the attack, focusing on the interests of the Lazarus Group.', '2026-01-07 22:40:38'),
(283, 54, 570, 7, NULL, NULL, '2026-01-07 22:40:38'),
(284, 55, 571, 1, 'Report: Initial Access via HVAC Vendor Breach', '### Overview\nFollowing the compromise of the HVAC vendor\'s network, FIN7 leveraged stolen credentials to gain unauthorized access to the target retail system. This initial breach facilitated further infiltration into the target\'s infrastructure.\n\n### Key Findings\n- **Credential Theft**: FIN7 successfully harvested credentials from the HVAC vendor, exploiting weak security practices.\n- **Vulnerability Exploitation**: Existing vulnerabilities in the vendor\'s remote access protocols were manipulated to bypass security controls.\n\n### Next Steps\n- **Monitor for Malware Deployment**: With initial access achieved, anticipate the deployment of malicious software, specifically RAM-scraping malware, aimed at extracting sensitive data from Point-of-Sale (POS) systems.', '2026-01-08 22:01:14'),
(285, 55, 572, 2, 'Report: RAM-Scraping Malware Deployed', '### Overview\nFollowing initial access, FIN7 deployed RAM-scraping malware on the retailer\'s POS systems. This malware aims to capture unencrypted credit card data during transactions.\n\n### Key Findings\n- **Malware Characteristics**: The deployed malware is designed to scrape memory, extracting payment card information in real-time.\n- **Infection Vector**: POS systems were targeted via network access established through the compromised HVAC vendor credentials.\n\n### Next Steps\n- **Establishing Persistence**: It is critical to investigate methods used by FIN7 to maintain long-term access within the network, potentially through backdoors or additional malware components.', '2026-01-08 22:01:14'),
(286, 55, 573, 3, 'Report: Persistence Mechanisms Identified', '### Overview\nFIN7 has implemented various persistence mechanisms to ensure continued access to the retailer\'s network, complicating remediation efforts.\n\n### Key Findings\n- **Backdoor Installations**: Multiple backdoors have been identified, allowing FIN7 to regain access even after initial malware removal attempts.\n- **Scheduled Tasks and Services**: The attackers utilized scheduled tasks and modified system services to maintain their foothold.\n\n### Next Steps\n- **Lateral Movement Detection**: With persistence established, anticipate attempts to move laterally within the network, specifically towards the payment processing environments.', '2026-01-08 22:01:14'),
(287, 55, 574, 4, 'Report: Lateral Movement to Payment Network', '### Overview\nFIN7 successfully navigated laterally through the network, reaching the payment processing systems. This movement facilitated the exfiltration phase.\n\n### Key Findings\n- **Credential Reuse**: Previously compromised credentials were reused to access high-value systems.\n- **Network Mapping**: The attackers conducted extensive mapping of the internal network to identify critical assets.\n\n### Next Steps\n- **Data Exfiltration Monitoring**: With access to the payment network confirmed, focus on detecting and preventing the exfiltration of credit card information. Implement heightened monitoring of data flows leaving the network perimeter.', '2026-01-08 22:01:14'),
(288, 55, 575, 5, NULL, NULL, '2026-01-08 22:01:14'),
(289, 56, 576, 1, NULL, NULL, '2026-01-08 22:06:19'),
(290, 56, 577, 2, 'Initial Access Analysis', '## Analysis of Suspicious HTTP Request\nThe initial suspicious HTTP request detected was aimed at the Apache Struts framework. It appears to have exploited the CVE-2017-5638 vulnerability. This exploit allows remote attackers to execute arbitrary commands via a crafted Content-Type header. Further investigation is needed to confirm execution vectors leading to subsequent activities.', '2026-01-08 22:06:19'),
(291, 56, 578, 3, 'Execution Tactics Uncovered', '## Unusual Command Execution Observed\nFollowing the initial access, an unusual command was executed on the server. This command matches known patterns used to drop web shells, indicating a potential foothold has been established. Investigate server directories for anomalies in file modifications and check for unauthorized shell scripts.', '2026-01-08 22:06:19'),
(292, 56, 579, 4, 'Persistence Tactics Identified', '## Web Shell Detected in Server Directory\nA web shell has been detected on the server, placed in a directory accessible via HTTP requests. This suggests the attackers have established persistence, potentially allowing for remote command execution. Immediate containment is necessary to prevent further compromise.', '2026-01-08 22:06:19'),
(293, 56, 580, 5, 'Exfiltration Indicators', '## Unexpected Outbound Traffic Spike\nA significant spike in outbound traffic was observed, coinciding with the detection of the web shell. This traffic anomaly suggests potential data exfiltration. It is crucial to identify the data being accessed and determine the destination of the outbound traffic.', '2026-01-08 22:06:19'),
(294, 56, 581, 6, 'Lateral Movement Analysis', '## Unauthorized User Account Activity\nFollowing the exfiltration indicators, unauthorized activity was detected on multiple user accounts. This suggests attempts at lateral movement within the network. Review user account logs and network access patterns to identify the scope of compromise.', '2026-01-08 22:06:19'),
(295, 56, 582, 7, 'Reconnaissance Patterns Detected', '## Anomalous File Access Patterns\nAnomalous file access patterns have been detected, indicative of reconnaissance efforts. Files typically not accessed by routine processes are being queried, suggesting preparation for further exploitation. Conduct a thorough audit of access logs to identify unusual patterns.', '2026-01-08 22:06:19'),
(296, 56, 583, 8, 'Command and Control Channel Investigation', '## DNS Tunneling Suspected\nUnusual DNS queries have been observed, consistent with DNS tunneling techniques used for command and control communication. This covert channel allows attackers to bypass traditional security measures. Immediate action is needed to disrupt this communication chain.', '2026-01-08 22:06:19'),
(297, 56, 584, 9, 'Exfiltration Anomalies', '## Encrypted Traffic Anomaly\nAn anomaly in encrypted traffic was detected, potentially indicating advanced exfiltration methods. The use of non-standard encryption protocols points to sophisticated efforts to mask data transfer. Analyze traffic patterns and decryption attempts to ascertain data flow.', '2026-01-08 22:06:19'),
(298, 56, 585, 10, 'Privilege Escalation Attempts', '## Privileged Account Escalation Attempt\nAn attempt to escalate privileges on a compromised account has been detected. This attempt was thwarted, but it suggests a strategy to gain higher-level access within the network. Review all privileged accounts for signs of tampering or unauthorized access.', '2026-01-08 22:06:19'),
(299, 57, 586, 1, 'Post-Initial Access: Analyzing JNDI Payloads', '## Overview\nFollowing the detection of JNDI injection, further analysis is required to understand the payloads utilized by the attackers. These payloads often serve as the initial stage for further exploitation.\n\n## Key Findings\n- **Payload Variants:** Multiple JNDI payloads have been identified, indicating a sophisticated attack strategy.\n- **APT Attribution:** Evidence suggests the involvement of Chinese APT groups, leveraging customized payloads for deeper penetration.\n\n## Recommendations\n- **Immediate Patch Application:** Ensure all systems are updated with the latest security patches for Log4j vulnerabilities.\n- **Network Monitoring:** Increase monitoring of outbound connections to detect any unauthorized data flows.', '2026-01-08 22:09:13'),
(300, 57, 587, 2, 'Cryptominer Deployment: Identifying Malware Behavior', '## Overview\nThe deployment of cryptominers has been confirmed following the JNDI injection. This stage marks the transition from initial access to execution.\n\n## Key Findings\n- **Cryptominer Characteristics:** The malware is designed to utilize compromised systems for mining cryptocurrency, primarily focusing on Monero.\n- **Indicators of Compromise (IoCs):** Hash values and network traffic patterns associated with the cryptominer have been documented.\n\n## Recommendations\n- **System Resource Monitoring:** Watch for abnormal CPU usage, which may indicate cryptominer activity.\n- **Endpoint Detection and Response (EDR):** Deploy EDR solutions to detect and mitigate malware installations.', '2026-01-08 22:09:13'),
(301, 57, 588, 3, 'Backdoor Creation: Ensuring Persistence', '## Overview\nA backdoor has been identified, indicating the attackers\' intent to maintain long-term access to the compromised network.\n\n## Key Findings\n- **Backdoor Mechanisms:** The backdoor utilizes both known and custom methods to evade detection.\n- **Targeted Systems:** Persistence mechanisms have been established on critical infrastructure components.\n\n## Recommendations\n- **Comprehensive Threat Hunting:** Conduct thorough investigations to uncover hidden backdoors.\n- **Access Control Review:** Reassess access permissions and implement stricter access controls.', '2026-01-08 22:09:13'),
(302, 57, 589, 4, 'Lateral Movement: Expanding Network Foothold', '## Overview\nUnauthorized access has been detected, suggesting lateral movement within the network. This phase indicates an attempt to expand control and compromise additional systems.\n\n## Key Findings\n- **Techniques Used:** Attackers are leveraging stolen credentials and exploiting weak network segmentations.\n- **Potential Targets:** Systems holding sensitive data and high-value assets are at increased risk.\n\n## Recommendations\n- **Network Segmentation:** Strengthen network segmentation to limit lateral movements.\n- **User Behavior Analytics:** Implement solutions to detect anomalies in user behavior that may indicate credential misuse.', '2026-01-08 22:09:13'),
(303, 57, 590, 5, NULL, NULL, '2026-01-08 22:09:13'),
(304, 58, 591, 1, 'Insight into SQL Injection Vulnerability and Exploitation', '### Overview\nFollowing the initial alert on Cl0p\'s zero-day exploitation via SQL injection, it is crucial to understand the mechanisms and potential impacts of this attack vector.\n\n### SQL Injection Details\nSQL injection is a code injection technique that might destroy your database. It is one of the most common web hacking techniques. It can allow attackers to gain unauthorized access to sensitive data and even execute administrative operations on the database.\n\n### Potential Impacts\n- Unauthorized access to sensitive data.\n- Database corruption or deletion.\n- Network compromise and further exploitation.\n\n### Recommendations\n- Immediate patching of known vulnerabilities in the MOVEit system.\n- Enhanced monitoring of SQL queries and database access logs.', '2026-01-08 22:12:37'),
(305, 58, 592, 2, 'Automated Data Harvesting Scripts: A Deeper Look', '### Overview\nFollowing the execution of data harvesting scripts, it is important to analyze the methods and scripts used in this automated process.\n\n### Command and Scripting Interpreter: JavaScript (T1059.007)\nCl0p employs JavaScript-based scripts to automate the extraction and collection of data. These scripts can run with minimal detection and can be tailored to target specific datasets.\n\n### Key Characteristics\n- Scripts are designed to execute silently and efficiently.\n- They can be modified on-the-fly to avoid detection by security tools.\n- Typically exfiltrate data to external servers controlled by attackers.\n\n### Recommendations\n- Implement script execution monitoring.\n- Utilize behavioral analysis tools to identify unusual script activities.\n- Regularly update security policies to counter emerging threats.', '2026-01-08 22:12:37'),
(306, 58, 593, 3, 'Establishing Persistence: Techniques and Indicators', '### Overview\nPersistence mechanisms are crucial for attackers to maintain a foothold within compromised networks. Understanding these mechanisms can aid in detection and remediation.\n\n### Boot or Logon Autostart Execution (T1547)\nCl0p uses various techniques to ensure persistence, including modifying autostart entries and using scheduled tasks.\n\n### Indicators of Compromise\n- Unexpected changes in registry keys related to startup items.\n- New or modified scheduled tasks.\n- Unusual applications set to auto-start.\n\n### Recommendations\n- Conduct regular audits of startup and scheduled task configurations.\n- Implement endpoint detection and response (EDR) solutions to identify suspicious behavior.', '2026-01-08 22:12:37'),
(307, 58, 594, 4, 'Lateral Movement and Data Exfiltration: Strategies and Mitigation', '### Overview\nCl0p\'s lateral movement and data exfiltration strategies pose significant risks. Understanding these tactics can help in strengthening defenses.\n\n### Indicator Removal on Host (T1070)\nTo facilitate lateral movement, Cl0p employs techniques to hide their tracks by removing indicators of compromise.\n\n### Exfiltration Over C2 Channel (T1041)\nMass exfiltration is conducted over command and control (C2) channels, often using encrypted communication to avoid detection.\n\n### Mitigation Strategies\n- Deploy network segmentation to limit lateral movement.\n- Monitor for anomalous network traffic patterns.\n- Implement data loss prevention (DLP) solutions to detect and prevent unauthorized data transfers.', '2026-01-08 22:12:37'),
(308, 58, 595, 5, NULL, NULL, '2026-01-08 22:12:37'),
(309, 59, 596, 1, 'Initial Access Analysis', '## Overview\n\nFollowing the **Suspicious Access to Exchange Server** alert, further analysis was conducted to identify the initial access vector. It appears the adversary leveraged a known Exchange vulnerability, likely CVE-2021-34473, to gain unauthorized access.\n\n## Technical Details\n- **IP Address**: 192.168.1.10\n- **User Agent**: Suspicious pattern indicating automated tool usage\n- **Vulnerability Exploited**: CVE-2021-34473\n\n## Recommendations\n- Patch vulnerable Exchange servers immediately.\n- Implement network segmentation to limit access to critical assets.\n\n## Next Steps\nPrepare for potential web shell deployment as adversaries often use this method for further exploitation post-initial access.', '2026-01-08 22:15:20'),
(310, 59, 597, 2, 'Web Shell Deployment Insights', '## Overview\n\nPost detection of **Web Shell Deployment**, an investigation revealed the presence of multiple malicious web shells on the Exchange server.\n\n## Indicators of Compromise\n- **File Path**: `/owa/auth/xyz.aspx`\n- **File Size**: 3kb\n- **Behavior**: Command execution via PowerShell\n\n## Recommendations\n- Conduct a thorough scan for additional web shells.\n- Isolate the affected server to prevent further compromise.\n\n## Next Steps\nMonitor for privilege escalation attempts, particularly those exploiting CVE-2021-34523.', '2026-01-08 22:15:20'),
(311, 59, 598, 3, 'Privilege Escalation Attempt Detected', '## Overview\n\nThe adversary has exploited **CVE-2021-34523** for privilege escalation, gaining SYSTEM-level access on the compromised Exchange server.\n\n## Technical Details\n- **Exploit Tool Used**: PrivEsc v2.0\n- **Privileges Gained**: SYSTEM\n\n## Recommendations\n- Review and restrict service account permissions.\n- Enhance monitoring on privileged account activities.\n\n## Next Steps\nAnticipate lateral movement attempts as adversaries seek to expand their foothold within the network.', '2026-01-08 22:15:20'),
(312, 59, 599, 4, 'Lateral Movement Strategy', '## Overview\n\nLateral movement activities have been identified, indicating the adversary\'s intent to expand their presence within the network.\n\n## Observed Tactics\n- **Technique**: Pass-the-Hash\n- **Targeted Systems**: File servers and domain controllers\n\n## Recommendations\n- Implement SMB signing and limit NTLM use.\n- Monitor network traffic for anomalous patterns.\n\n## Next Steps\nPrepare for potential data exfiltration efforts, focusing on monitoring unusual data transfer channels.', '2026-01-08 22:15:20'),
(313, 59, 600, 5, NULL, NULL, '2026-01-08 22:15:20');

-- --------------------------------------------------------

--
-- Table structure for table `password_resets`
--

CREATE TABLE `password_resets` (
  `id` int(11) NOT NULL,
  `email` varchar(255) NOT NULL,
  `token` varchar(255) NOT NULL,
  `created_at` datetime DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

-- --------------------------------------------------------

--
-- Table structure for table `system_settings`
--

CREATE TABLE `system_settings` (
  `key` varchar(255) NOT NULL,
  `value` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `category` varchar(50) DEFAULT NULL,
  `updated_at` datetime DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `system_settings`
--

INSERT INTO `system_settings` (`key`, `value`, `category`, `updated_at`) VALUES
('account_deleted_body', '\"<h1>Account Deleted</h1><p>Hi {{name}},</p><p>Your account has been successfully deleted from InfoSec Labs. We are sorry to see you go.</p>\"', 'email_template', '2026-01-08 01:09:51'),
('account_deleted_subject', '\"Account Deleted\"', 'email_template', '2026-01-08 01:09:51'),
('account_locked_body', '\"<h1>Account Locked</h1><p>Hi {{name}},</p><p>Your account has been locked due to multiple failed login attempts. Please contact support or try again later.</p>\"', 'email_template', '2026-01-08 01:09:51'),
('account_locked_subject', '\"Your Account has been Locked\"', 'email_template', '2026-01-08 01:09:51'),
('ai_admin_approval', '\"false\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_alert_count', '\"2\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_alert_frequency', '\"12hours\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_api_key', '\"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\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_auto_gen_enabled', 'false', 'ai_integration', '2026-01-08 01:09:51'),
('ai_distribution_hours', '\"12\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_evaluation_enabled', '\"true\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_prompt', '\"You are a Professional SOC Analyst and Mentor at a high-security Security Operations Center.\\nYour task is to review and grade a junior analyst\'s investigation report for a security alert.\\n\\n### ALERT CONTEXT\\nTitle: {{title}}\\nSeverity: {{severity}}\\nDescription: {{details}}\\nIs Real World Example: {{example}}\\n\\n### ANALYST SUBMISSION\\nVerdict: {{verdict}}\\nAnalysis: {{analysis}}\\nSteps Taken: {{steps}}\\nConclusion: {{conclusion}}\\n\\n### EVALUATION CRITERIA\\n1. Verdict Accuracy (CRITICAL): Did the analyst correctly identify the true nature of the alert (True Positive vs False Positive)?\\n2. Analysis Depth: Did they interpret the raw logs correctly? Did they find the root cause?\\n3. Remediation: Were the steps taken (e.g., blocking IPs, isolating hosts, resetting passwords) appropriate for the severity?\\n4. Communication: Is the conclusion clear, professional, and actionable?\\n\\n### YOUR OUTPUT\\nYou must respond with valid JSON ONLY. Do not use Markdown formatting (like ```json).\\n\\n{\\n  \\\"grade\\\": <integer between 0 and 100>,\\n  \\\"feedback\\\": \\\"<Constructive, professional feedback addressed to the analyst. improved analysis tips.>\\\",\\n  \\\"ai_summary\\\": {\\n    \\\"verdict\\\": \\\"<The Correct Verdict>\\\",\\n    \\\"analysis\\\": \\\"<Expert technical analysis of what actually occurred in this alert>\\\",\\n    \\\"steps\\\": \\\"<The ideal remediation steps that should have been taken>\\\",\\n    \\\"conclusion\\\": \\\"<A concise executive summary suitable for management>\\\"\\n  }\\n}\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_provider', '\"openai\"', 'ai_integration', '2026-01-08 01:09:51'),
('ai_strategy', '\"random\"', 'ai_integration', '2026-01-08 01:09:51'),
('alert_assigned_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">New Incident Assigned</h1> <p>Hello <strong>{{name}}</strong>,</p> <p>A new security incident has been flagged and assigned to you for immediate analysis.</p> <div class=\\\"card\\\"> <p style=\\\"margin:0; color:#aaa; font-size:12px; uppercase;\\\">Incident Details</p> <h3 style=\\\"margin:5px 0; color:#fff; font-size:18px;\\\">{{title}}</h3> <p style=\\\"margin:0; color:#b026ff; font-weight:bold;\\\">Status: Pending Investigation</p> </div> <p>Review logs and submit your verdict.</p> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{baseUrl}}/dashboard\\\" class=\\\"button\\\">Start Investigation</a> </div> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('alert_assigned_subject', '\"New Mission: {{title}}\"', 'email_template', '2026-01-11 18:10:54'),
('articles', '\"[{\\\"source\\\":\\\"SecurityWeek\\\",\\\"title\\\":\\\"Kimwolf Android Botnet Grows Through Residential Proxy Networks\\\",\\\"link\\\":\\\"https://www.securityweek.com/kimwolf-android-botnet-grows-through-residential-proxy-networks/\\\",\\\"date\\\":\\\"2026-01-05T09:48:08.000Z\\\",\\\"description\\\":\\\"\\\\nThe 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth.\\\\nThe post Kimwolf Android Botnet Grows Through Residential Proxy Networks appeared first on SecurityWeek.\\\\n\\\",\\\"image\\\":null,\\\"tldr\\\":\\\"\\\\nThe 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the ...\\\"},{\\\"source\\\":\\\"SecurityWeek\\\",\\\"title\\\":\\\"Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes\\\",\\\"link\\\":\\\"https://www.securityweek.com/researcher-spotlights-whatsapp-metadata-leak-as-meta-begins-rolling-out-fixes/\\\",\\\"date\\\":\\\"2026-01-05T09:01:59.000Z\\\",\\\"description\\\":\\\"\\\\nWhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day.\\\\nThe post Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes appeared first on SecurityWeek.\\\\n\\\",\\\"image\\\":null,\\\"tldr\\\":\\\"\\\\nWhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact i...\\\"},{\\\"source\\\":\\\"Schneier on Security\\\",\\\"title\\\":\\\"Telegram Hosting World’s Largest Darknet Market\\\",\\\"link\\\":\\\"https://www.schneier.com/blog/archives/2026/01/telegram-hosting-worlds-largest-darknet-market.html\\\",\\\"date\\\":\\\"2026-01-05T09:01:16.000Z\\\",\\\"description\\\":\\\"\\\\nWired is reporting on Chinese darknet markets on Telegram.\\\\nThe ecosystem of marketplaces for Chinese-speaking crypto scammers hosted on the messaging service Telegram have now grown to be bigger than ever before, according to a new analysis from the crypto tracing firm Elliptic. Despite a brief dro\\\",\\\"image\\\":null,\\\"tldr\\\":\\\"\\\\nWired is reporting on Chinese darknet markets on Telegram.\\\\nThe ecosystem of marketplaces for Chines...\\\"},{\\\"source\\\":\\\"The Hacker News\\\",\\\"title\\\":\\\"The State of Cybersecurity in 2025: Key Segments, Insights, and Innovations \\\",\\\"link\\\":\\\"https://thehackernews.com/2026/01/the-state-of-cybersecurity-in-2025key.html\\\",\\\"date\\\":\\\"2026-01-05T08:55:00.000Z\\\",\\\"description\\\":\\\"Featuring:\\\\n\\\\nCybersecurity is being reshaped by forces that extend beyond individual threats or tools. As organizations operate across cloud infrastructure, distributed endpoints, and complex supply chains, security has shifted from a collection of point solutions to a question of architecture, trust\\\",\\\"image\\\":\\\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA8x4yWhFnltxystR8dz6wTJZo-s-V59gxVDdhogzQnCBOGTU8Rl8SzY-Qa9q83pzJfuShODB0oiNiImplzMoWmBgY754RhzQLWWutipMGuqbhZMyGTQKGsHQEqAOsdiZ2F6FHASN947iuZczpw47T46GJy6juP0qa4739u4U_1-S9yahO6ma6VI_ttIM/s1600/papryon.jpg\\\",\\\"tldr\\\":\\\"Featuring:\\\\n\\\\nCybersecurity is being reshaped by forces that extend beyond individual threats or tools...\\\"},{\\\"source\\\":\\\"The Hacker News\\\",\\\"title\\\":\\\"Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act\\\",\\\"link\\\":\\\"https://thehackernews.com/2026/01/bitfinex-hack-convict-ilya-lichtenstein.html\\\",\\\"date\\\":\\\"2026-01-05T06:42:00.000Z\\\",\\\"description\\\":\\\"Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection with his role in the massive hack of cryptocurrency exchange Bitfinex in 2016, said he has been released early.\\\\nIn a post shared on X last week, the 38-year-old announced his release, crediting U.S. P\\\",\\\"image\\\":\\\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRjeSAB0rkk2lglAZ8hgVe7QDPCxycsYNyYdH-GgUX4XyDU2mGl_iQ2uOtMu8ShG5OlzZ-ds7crBTv8Orc9nSe-JMycT7ukvHmQ-yEmXZPSwkhY8DlnPvfag3d0RdJ6fPAV_baXOgwpvJefpvO08HzmLNZF13f5d9oL63dXTTBS72P_2lg0lsaEJCQx82C/s1600/bitfinex-case.jpg\\\",\\\"tldr\\\":\\\"Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection ...\\\"}]\"', 'newsletter', '2026-01-08 01:09:51'),
('award_gold_body', '\"<h1>🏆 Gold Award Earned!</h1><p>Hi {{name}},</p><p>Congratulations on your outstanding performance! You have been awarded the Gold Analyst Badge.</p>\"', 'email_template', '2026-01-08 01:09:51'),
('award_gold_subject', '\"Congratulations! You earned a Gold Award\"', 'email_template', '2026-01-08 01:09:51'),
('award_won_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Achievement Unlocked</h1> <div style=\\\"text-align: center; margin-bottom: 20px;\\\"> <div style=\\\"font-size: 64px;\\\">🏆</div> </div> <p style=\\\"text-align: center; font-size: 18px;\\\">Congratulations, <strong>{{name}}</strong>!</p> <p style=\\\"text-align: center;\\\">You have earned the <strong>{{awardType}} Tier Analyst</strong> award.</p> <div class=\\\"card\\\" style=\\\"border-left-color: #f59e0b; text-align: center;\\\"> <p style=\\\"color: #fff;\\\">This badge has been added to your profile as a testament to your elite status.</p> </div> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{baseUrl}}/profile\\\" class=\\\"button\\\" style=\\\"background: linear-gradient(135deg, #f59e0b 0%, #d97706 100%); box-shadow: 0 4px 15px rgba(245, 158, 11, 0.4);\\\">View Profile</a> </div> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('award_won_subject', '\"Achievement Unlocked: {{awardType}} Award\"', 'email_template', '2026-01-11 18:10:54'),
('build_id', '\"1767031585\"', 'version', '2026-01-08 01:09:51'),
('day', '\"friday\"', 'newsletterSchedule', '2026-01-08 01:09:51'),
('default_threat_map', '\"https://livethreatmap.radware.com\"', 'general', '2026-01-08 01:09:51'),
('discount_monthly_percent', '\"25\"', 'payment', '2026-01-08 01:09:51'),
('discount_yearly_percent', '\"25\"', 'payment', '2026-01-08 01:09:51'),
('email_from_address', '\"noreply@infoseclabs.io\"', 'email', '2026-01-08 01:09:51'),
('email_smtp_host', '\"\"', 'email', '2026-01-08 01:09:51'),
('email_smtp_pass', '\"\"', 'email', '2026-01-08 01:09:51'),
('email_smtp_port', '\"587\"', 'email', '2026-01-08 01:09:51'),
('email_smtp_user', '\"\"', 'email', '2026-01-08 01:09:51'),
('enabled', 'false', 'newsletterSchedule', '2026-01-08 01:09:51'),
('free_tier_limit', '\"3\"', 'general', '2026-01-08 01:09:51'),
('giveaway', '\"{\\\"last_winner_id\\\":34,\\\"last_winner_name\\\":\\\"Jacob Myfield\\\",\\\"last_awarded_at\\\":\\\"2026-01-01T21:15:34.862Z\\\",\\\"award_type\\\":\\\"gold\\\"}\"', NULL, '2026-01-08 01:09:51'),
('google_analytics_id', '\"G-L24HQ8D3ZW\"', 'general', '2026-01-08 01:09:51'),
('hide_tiers', 'false', 'payment', '2026-01-08 01:09:51'),
('hour', '\"9\"', 'newsletterSchedule', '2026-01-08 01:09:51'),
('investigation_graded_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Performance Review</h1> <p>Your investigation report for <strong>{{title}}</strong> has been audited.</p> <div style=\\\"background-color: #131416; border: 1px solid #333; border-radius: 8px; padding: 20px; text-align: center; margin: 20px 0;\\\"> <p style=\\\"margin:0; color:#aaa; font-size:12px; text-transform:uppercase; letter-spacing:1px;\\\">Final Grade</p> <h2 style=\\\"margin:10px 0; font-size:48px; color: #{{gradeColor}};\\\">{{grade}}</h2> </div> <div class=\\\"card\\\" style=\\\"border-left: 4px solid #{{gradeColor}};\\\"> <p style=\\\"margin:0; color:#aaa; font-size:12px;\\\">Auditor Feedback</p> <p style=\\\"margin:5px 0 0 0; color:#fff; font-style:italic;\\\">\\\"{{feedback}}\\\"</p> </div> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{baseUrl}}/dashboard\\\" class=\\\"button\\\">View Full Details</a> </div> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('investigation_graded_subject', '\"Report Graded: {{title}}\"', 'email_template', '2026-01-11 18:10:54'),
('newsletter_day', '\"monday\"', NULL, '2026-01-08 01:09:51'),
('newsletter_enabled', '\"1\"', NULL, '2026-01-08 01:09:51'),
('newsletter_hour', '\"7\"', NULL, '2026-01-08 01:09:51'),
('password_reset_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Password Reset Protocol</h1> <p>We received a request to reset the credentials for your account.</p> <div class=\\\"card\\\" style=\\\"border-left-color: #fca5a5;\\\"> <p style=\\\"margin:0; color:#f87171; font-weight:bold;\\\">Expiration Warning</p> <p style=\\\"margin:5px 0 0 0; color:#fff;\\\">This secure link expires in 60 minutes.</p> </div> <p>If you did not initiate this request, immediate perimeter checks are recommended.</p> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{link}}\\\" class=\\\"button\\\" style=\\\"background: linear-gradient(135deg, #ef4444 0%, #b91c1c 100%); box-shadow: 0 4px 15px rgba(239, 68, 68, 0.4);\\\">Reset Password</a> </div> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('password_reset_subject', '\"Security Alert: Password Reset Request\"', 'email_template', '2026-01-11 18:10:54'),
('plan_free_name', '\"Free Tier\"', 'payment', '2026-01-08 01:09:51'),
('plan_monthly_name', '\"Monthly Pro\"', 'payment', '2026-01-08 01:09:51'),
('plan_yearly_name', '\"Yearly Pro\"', 'payment', '2026-01-08 01:09:51'),
('price_free', '\"0\"', 'payment', '2026-01-08 01:09:51'),
('price_monthly', '\"19.99\"', 'payment', '2026-01-08 01:09:51'),
('price_yearly', '\"199.99\"', 'payment', '2026-01-08 01:09:51'),
('registration_enabled', '\"true\"', 'general', '2026-01-08 01:09:51'),
('reset_password_body', '\"<h1>Password Reset Request</h1><p>You requested to reset your password. Click the link below to proceed:</p><p><a href=\\\"{{url}}\\\">Reset Password</a></p><p>If you did not request this, please ignore this email.</p>\"', 'email_template', '2026-01-08 01:09:51'),
('reset_password_subject', '\"Reset your InfoSec Labs Password\"', 'email_template', '2026-01-08 01:09:51'),
('site_title', '\"InfoSecLabs\"', 'general', '2026-01-08 01:09:51'),
('smtp_host', '\"mail.infoseclabs.io\"', 'email', '2026-01-08 01:09:51'),
('smtp_pass', '\"Konyalim82@\"', 'email', '2026-01-08 01:09:51'),
('smtp_port', '\"587\"', 'email', '2026-01-08 01:09:51'),
('smtp_user', '\"noreply@infoseclabs.io\"', 'email', '2026-01-08 01:09:51'),
('stripe_price_display_monthly', '\"$11.24\"', 'payment', '2026-01-08 01:09:51'),
('stripe_price_display_yearly', '\"$112.48\"', 'payment', '2026-01-08 01:09:51'),
('stripe_price_monthly', '\"price_1Sn4wNL5VKtXn66bfKqWHcTw\"', 'payment', '2026-01-08 01:09:51'),
('stripe_price_original_monthly', '\"14.98\"', 'payment', '2026-01-08 01:09:51'),
('stripe_price_original_yearly', '\"149.98\"', 'payment', '2026-01-08 01:09:51'),
('stripe_price_yearly', '\"price_1Sn4wOL5VKtXn66b7T6oftiS\"', 'payment', '2026-01-08 01:09:51'),
('stripe_publishable_key', '\"pk_live_51QQtYrL5VKtXn66boiqeGpfhs7jYgGOERnWlxNwjTYtFuigU04AdXl0CnFhH0FLBUNo6MVAjPLACpXcYjgJuY3BU00ViZYgEBE\"', 'payment', '2026-01-08 01:09:51'),
('stripe_secret_key', '\"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\"', 'payment', '2026-01-08 01:09:51'),
('stripe_webhook_secret', '\"whsec_TTJgpSwgkcQFwNyM7IKkrodE2aTTSL8H\"', 'payment', '2026-01-08 01:09:51'),
('subscriber_count', '\"30\"', 'newsletter', '2026-01-08 01:09:51'),
('subscription_upgraded_body', '\"<h1>Welcome to Pro!</h1><p>Hi {{name}},</p><p>Your account has been successfully upgraded to the Pro plan. Enjoy access to all premium features!</p>\"', 'email_template', '2026-01-08 01:09:51'),
('subscription_upgraded_subject', '\"Subscription Upgraded to Pro\"', 'email_template', '2026-01-08 01:09:51'),
('support_email', '\"support@infoseclabs.io\"', 'general', '2026-01-08 01:09:51'),
('system_email', '\"noreply@infoseclabs.io\"', 'general', '2026-01-08 01:09:51'),
('testEmail', '\"\"', 'newsletter', '2026-01-08 01:09:51'),
('timestamp', '\"2025-12-29T18:06:25Z\"', 'version', '2026-01-08 01:09:51'),
('verification_body', '\"<h1>Welcome to InfoSec Labs!</h1><p>Please verify your email address by clicking the link below:</p><p><a href=\\\"{{url}}\\\">Verify Email</a></p>\"', 'email_template', '2026-01-08 01:09:51'),
('verification_subject', '\"Verify your InfoSec Labs Account\"', 'email_template', '2026-01-08 01:09:51'),
('verify_email_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Verify Your Account</h1> <p>Welcome, Analyst.</p> <p>To initialize your secure workspace and begin your training simulations, you must verify this communication channel.</p> <div class=\\\"card\\\"> <p style=\\\"margin:0; color:#aaa; font-size:12px; text-transform:uppercase;\\\">Action Required</p> <p style=\\\"margin:5px 0 0 0; color:#fff;\\\">Click the button below to activate your clearance.</p> </div> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{link}}\\\" class=\\\"button\\\">Verify Email</a> </div> <p style=\\\"font-size: 12px; color: #666; margin-top: 30px;\\\">Direct uplink: <br><a href=\\\"{{link}}\\\" style=\\\"color: #666;\\\">{{link}}</a></p> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('verify_email_subject', '\"Action Required: Verify Your Identity\"', 'email_template', '2026-01-11 18:10:54'),
('version', '\"1.0.1767031585\"', 'version', '2026-01-08 01:09:51'),
('weekly_report_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Weekly Performance Report</h1> <p>Hello <strong>{{name}}</strong>,</p> <p>Here is your weekly activity summary and all-time performance stats.</p> <!-- This Week Section --> <div style=\\\"background-color: #131416; border: 1px solid #333; border-radius: 8px; padding: 20px; margin: 20px 0;\\\"> <p style=\\\"margin:0 0 15px 0; color:#b026ff; font-weight:bold; font-size:14px; text-transform:uppercase; letter-spacing:1px;\\\">📅 This Week</p> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">Alerts Assigned</span> <span class=\\\"stat-value\\\">{{assigned}}</span> </div> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">Investigations Closed</span> <span class=\\\"stat-value\\\">{{graded}}</span> </div> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">Average Score</span> <span class=\\\"stat-value highlight\\\">{{avgScore}}%</span> </div> <div class=\\\"stat-row\\\" style=\\\"border-bottom: none; margin-bottom: 0px; padding-bottom: 0px;\\\"> <span class=\\\"stat-label\\\">XP Earned</span> <span class=\\\"stat-value\\\" style=\\\"color:#00ff41;\\\">+{{totalScore}}</span> </div> </div> <!-- All-Time Stats Section --> <div style=\\\"background-color: #131416; border: 1px solid #333; border-radius: 8px; padding: 20px; margin: 20px 0;\\\"> <p style=\\\"margin:0 0 15px 0; color:#00ff41; font-weight:bold; font-size:14px; text-transform:uppercase; letter-spacing:1px;\\\">🏆 All-Time Stats</p> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">🔍 Total Investigations</span> <span class=\\\"stat-value\\\">{{totalInvestigations}}</span> </div> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">⭐ Total XP</span> <span class=\\\"stat-value\\\" style=\\\"color:#00ff41;\\\">{{totalXP}}</span> </div> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">📈 Lifetime Average</span> <span class=\\\"stat-value\\\">{{lifetimeAvg}}%</span> </div> <div class=\\\"stat-row\\\"> <span class=\\\"stat-label\\\">🎯 Best Score</span> <span class=\\\"stat-value\\\" style=\\\"color:#f59e0b;\\\">{{bestScore}}</span> </div> <div class=\\\"stat-row\\\" style=\\\"border-bottom: none; margin-bottom: 0px; padding-bottom: 0px;\\\"> <span class=\\\"stat-label\\\">🥇 Leaderboard Rank</span> <span class=\\\"stat-value\\\" style=\\\"color:#b026ff;\\\">#{{rank}}</span> </div> </div> <p>Keep investigating alerts to climb the leaderboard!</p> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{baseUrl}}/dashboard\\\" class=\\\"button\\\">Go to Dashboard</a> </div> <p style=\\\"font-size: 11px; color: #666; margin-top: 30px; text-align: center;\\\"> <a href=\\\"{{baseUrl}}/profile\\\" style=\\\"color: #666;\\\">Manage email preferences</a> </p> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('weekly_report_subject', '\"Weekly Analyst Report\"', 'email_template', '2026-01-11 18:10:54'),
('welcome_email_body', '\"<!DOCTYPE html><html><head> <meta charset=\\\"utf-8\\\"> <meta name=\\\"viewport\\\" content=\\\"width=device-width, initial-scale=1.0\\\"> <style> body { font-family: \'Segoe UI\', Tahoma, Geneva, Verdana, sans-serif; background-color: #0e0f11; margin: 0; padding: 0; color: #e0e0e0; } .container { max-width: 600px; margin: 0 auto; background-color: #1a1b1e; border-radius: 12px; overflow: hidden; box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.5); border: 1px solid #333; } .header { background: linear-gradient(90deg, #1a1b1e 0%, #2c0b4a 100%); padding: 30px 40px; border-bottom: 1px solid #333; text-align: center; } .logo { color: #00ff41; font-size: 24px; font-weight: 800; letter-spacing: 2px; text-transform: uppercase; text-shadow: 0 0 10px rgba(0, 255, 65, 0.3); margin: 0; } .logo span { color: #b026ff; } .content { padding: 40px; line-height: 1.6; } .h1 { color: #ffffff; margin-top: 0; font-size: 24px; margin-bottom: 20px; } .card { background-color: #131416; border-left: 4px solid #b026ff; padding: 20px; margin: 20px 0; border-radius: 4px; } .button { display: inline-block; background: linear-gradient(135deg, #b026ff 0%, #7928ca 100%); color: white !important; padding: 14px 30px; text-decoration: none; border-radius: 8px; font-weight: bold; margin-top: 20px; text-transform: uppercase; font-size: 14px; letter-spacing: 1px; box-shadow: 0 4px 15px rgba(176, 38, 255, 0.4); } .footer { background-color: #0e0f11; padding: 30px; text-align: center; font-size: 12px; color: #666; border-top: 1px solid #333; } .stat-row { display: flex; justify-content: space-between; margin-bottom: 10px; border-bottom: 1px solid #333; padding-bottom: 10px; } .stat-label { color: #888; } .stat-value { color: #fff; font-weight: bold; } .highlight { color: #00ff41; } </style></head><body> <div class=\\\"container\\\"> <div class=\\\"header\\\"> <div class=\\\"logo\\\">InfoSec<span>Labs</span></div> </div> <div class=\\\"content\\\"> <h1 class=\\\"h1\\\">Deployment Authorized</h1> <p>Analyst credentials active.</p> <p>Your objective is to investigate realistic cyber threats, analyze logs, and defend the network. Every correct verdict improves your rank on the global leaderboard.</p> <div class=\\\"card\\\" style=\\\"border-left-color: #00ff41;\\\"> <p style=\\\"margin:0; color:#00ff41; font-weight:bold;\\\">Mission Brief</p> <ul style=\\\"margin:10px 0 0 0; padding-left:20px; color:#ddd;\\\"> <li>Investigate Incidents</li> <li>Earn XP & Badges</li> <li>Competite with Top Analysts</li> </ul> </div> <div style=\\\"text-align: center;\\\"> <a href=\\\"{{link}}\\\" class=\\\"button\\\">Access Dashboard</a> </div> </div> <div class=\\\"footer\\\"> <p>&copy; 2026 InfoSecLabs Platform. All rights reserved.</p> <p>Secure Simulation Environment // Authorized Personnel Only</p> </div> </div></body></html>\"', 'email_template', '2026-01-11 18:10:54'),
('welcome_email_subject', '\"Deployment Authorized: Welcome to InfoSecLabs\"', 'email_template', '2026-01-11 18:10:54');

-- --------------------------------------------------------

--
-- Table structure for table `tasks`
--

CREATE TABLE `tasks` (
  `id` int(11) NOT NULL,
  `module_id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `task_type` enum('reading','challenge','quiz','alert_link','external_resource') DEFAULT 'reading',
  `task_data` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`task_data`)),
  `xp_reward` int(11) DEFAULT 50,
  `display_order` int(11) DEFAULT 0,
  `is_active` tinyint(1) DEFAULT 1,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `alert_id` int(11) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `tasks`
--

INSERT INTO `tasks` (`id`, `module_id`, `title`, `description`, `task_type`, `task_data`, `xp_reward`, `display_order`, `is_active`, `created_at`, `updated_at`, `alert_id`) VALUES
(1, 1, 'What is Cybersecurity?', 'Read about cybersecurity fundamentals, the CIA Triad, and why security matters in the digital age.', 'reading', NULL, 20, 1, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(2, 1, 'Understanding Threats and Vulnerabilities', 'Learn the difference between threats, vulnerabilities, and risks. Explore common attack vectors.', 'reading', NULL, 30, 2, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(3, 1, 'Career Paths in Cybersecurity', 'Discover different career paths: SOC Analyst, Penetration Tester, Security Engineer, and more.', 'reading', NULL, 20, 3, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(4, 1, 'Quiz: Cybersecurity Basics', 'Test your knowledge of fundamental cybersecurity concepts.', 'quiz', NULL, 50, 4, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(5, 1, 'Setting Up Your Lab Environment', 'Install VirtualBox and download your first security-focused Linux distribution.', 'challenge', NULL, 100, 5, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(6, 2, 'Navigating the File System', 'Learn cd, ls, pwd commands. Practice moving through directories.', 'challenge', NULL, 40, 1, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(7, 2, 'File Manipulation', 'Master cp, mv, rm, mkdir, touch commands for managing files and directories.', 'challenge', NULL, 40, 2, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(8, 2, 'Understanding Permissions', 'Learn about user, group, and other permissions using chmod and chown.', 'reading', NULL, 50, 3, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(9, 2, 'Searching and Finding Files', 'Use find, locate, and which commands to search for files.', 'challenge', NULL, 40, 4, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(10, 2, 'Text Manipulation with grep', 'Learn to search file contents using grep with regular expressions.', 'challenge', NULL, 50, 5, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(11, 2, 'Process Management', 'Understand ps, top, kill commands for managing running processes.', 'challenge', NULL, 50, 6, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(12, 2, 'Package Management', 'Install and manage software using apt/yum package managers.', 'challenge', NULL, 40, 7, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(22, 4, 'OSI Model Explained', 'Learn the 7 layers of the OSI model and their functions.', 'reading', NULL, 40, 1, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(23, 4, 'TCP/IP Protocol Suite', 'Understand TCP vs UDP, common ports, and the three-way handshake.', 'reading', NULL, 50, 2, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(24, 4, 'IP Addressing and Subnetting', 'Learn IPv4 addressing, subnet masks, and CIDR notation.', 'challenge', NULL, 60, 3, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(25, 4, 'Subnetting Practice', 'Complete subnetting exercises to master network calculations.', 'challenge', NULL, 70, 4, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(26, 4, 'DNS Fundamentals', 'Understand how DNS works, record types (A, AAAA, MX, CNAME), and DNS queries.', 'reading', NULL, 50, 5, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(27, 4, 'DHCP and ARP', 'Learn how DHCP assigns IP addresses and how ARP maps IPs to MAC addresses.', 'reading', NULL, 40, 6, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(28, 4, 'Common Network Protocols', 'Explore HTTP/HTTPS, FTP, SSH, SMTP, and their security implications.', 'reading', NULL, 50, 7, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(30, 4, 'Network Traffic Analysis Challenge', 'Analyze a PCAP file to identify suspicious network activity.', 'challenge', NULL, 100, 9, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(31, 4, 'Quiz: Networking Essentials', 'Test your networking knowledge with a comprehensive quiz.', 'quiz', NULL, 60, 10, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(32, 9, 'Windows File System', NULL, 'reading', NULL, 25, 1, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(33, 9, 'User Account Control', NULL, 'reading', NULL, 25, 2, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(34, 9, 'Windows Registry', NULL, 'reading', NULL, 25, 3, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(35, 9, 'Active Directory Intro', NULL, 'reading', NULL, 25, 4, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(36, 9, 'PowerShell Fundamentals', NULL, 'reading', NULL, 25, 5, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(37, 9, 'Windows Event Logs', NULL, 'reading', NULL, 25, 6, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(38, 9, 'Group Policy', NULL, 'reading', NULL, 25, 7, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(39, 9, 'Windows Security Tools', NULL, 'reading', NULL, 25, 8, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(40, 10, 'CIA Triad', NULL, 'reading', NULL, 25, 1, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(41, 10, 'Authentication Methods', NULL, 'reading', NULL, 25, 2, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(42, 10, 'Authorization', NULL, 'reading', NULL, 25, 3, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(43, 10, 'Accounting', NULL, 'reading', NULL, 25, 4, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(44, 10, 'Encryption Basics', NULL, 'reading', NULL, 25, 5, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(45, 10, 'Hashing vs Encryption', NULL, 'reading', NULL, 25, 6, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(46, 10, 'Defense in Depth', NULL, 'reading', NULL, 25, 7, 1, '2025-12-26 02:44:43', '2025-12-26 02:44:43', NULL),
(47, 10, 'Quiz: Security Principles', NULL, 'reading', NULL, 25, 8, 1, '2025-12-26 02:44:43', '2025-12-26 20:57:55', NULL),
(48, 11, 'Navigating Directories', NULL, 'reading', NULL, 25, 2, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12', NULL),
(49, 11, 'Reading Files', NULL, 'reading', NULL, 25, 3, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12', NULL),
(50, 11, 'Host Identity', NULL, 'reading', NULL, 25, 4, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12', NULL),
(51, 11, 'IP Configuration', NULL, 'reading', NULL, 25, 5, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12', NULL),
(52, 11, 'Terminating Processes', NULL, 'reading', NULL, 25, 6, 1, '2025-12-26 02:44:43', '2025-12-26 21:05:12', NULL),
(54, 12, 'Anatomy of a Log', NULL, 'reading', NULL, 30, 1, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(55, 12, 'SSH Authentication', NULL, 'reading', NULL, 30, 2, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(56, 12, 'Web Access Logs', NULL, 'reading', NULL, 30, 3, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(57, 12, 'Windows Event Logs', NULL, 'reading', NULL, 30, 4, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(58, 12, 'Detecting Web Attacks', NULL, 'reading', NULL, 30, 5, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(59, 12, 'Firewall & Network Logs', NULL, 'reading', NULL, 30, 6, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(60, 12, 'Command Injection', NULL, 'reading', NULL, 30, 7, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(61, 12, 'Advanced Obfuscation', NULL, 'reading', NULL, 30, 8, 1, '2025-12-26 02:44:43', '2025-12-26 21:08:58', NULL),
(72, 14, 'What is a Proxy?', NULL, 'reading', NULL, 30, 1, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42', NULL),
(73, 14, 'Burp Suite Basics', NULL, 'reading', NULL, 30, 2, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42', NULL),
(74, 14, 'Intercepting Requests', NULL, 'reading', NULL, 30, 3, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42', NULL),
(75, 14, 'Repeater & Decoder', NULL, 'reading', NULL, 30, 4, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42', NULL),
(76, 14, 'Proxy Chaining & VPNs', NULL, 'reading', NULL, 30, 5, 1, '2025-12-26 02:44:43', '2025-12-26 21:17:42', NULL),
(77, 15, 'IDS vs IPS: Architecture', NULL, 'reading', NULL, 30, 1, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(78, 15, 'Detection Methodologies', NULL, 'reading', NULL, 30, 2, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(79, 15, 'Network (NIDS) vs Host (HIDS)', NULL, 'reading', NULL, 30, 3, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(81, 15, 'Zeek (Bro) Surveillance', NULL, 'reading', NULL, 30, 5, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(82, 15, 'Alert Triage & Investigation', NULL, 'reading', NULL, 30, 6, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(83, 15, 'Handling False Positives', NULL, 'reading', NULL, 30, 7, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(84, 16, 'The Vulnerability Lifecycle', NULL, 'reading', NULL, 30, 1, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(85, 16, 'Authenticated vs Unauthenticated', NULL, 'reading', NULL, 30, 2, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(86, 16, 'Decoding CVSS Scores', NULL, 'reading', NULL, 30, 3, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(87, 16, 'Nessus Operations', NULL, 'reading', NULL, 30, 4, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(88, 16, 'Analyzing Scan Reports', NULL, 'reading', NULL, 30, 5, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(89, 16, 'Patch Management Strategy', NULL, 'reading', NULL, 30, 6, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(90, 16, 'Understanding CVEs', NULL, 'reading', NULL, 30, 7, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(91, 16, 'Risk Response Strategies', NULL, 'reading', NULL, 30, 8, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(92, 17, 'DAST Fundamentals', NULL, 'reading', NULL, 30, 1, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(93, 17, 'OWASP Top 10 Deep Dive', NULL, 'reading', NULL, 30, 2, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(94, 17, 'OWASP ZAP Mastery', NULL, 'reading', NULL, 30, 3, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(95, 17, 'Advanced Spidering', NULL, 'reading', NULL, 30, 4, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(96, 17, 'Active Scanning Mechanics', NULL, 'reading', NULL, 30, 5, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(97, 17, ' Identifying DAST False Positives', NULL, 'reading', NULL, 30, 6, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(98, 17, 'Effective Remediation Reporting', NULL, 'reading', NULL, 30, 7, 1, '2025-12-26 02:44:43', '2025-12-26 22:03:21', NULL),
(160, 16, 'Module 16 Final Quiz', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:51:15', NULL),
(181, 18, 'What is OSINT?', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(182, 18, 'The Intelligence Cycle', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(183, 18, 'OPSEC & Sock Puppets', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(184, 18, 'Google Dorking Mastery', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(185, 18, 'People & Username Recon', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(186, 18, 'Email & Breach Data', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(187, 18, 'Image Intelligence (IMINT)', NULL, 'reading', NULL, 40, 7, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(188, 18, 'Domain & Infrastructure', NULL, 'reading', NULL, 40, 8, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(189, 18, 'Geolocation & Maps', NULL, 'reading', NULL, 40, 9, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(190, 18, 'Module 18 Final Quiz', NULL, 'reading', NULL, 40, 10, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(191, 19, 'Email Anatomy: RFC 5322', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(192, 19, 'Authentication: SPF, DKIM, DMARC', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(193, 19, 'Investigation 1: The CEO Fraud', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(194, 19, 'Investigation 2: Malicious Attachment', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(195, 19, 'Investigation 3: The Credential Harvest', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(196, 19, 'Module 19 Final Quiz', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:46', '2025-12-26 22:20:34', NULL),
(201, 20, 'Psychology of Persuasion', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(202, 20, 'Pretexting & Impersonation', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(203, 20, 'Vishing (Voice Phishing)', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(204, 20, 'Smishing (SMS Phishing)', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(205, 20, 'Physical: Tailgating & Dumpster Diving', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(206, 20, 'Baiting & Quid Pro Quo', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(207, 20, 'Module 20 Final Quiz', NULL, 'reading', NULL, 40, 7, 1, '2025-12-26 02:45:46', '2025-12-26 22:29:54', NULL),
(211, 21, 'Introduction to Virtualization', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(212, 21, 'Hypervisors: Type 1 vs Type 2', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(213, 21, 'Setting Up VirtualBox (Free)', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(214, 21, 'Setting Up VMware Workstation', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(215, 21, 'Creating Your First VM (Kali Linux)', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(216, 21, 'Network Modes: NAT, Bridged, Host-Only', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(217, 21, 'Snapshots & Clones (The Safety Net)', NULL, 'reading', NULL, 40, 7, 1, '2025-12-26 02:45:46', '2025-12-26 22:33:02', NULL),
(221, 22, 'What is a SIEM?', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(222, 22, 'Log Sources & Ingestion', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(223, 22, 'Normalization & Parsing', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(224, 22, 'Correlation Rules (The Magic)', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(225, 22, 'Market Leaders: Splunk vs Sentinel', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(226, 22, 'Open Source: The ELK Stack', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(227, 22, 'Wazuh: The Modern Open SIEM', NULL, 'reading', NULL, 40, 7, 1, '2025-12-26 02:45:46', '2025-12-26 22:37:10', NULL),
(228, 22, 'Final Quiz', NULL, 'reading', NULL, 40, 8, 1, '2025-12-26 02:45:46', '2025-12-26 22:38:12', NULL),
(231, 23, 'Use Case 1: Brute Force Attack (Easy)', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:46', '2025-12-26 22:43:08', NULL),
(232, 23, 'Use Case 2: Malware Beaconing (Easy)', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:46', '2025-12-26 22:43:08', NULL),
(233, 23, 'Use Case 3: Impossible Travel (Medium)', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:46', '2025-12-26 22:43:08', NULL),
(234, 23, 'Use Case 4: Privilege Escalation (Medium)', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:46', '2025-12-26 22:43:08', NULL),
(235, 23, 'Use Case 5: DNS Tunneling (Hard)', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:46', '2025-12-26 22:43:08', NULL),
(236, 23, 'Final Quiz', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:47', '2025-12-26 22:43:08', NULL),
(241, 24, 'What is EDR?', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(242, 24, 'EDR vs Antivirus', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(243, 24, 'The Process Tree (Deep Dive)', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(244, 24, 'Reading Process Ancestry', NULL, 'reading', NULL, 40, 4, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(245, 24, 'Suspicious Parent-Child Relationships', NULL, 'reading', NULL, 40, 5, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(246, 24, 'EDR Market Leaders', NULL, 'reading', NULL, 40, 6, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(247, 24, 'Final Quiz', NULL, 'reading', NULL, 40, 7, 1, '2025-12-26 02:45:47', '2025-12-26 22:47:36', NULL),
(251, 25, 'IDS Types: NIDS vs HIDS', NULL, 'reading', NULL, 40, 1, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(252, 25, 'Signature vs Anomaly Detection', NULL, 'reading', NULL, 40, 2, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(253, 25, 'Snort: The Open-Source IDS', NULL, 'reading', NULL, 40, 3, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(254, 25, 'Suricata: The Modern Alternative', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(255, 25, 'Analyzing IDS Alerts', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(256, 25, 'Final Quiz', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 22:51:25', NULL),
(261, 26, 'Malware Categories', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(262, 26, 'Static vs Dynamic Analysis', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(263, 26, 'Setting Up a Safe Lab', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(264, 26, 'Static Analysis Tools', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(265, 26, 'Dynamic Analysis (Sandboxing)', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(266, 26, 'Identifying IOCs from Malware', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(267, 26, 'Final Quiz', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 22:57:14', NULL),
(271, 27, 'What is Incident Response?', NULL, 'reading', NULL, 50, 8, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(272, 27, 'The IR Lifecycle (NIST)', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(273, 27, 'Phase 1: Preparation', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(274, 27, 'Phase 2: Detection & Analysis', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(275, 27, 'Phase 3: Containment', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(276, 27, 'Phase 4: Eradication & Recovery', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(277, 27, 'Phase 5: Post-Incident Activity', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(278, 27, 'Final Quiz', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:03:48', NULL),
(281, 28, 'What is Digital Forensics?', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(282, 28, 'The Forensic Process', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(283, 28, 'Evidence Handling & Chain of Custody', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(284, 28, 'Disk Imaging & Acquisition', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(285, 28, 'File System Analysis (NTFS/ext4)', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(286, 28, 'Windows Artifacts', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(287, 28, 'Final Quiz', NULL, 'reading', NULL, 50, 8, 1, '2025-12-26 02:45:47', '2025-12-26 23:05:09', NULL),
(291, 29, 'Why Analyze Network Traffic?', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(292, 29, 'Packet Capture Fundamentals', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(293, 29, 'Wireshark Essentials', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(294, 29, 'Analyzing TCP/HTTP Traffic', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(295, 29, 'Detecting Malicious Traffic', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(296, 29, 'Zeek (Bro) for Network Logs', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(297, 29, 'Final Quiz', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:06:44', NULL),
(301, 30, 'What is Threat Hunting?', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(302, 30, 'Hunting vs Detection', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(303, 30, 'The Hunting Loop', NULL, 'reading', NULL, 50, 8, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(304, 30, 'Hypothesis-Driven Hunting', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(305, 30, 'Data Sources for Hunting', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(306, 30, 'Hunting Techniques', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(307, 30, 'Final Quiz', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:08:10', NULL),
(311, 31, 'What is MITRE ATT&CK?', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(312, 31, 'Tactics: The \"Why\"', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(313, 31, 'Techniques: The \"How\"', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(314, 31, 'Navigating the Matrix', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(315, 31, 'Using ATT&CK for Defense', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(316, 31, 'Final Quiz', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:09:24', NULL),
(321, 32, 'Cloud Service Models (IaaS/PaaS/SaaS)', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(322, 32, 'Shared Responsibility Model', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(323, 32, 'AWS Security Fundamentals', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(324, 32, 'Azure Security Fundamentals', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(325, 32, 'Cloud Misconfigurations', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(326, 32, 'Final Quiz', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:10:39', NULL),
(331, 33, 'Why Automate Security?', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(332, 33, 'SOAR Platforms Overview', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(333, 33, 'Playbook Design Principles', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(334, 33, 'Common Automation Use Cases', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(335, 33, 'Python for Security Automation', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(336, 33, 'Final Quiz', NULL, 'reading', NULL, 50, 8, 1, '2025-12-26 02:45:47', '2025-12-26 23:11:57', NULL),
(341, 34, 'Why Documentation Matters', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(342, 34, 'Incident Timelines', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(343, 34, 'Writing Effective Reports', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(344, 34, 'Executive Summaries', NULL, 'reading', NULL, 50, 6, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(345, 34, 'Metrics and KPIs', NULL, 'reading', NULL, 50, 7, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(346, 34, 'Final Quiz', NULL, 'reading', NULL, 50, 8, 1, '2025-12-26 02:45:47', '2025-12-26 23:13:12', NULL),
(349, 49, 'Understanding EDR Telemetry', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', NULL),
(350, 49, 'Analyzing Process Trees', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', 233),
(351, 49, 'Detecting Lateral Movement', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', 234),
(352, 49, 'Memory Injection Techniques', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', 235),
(353, 49, 'Isolating infected Hosts', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', 236),
(359, 51, 'Writing SPL (Search Processing Language)', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 17:59:30', '2025-12-26 18:15:01', 242),
(360, 51, 'Correlating Events', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 17:59:31', '2025-12-26 18:15:01', 243),
(361, 36, 'SIEM Architecture Deep Dive', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 244),
(362, 36, 'Log Parsing & Normalization', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 245),
(363, 36, 'Advanced Correlation Rules', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 246),
(364, 36, 'Query Optimization', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 247),
(365, 36, 'Building Detection-as-Code', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 248),
(366, 36, 'Final Quiz', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 17:59:31', '2025-12-27 02:16:31', 249),
(367, 52, 'Phishing vs Spear Phishing', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31', NULL),
(368, 52, 'URL Analysis', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31', NULL),
(369, 53, 'CVSS Scoring System', NULL, 'reading', NULL, 50, 1, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31', NULL),
(370, 53, 'Prioritizing Patches', NULL, 'reading', NULL, 50, 2, 1, '2025-12-26 17:59:31', '2025-12-26 17:59:31', NULL),
(371, 37, 'Why Memory Forensics?', NULL, 'reading', NULL, 50, 3, 1, '2025-12-26 17:59:31', '2025-12-27 02:18:03', NULL),
(372, 37, 'Memory Acquisition Techniques', NULL, 'reading', NULL, 50, 4, 1, '2025-12-26 17:59:31', '2025-12-27 02:18:03', NULL),
(373, 37, 'Volatility Framework Deep Dive', NULL, 'reading', NULL, 50, 5, 1, '2025-12-26 17:59:31', '2025-12-27 02:18:03', NULL),
(374, 37, 'Process Analysis & Injection Detection', NULL, 'reading', NULL, 50, 374, 1, '2025-12-27 02:18:03', '2025-12-27 02:18:03', NULL),
(375, 37, 'Hunting Rootkits & Hidden Processes', NULL, 'reading', NULL, 50, 375, 1, '2025-12-27 02:18:03', '2025-12-27 02:18:03', NULL),
(376, 37, 'Final Quiz', NULL, 'reading', NULL, 50, 376, 1, '2025-12-27 02:18:03', '2025-12-27 02:18:03', NULL),
(381, 38, 'RE Fundamentals & Tools', NULL, 'reading', NULL, 50, 381, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(382, 38, 'x86/x64 Assembly Essentials', NULL, 'reading', NULL, 50, 382, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(383, 38, 'Static Analysis with IDA/Ghidra', NULL, 'reading', NULL, 50, 383, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(384, 38, 'Debugging with x64dbg', NULL, 'reading', NULL, 50, 384, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(385, 38, 'Unpacking & Anti-Analysis', NULL, 'reading', NULL, 50, 385, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(386, 38, 'Final Quiz', NULL, 'reading', NULL, 50, 386, 1, '2025-12-27 02:19:34', '2025-12-27 02:19:34', NULL),
(391, 39, 'Threat Intel Lifecycle', NULL, 'reading', NULL, 50, 391, 1, '2025-12-27 02:21:00', '2025-12-27 02:21:00', NULL),
(392, 39, 'Collection & Sources', NULL, 'reading', NULL, 50, 392, 1, '2025-12-27 02:21:01', '2025-12-27 02:21:01', NULL),
(393, 39, 'Analysis & Attribution', NULL, 'reading', NULL, 50, 393, 1, '2025-12-27 02:21:01', '2025-12-27 02:21:01', NULL),
(394, 39, 'STIX/TAXII & Sharing', NULL, 'reading', NULL, 50, 394, 1, '2025-12-27 02:21:01', '2025-12-27 02:21:01', NULL),
(395, 39, 'Operationalizing Intel', NULL, 'reading', NULL, 50, 395, 1, '2025-12-27 02:21:01', '2025-12-27 02:21:01', NULL),
(396, 39, 'Final Quiz', NULL, 'reading', NULL, 50, 396, 1, '2025-12-27 02:21:01', '2025-12-27 02:21:01', NULL),
(401, 40, 'Red, Blue, and Purple Teams', NULL, 'reading', NULL, 50, 401, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(402, 40, 'Red Team Operations', NULL, 'reading', NULL, 50, 402, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(403, 40, 'Blue Team Defense', NULL, 'reading', NULL, 50, 403, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(404, 40, 'Purple Team Exercises', NULL, 'reading', NULL, 50, 404, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(405, 40, 'Adversary Emulation', NULL, 'reading', NULL, 50, 405, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(406, 40, 'Final Quiz', NULL, 'reading', NULL, 50, 406, 1, '2025-12-27 02:22:23', '2025-12-27 02:22:23', NULL),
(411, 41, 'Exercise Framework Setup', NULL, 'reading', NULL, 50, 411, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(412, 41, 'Exercise: Credential Dumping', NULL, 'reading', NULL, 50, 412, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(413, 41, 'Exercise: Lateral Movement', NULL, 'reading', NULL, 50, 413, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(414, 41, 'Exercise: Data Exfiltration', NULL, 'reading', NULL, 50, 414, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(415, 41, 'Metrics & Reporting', NULL, 'reading', NULL, 50, 415, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(416, 41, 'Final Quiz', NULL, 'reading', NULL, 50, 416, 1, '2025-12-27 02:26:00', '2025-12-27 02:26:00', NULL),
(421, 42, 'Container Security Fundamentals', NULL, 'reading', NULL, 50, 421, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(422, 42, 'Docker Security Hardening', NULL, 'reading', NULL, 50, 422, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(423, 42, 'Kubernetes Security', NULL, 'reading', NULL, 50, 423, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(424, 42, 'Container Image Security', NULL, 'reading', NULL, 50, 424, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(425, 42, 'Runtime Protection', NULL, 'reading', NULL, 50, 425, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(426, 42, 'Final Quiz', NULL, 'reading', NULL, 50, 426, 1, '2025-12-27 02:27:22', '2025-12-27 02:27:22', NULL),
(431, 43, 'Zero Trust Principles', NULL, 'reading', NULL, 50, 431, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(432, 43, 'Identity as the Perimeter', NULL, 'reading', NULL, 50, 432, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(433, 43, 'Microsegmentation', NULL, 'reading', NULL, 50, 433, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(434, 43, 'Continuous Verification', NULL, 'reading', NULL, 50, 434, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(435, 43, 'Zero Trust Implementation', NULL, 'reading', NULL, 50, 435, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(436, 43, 'Final Quiz', NULL, 'reading', NULL, 50, 436, 1, '2025-12-27 02:28:42', '2025-12-27 02:28:42', NULL),
(441, 44, 'Security Frameworks Overview', NULL, 'reading', NULL, 50, 441, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(442, 44, 'NIST Cybersecurity Framework', NULL, 'reading', NULL, 50, 442, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(443, 44, 'ISO 27001 & 27002', NULL, 'reading', NULL, 50, 443, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(444, 44, 'SOC 2 Compliance', NULL, 'reading', NULL, 50, 444, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(445, 44, 'PCI-DSS & HIPAA', NULL, 'reading', NULL, 50, 445, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(446, 44, 'Final Quiz', NULL, 'reading', NULL, 50, 446, 1, '2025-12-27 02:30:07', '2025-12-27 02:30:07', NULL),
(765, 117, 'What is Cyber Threat Intelligence?', 'Define CTI and understand the Pyramid of Value.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:30:44', '2025-12-29 13:30:44', NULL),
(766, 117, 'The Intelligence Cycle', 'The 6 phases of CTI production.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(767, 117, 'Types of Threat Intelligence', 'Strategic, Operational, and Tactical.', 'reading', NULL, 50, 3, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(768, 117, 'Module 1 Assessment', 'Test your knowledge of CTI Fundamentals.', 'quiz', NULL, 100, 4, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(769, 118, 'Introduction to OSINT', 'What is OSINT, The Framework, and OPSEC.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(770, 118, 'Domain & Infrastructure Recon', 'DNS, WHOIS, and Certificate Transparency.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(771, 118, 'Social Media & HUMINT', 'Investigating people and groups.', 'reading', NULL, 50, 3, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(772, 118, 'OSINT Tools Workshop', 'Hands-on: Google Dorks, Shodan, and Maltego.', 'reading', NULL, 50, 4, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(773, 118, 'Module 2 Assessment', 'Test your OSINT knowledge.', 'quiz', NULL, 100, 5, 1, '2025-12-29 13:30:45', '2025-12-29 13:30:45', NULL),
(774, 119, 'Introduction to Malware Analysis', 'Static vs Dynamic Analysis.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(775, 119, 'Key Indicators: Strings & Hashes', 'Extracting low-hanging fruit.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(776, 119, 'Module 3 Assessment', 'Test your Malware Analysis knowledge.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(777, 120, 'IOCs vs IOAs', 'Indicators of Compromise vs Attack.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(778, 120, 'Traffic Light Protocol (TLP)', 'Sharing standards.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(779, 120, 'Module 4 Assessment', 'Test your Indicators & Standards knowledge.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(780, 121, 'The ATT&CK Framework', 'Tactics, Techniques, and Procedures.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(781, 121, 'MITRE Navigator', 'Visualizing coverage.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(782, 121, 'Module 5 Assessment', 'Test your MITRE knowledge.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(783, 122, 'Introduction to Threat Hunting', 'The Hunter\'s Mindset: Assume Breach.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(784, 122, 'Hunting Techniques', 'Stacking and Clustering.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(785, 122, 'Module 6 Assessment', 'Test your Threat Hunting knowledge.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(786, 123, 'TIP Capabilities', 'Aggregation, Normalization, Dissemination.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(787, 123, 'MISP (Malware Information Sharing Platform)', 'The open source standard.', 'reading', NULL, 50, 2, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(788, 123, 'Module 7 Assessment', 'Test your TIP knowledge.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(789, 124, 'Writing Effective Intel Reports', 'BLUF, Estimative Language, and Audience Analysis.', 'reading', NULL, 50, 1, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL),
(790, 124, 'Module 8 Assessment', 'Final Module Assessment.', 'quiz', NULL, 100, 3, 1, '2025-12-29 13:38:32', '2025-12-29 13:38:32', NULL);

-- --------------------------------------------------------

--
-- Table structure for table `user_alert_assignments`
--

CREATE TABLE `user_alert_assignments` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `assigned_date` date NOT NULL,
  `completed` tinyint(1) DEFAULT 0,
  `is_replay` tinyint(1) DEFAULT 0,
  `xp_earned` int(11) DEFAULT 0,
  `completed_at` datetime DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_alert_assignments`
--

INSERT INTO `user_alert_assignments` (`id`, `user_id`, `alert_id`, `assigned_date`, `completed`, `is_replay`, `xp_earned`, `completed_at`) VALUES
(1, 34, 383, '2026-01-11', 0, 0, 0, NULL),
(2, 34, 398, '2026-01-11', 0, 0, 0, NULL),
(3, 34, 359, '2026-01-11', 0, 0, 0, NULL),
(4, 34, 375, '2026-01-11', 0, 0, 0, NULL),
(5, 34, 302, '2026-01-11', 0, 0, 0, NULL),
(6, 34, 599, '2026-01-11', 0, 0, 0, NULL),
(7, 34, 355, '2026-01-11', 0, 0, 0, NULL),
(8, 34, 345, '2026-01-11', 0, 0, 0, NULL),
(9, 34, 596, '2026-01-11', 0, 0, 0, NULL),
(10, 34, 573, '2026-01-11', 0, 0, 0, NULL);

-- --------------------------------------------------------

--
-- Table structure for table `user_badges`
--

CREATE TABLE `user_badges` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `badge_id` int(11) NOT NULL,
  `earned_at` timestamp NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_badges`
--

INSERT INTO `user_badges` (`id`, `user_id`, `badge_id`, `earned_at`) VALUES
(1, 34, 1, '2025-12-26 01:00:05'),
(2, 1, 1, '2025-12-26 15:29:20'),
(3, 42, 1, '2025-12-30 13:40:31'),
(4, 65, 1, '2026-01-06 16:28:31');

-- --------------------------------------------------------

--
-- Table structure for table `user_lesson_answers`
--

CREATE TABLE `user_lesson_answers` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `question_id` int(11) NOT NULL,
  `submitted_answer` text DEFAULT NULL,
  `is_correct` tinyint(1) DEFAULT NULL,
  `submitted_at` timestamp NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_lesson_answers`
--

INSERT INTO `user_lesson_answers` (`id`, `user_id`, `question_id`, `submitted_answer`, `is_correct`, `submitted_at`) VALUES
(14, 1, 4164, 'Risk reduction', 1, '2025-12-26 15:29:20'),
(15, 1, 4165, 'SOC team', 1, '2025-12-26 15:29:20'),
(16, 1, 4166, 'Context', 1, '2025-12-26 15:29:20'),
(32, 34, 5522, 'ERROR', 1, '2025-12-26 21:14:00'),
(33, 34, 5523, 'db_admin', 1, '2025-12-26 21:14:00'),
(34, 34, 5524, 'users_db', 1, '2025-12-26 21:14:00'),
(35, 1, 6475, 'Analysis and Context', 1, '2025-12-29 13:52:47'),
(36, 1, 6476, 'A report advising to block an IP due to active ransomware targeting your industry', 1, '2025-12-29 13:53:26'),
(37, 1, 6477, 'To support decision making', 1, '2025-12-29 13:53:26'),
(38, 42, 4164, 'Integrity', 1, '2025-12-30 13:40:30'),
(39, 42, 4165, 'To trick users into revealing information', 1, '2025-12-30 13:40:31'),
(40, 42, 4166, 'SOC Analyst', 1, '2025-12-30 13:40:31'),
(41, 42, 4167, 'Detection', 1, '2025-12-30 13:41:34'),
(42, 42, 4168, 'Threat actor', 1, '2025-12-30 13:41:34'),
(43, 42, 4169, 'High priority', 1, '2025-12-30 13:41:34'),
(44, 42, 4170, 'Log data', 1, '2025-12-30 13:42:10'),
(45, 42, 4171, 'Confirmed threat', 1, '2025-12-30 13:42:10'),
(46, 42, 4172, 'High priority', 1, '2025-12-30 13:42:10'),
(47, 42, 4173, 'Protection', 1, '2025-12-30 13:42:40'),
(48, 42, 4174, 'Detection', 1, '2025-12-30 13:42:40'),
(49, 42, 4175, 'Security tool', 1, '2025-12-30 13:42:40'),
(50, 42, 4176, 'Threat actor', 1, '2025-12-30 13:43:10'),
(51, 42, 4177, 'Log data', 1, '2025-12-30 13:43:10'),
(52, 42, 4178, 'Context', 1, '2025-12-30 13:43:10'),
(53, 42, 5339, 'Network', 1, '2025-12-30 13:45:54'),
(54, 42, 5340, 'Segments', 1, '2025-12-30 13:45:54'),
(55, 42, 5341, 'Presentation', 1, '2025-12-30 13:45:54'),
(56, 42, 5342, 'TCP', 1, '2025-12-30 13:46:37'),
(57, 42, 5343, 'Speed', 1, '2025-12-30 13:46:37'),
(58, 42, 5344, 'Internet', 1, '2025-12-30 13:46:37'),
(59, 42, 5345, '192.168.1.10', 1, '2025-12-30 13:47:41'),
(60, 42, 5346, '32', 1, '2025-12-30 13:47:41'),
(61, 42, 5347, 'NAT', 1, '2025-12-30 13:47:42'),
(62, 42, 5348, '/24', 1, '2025-12-30 13:50:19'),
(63, 42, 5349, '254', 1, '2025-12-30 13:50:19'),
(64, 42, 5350, 'Network ID', 1, '2025-12-30 13:50:19'),
(65, 42, 5351, 'A', 1, '2025-12-30 13:51:39'),
(66, 42, 5352, 'MX', 1, '2025-12-30 13:51:39'),
(67, 42, 5353, 'DNS', 1, '2025-12-30 13:51:39'),
(68, 42, 5354, 'Discover', 1, '2025-12-30 13:52:49'),
(69, 42, 5355, 'IP to MAC', 1, '2025-12-30 13:52:49'),
(70, 42, 5356, 'ARP Spoofing', 1, '2025-12-30 13:52:49'),
(71, 42, 5357, '22', 1, '2025-12-30 13:53:51'),
(72, 42, 5358, 'Telnet', 1, '2025-12-30 13:53:51'),
(73, 42, 5359, 'SMB', 1, '2025-12-30 13:53:51'),
(74, 65, 4164, 'Integrity', 1, '2026-01-06 16:28:30'),
(75, 65, 4165, 'To trick users into revealing information', 1, '2026-01-06 16:28:30'),
(76, 65, 4166, 'SOC Analyst', 1, '2026-01-06 16:28:31');

-- --------------------------------------------------------

--
-- Table structure for table `user_lesson_grades`
--

CREATE TABLE `user_lesson_grades` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `task_id` int(11) NOT NULL,
  `score` decimal(5,2) NOT NULL,
  `total_questions` int(11) NOT NULL,
  `correct_answers` int(11) NOT NULL,
  `passed` tinyint(1) DEFAULT 0,
  `completed_at` timestamp NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_lesson_grades`
--

INSERT INTO `user_lesson_grades` (`id`, `user_id`, `task_id`, `score`, `total_questions`, `correct_answers`, `passed`, `completed_at`) VALUES
(1, 34, 1, 100.00, 4, 4, 1, '2025-12-26 01:24:19'),
(2, 34, 3, 100.00, 4, 4, 1, '2025-12-26 02:00:03'),
(3, 1, 1, 100.00, 3, 3, 1, '2025-12-26 15:29:20'),
(4, 34, 349, 92.00, 1, 1, 1, '2025-12-26 18:37:54'),
(5, 34, 350, 85.00, 1, 1, 1, '2025-12-26 19:11:06'),
(6, 34, 6, 100.00, 1, 1, 1, '2025-12-26 20:10:11'),
(7, 34, 7, 100.00, 1, 1, 1, '2025-12-26 20:14:32'),
(8, 34, 8, 100.00, 1, 1, 1, '2025-12-26 20:20:31'),
(9, 34, 9, 100.00, 1, 1, 1, '2025-12-26 20:22:23'),
(10, 34, 10, 100.00, 1, 1, 1, '2025-12-26 20:26:35'),
(11, 34, 11, 100.00, 1, 1, 1, '2025-12-26 20:28:07'),
(12, 34, 12, 100.00, 1, 1, 1, '2025-12-26 20:29:15'),
(13, 34, 32, 80.00, 5, 4, 1, '2025-12-26 20:44:41'),
(14, 34, 33, 80.00, 5, 4, 1, '2025-12-26 20:46:41'),
(15, 34, 34, 40.00, 5, 2, 0, '2025-12-26 20:47:33'),
(16, 34, 54, 100.00, 3, 3, 1, '2025-12-26 21:14:00'),
(17, 1, 771, 100.00, 3, 3, 1, '2025-12-29 13:53:27'),
(18, 42, 1, 100.00, 3, 3, 1, '2025-12-30 13:40:31'),
(19, 42, 2, 100.00, 3, 3, 1, '2025-12-30 13:41:34'),
(20, 42, 3, 100.00, 3, 3, 1, '2025-12-30 13:42:10'),
(21, 42, 4, 100.00, 3, 3, 1, '2025-12-30 13:42:41'),
(22, 42, 5, 100.00, 3, 3, 1, '2025-12-30 13:43:10'),
(23, 42, 22, 100.00, 3, 3, 1, '2025-12-30 13:45:54'),
(24, 42, 23, 100.00, 3, 3, 1, '2025-12-30 13:46:37'),
(25, 42, 24, 100.00, 3, 3, 1, '2025-12-30 13:47:42'),
(26, 42, 25, 100.00, 3, 3, 1, '2025-12-30 13:50:19'),
(27, 42, 26, 100.00, 3, 3, 1, '2025-12-30 13:51:39'),
(28, 42, 27, 100.00, 3, 3, 1, '2025-12-30 13:52:49'),
(29, 42, 28, 100.00, 3, 3, 1, '2025-12-30 13:53:51'),
(30, 65, 1, 100.00, 3, 3, 1, '2026-01-06 16:28:31');

-- --------------------------------------------------------

--
-- Table structure for table `user_operation_progress`
--

CREATE TABLE `user_operation_progress` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `operation_id` int(11) NOT NULL,
  `current_alert_sequence` int(11) DEFAULT 1,
  `started_at` timestamp NOT NULL DEFAULT current_timestamp(),
  `completed_at` timestamp NULL DEFAULT NULL
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

--
-- Dumping data for table `user_operation_progress`
--

INSERT INTO `user_operation_progress` (`id`, `user_id`, `operation_id`, `current_alert_sequence`, `started_at`, `completed_at`) VALUES
(1, 34, 1, 3, '2025-12-31 13:11:32', NULL),
(2, 34, 7, 2, '2026-01-02 04:31:15', NULL),
(3, 1, 37, 1, '2026-01-05 03:22:25', NULL),
(4, 34, 37, 2, '2026-01-06 00:53:10', NULL),
(5, 1, 47, 1, '2026-01-06 01:49:25', NULL),
(6, 1, 48, 1, '2026-01-06 19:45:51', NULL),
(7, 68, 48, 4, '2026-01-07 16:11:48', NULL),
(8, 34, 48, 1, '2026-01-11 01:35:25', NULL),
(9, 34, 51, 1, '2026-01-11 01:38:00', NULL);

-- --------------------------------------------------------

--
-- Table structure for table `user_path_progress`
--

CREATE TABLE `user_path_progress` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `learning_path_id` int(11) NOT NULL,
  `enrolled_at` timestamp NULL DEFAULT current_timestamp(),
  `completed_at` timestamp NULL DEFAULT NULL,
  `percentage_completed` decimal(5,2) DEFAULT 0.00,
  `current_module_id` int(11) DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `certificate_id` varchar(255) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_path_progress`
--

INSERT INTO `user_path_progress` (`id`, `user_id`, `learning_path_id`, `enrolled_at`, `completed_at`, `percentage_completed`, `current_module_id`, `created_at`, `updated_at`, `certificate_id`) VALUES
(1, 34, 1, '2025-12-26 00:53:30', NULL, 29.55, NULL, '2025-12-26 00:53:30', '2025-12-26 20:46:41', NULL),
(2, 34, 2, '2025-12-26 02:54:35', NULL, 1.33, NULL, '2025-12-26 02:54:35', '2025-12-26 21:14:00', NULL),
(3, 34, 3, '2025-12-26 03:17:44', NULL, 0.00, NULL, '2025-12-26 03:17:44', '2025-12-26 03:17:44', NULL),
(5, 34, 4, '2025-12-26 03:17:47', NULL, 0.00, NULL, '2025-12-26 03:17:47', '2025-12-26 03:17:47', NULL),
(8, 1, 2, '2025-12-26 10:00:57', NULL, 0.00, NULL, '2025-12-26 10:00:57', '2025-12-26 10:00:57', NULL),
(10, 1, 4, '2025-12-26 14:08:00', NULL, 0.00, NULL, '2025-12-26 14:08:00', '2025-12-26 14:08:00', NULL),
(11, 1, 3, '2025-12-26 14:09:43', NULL, 0.00, NULL, '2025-12-26 14:09:43', '2025-12-26 14:09:43', NULL),
(12, 1, 1, '2025-12-26 15:33:20', NULL, 0.00, NULL, '2025-12-26 15:33:20', '2025-12-26 15:33:20', NULL),
(13, 34, 5, '2025-12-26 17:59:48', NULL, 8.00, NULL, '2025-12-26 17:59:48', '2025-12-29 03:18:58', NULL),
(14, 1, 5, '2025-12-27 03:06:50', NULL, 0.00, NULL, '2025-12-27 03:06:50', '2025-12-29 03:18:58', NULL),
(15, 39, 5, '2025-12-27 03:56:25', NULL, 0.00, NULL, '2025-12-27 03:56:25', '2025-12-29 03:18:58', NULL),
(16, 40, 5, '2025-12-27 04:13:07', NULL, 0.00, NULL, '2025-12-27 04:13:07', '2025-12-29 03:18:58', NULL),
(17, 40, 1, '2025-12-27 04:19:13', NULL, 0.00, NULL, '2025-12-27 04:19:13', '2025-12-27 04:19:13', NULL),
(18, 41, 5, '2025-12-27 10:28:37', NULL, 0.00, NULL, '2025-12-27 10:28:37', '2025-12-29 03:18:58', NULL),
(19, 42, 5, '2025-12-27 11:49:51', NULL, 0.00, NULL, '2025-12-27 11:49:51', '2025-12-29 03:18:58', NULL),
(20, 42, 1, '2025-12-27 12:42:27', NULL, 28.57, NULL, '2025-12-27 12:42:27', '2025-12-30 13:53:51', NULL),
(21, 43, 5, '2025-12-27 17:35:02', NULL, 0.00, NULL, '2025-12-27 17:35:02', '2025-12-29 03:18:58', NULL),
(22, 43, 1, '2025-12-27 17:36:08', NULL, 0.00, NULL, '2025-12-27 17:36:08', '2025-12-27 17:36:08', NULL),
(23, 44, 5, '2025-12-27 20:59:19', NULL, 0.00, NULL, '2025-12-27 20:59:19', '2025-12-29 03:18:58', NULL),
(24, 44, 1, '2025-12-27 21:00:51', NULL, 0.00, NULL, '2025-12-27 21:00:51', '2025-12-27 21:00:51', NULL),
(25, 45, 5, '2025-12-28 17:13:10', NULL, 0.00, NULL, '2025-12-28 17:13:10', '2025-12-29 03:18:58', NULL),
(26, 45, 4, '2025-12-28 17:13:28', NULL, 0.00, NULL, '2025-12-28 17:13:28', '2025-12-28 17:13:28', NULL),
(27, 46, 5, '2025-12-28 17:31:43', NULL, 0.00, NULL, '2025-12-28 17:31:43', '2025-12-29 03:18:58', NULL),
(28, 47, 5, '2025-12-28 17:52:28', NULL, 0.00, NULL, '2025-12-28 17:52:28', '2025-12-29 03:18:58', NULL),
(29, 48, 5, '2025-12-28 19:32:17', NULL, 0.00, NULL, '2025-12-28 19:32:17', '2025-12-29 03:18:58', NULL),
(30, 49, 5, '2025-12-28 19:54:53', NULL, 0.00, NULL, '2025-12-28 19:54:53', '2025-12-29 03:18:58', NULL),
(31, 50, 5, '2025-12-28 21:32:20', NULL, 0.00, NULL, '2025-12-28 21:32:20', '2025-12-29 03:18:58', NULL),
(32, 51, 5, '2025-12-28 21:55:58', NULL, 0.00, NULL, '2025-12-28 21:55:58', '2025-12-29 03:18:58', NULL),
(35, 51, 1, '2025-12-28 22:32:39', NULL, 0.00, NULL, '2025-12-28 22:32:39', '2025-12-28 22:32:39', NULL),
(36, 52, 5, '2025-12-29 00:28:27', NULL, 0.00, NULL, '2025-12-29 00:28:27', '2025-12-29 03:18:58', NULL),
(44, 52, 1, '2025-12-29 08:09:40', NULL, 0.00, NULL, '2025-12-29 08:09:40', '2025-12-29 08:09:40', NULL),
(45, 1, 6, '2025-12-29 13:51:54', NULL, 3.85, NULL, '2025-12-29 13:51:54', '2025-12-29 13:53:27', NULL),
(46, 1, 9, '2025-12-29 16:24:12', NULL, 0.00, NULL, '2025-12-29 16:24:12', '2025-12-29 16:24:12', NULL),
(47, 54, 9, '2025-12-29 21:29:25', NULL, 0.00, NULL, '2025-12-29 21:29:25', '2025-12-29 21:29:25', NULL),
(48, 54, 1, '2025-12-29 22:40:53', NULL, 0.00, NULL, '2025-12-29 22:40:53', '2025-12-29 22:40:53', NULL),
(49, 55, 9, '2025-12-31 01:11:23', NULL, 0.00, NULL, '2025-12-31 01:11:23', '2025-12-31 01:11:23', NULL),
(50, 56, 9, '2025-12-31 07:24:05', NULL, 0.00, NULL, '2025-12-31 07:24:05', '2025-12-31 07:24:05', NULL),
(51, 57, 9, '2025-12-31 07:24:26', NULL, 0.00, NULL, '2025-12-31 07:24:26', '2025-12-31 07:24:26', NULL),
(52, 56, 4, '2025-12-31 07:27:27', NULL, 0.00, NULL, '2025-12-31 07:27:27', '2025-12-31 07:27:27', NULL),
(53, 56, 6, '2025-12-31 07:28:39', NULL, 0.00, NULL, '2025-12-31 07:28:39', '2025-12-31 07:28:39', NULL),
(54, 56, 2, '2025-12-31 07:28:43', NULL, 0.00, NULL, '2025-12-31 07:28:43', '2025-12-31 07:28:43', NULL),
(55, 58, 9, '2025-12-31 14:33:15', NULL, 0.00, NULL, '2025-12-31 14:33:15', '2025-12-31 14:33:15', NULL),
(56, 59, 9, '2026-01-01 21:33:27', NULL, 0.00, NULL, '2026-01-01 21:33:27', '2026-01-01 21:33:27', NULL),
(57, 60, 9, '2026-01-02 00:49:19', NULL, 0.00, NULL, '2026-01-02 00:49:19', '2026-01-02 00:49:19', NULL),
(58, 61, 9, '2026-01-02 06:46:42', NULL, 0.00, NULL, '2026-01-02 06:46:42', '2026-01-02 06:46:42', NULL),
(59, 61, 1, '2026-01-02 06:49:58', NULL, 0.00, NULL, '2026-01-02 06:49:58', '2026-01-02 06:49:58', NULL),
(60, 62, 9, '2026-01-02 11:36:35', NULL, 0.00, NULL, '2026-01-02 11:36:35', '2026-01-02 11:36:35', NULL),
(61, 63, 9, '2026-01-02 21:09:30', NULL, 0.00, NULL, '2026-01-02 21:09:30', '2026-01-02 21:09:30', NULL),
(62, 64, 9, '2026-01-03 21:32:47', NULL, 0.00, NULL, '2026-01-03 21:32:47', '2026-01-03 21:32:47', NULL),
(63, 49, 1, '2026-01-04 22:28:44', NULL, 0.00, NULL, '2026-01-04 22:28:44', '2026-01-04 22:28:44', NULL),
(64, 61, 4, '2026-01-05 11:09:23', NULL, 0.00, NULL, '2026-01-05 11:09:23', '2026-01-05 11:09:23', NULL),
(65, 34, 9, '2026-01-06 00:39:27', NULL, 0.00, NULL, '2026-01-06 00:39:27', '2026-01-06 00:39:27', NULL),
(66, 65, 9, '2026-01-06 06:39:55', NULL, 0.00, NULL, '2026-01-06 06:39:55', '2026-01-06 06:39:55', NULL),
(67, 65, 3, '2026-01-06 06:49:34', NULL, 0.00, NULL, '2026-01-06 06:49:34', '2026-01-06 06:49:34', NULL),
(68, 65, 4, '2026-01-06 06:56:51', NULL, 0.00, NULL, '2026-01-06 06:56:51', '2026-01-06 06:56:51', NULL),
(69, 65, 1, '2026-01-06 07:02:18', NULL, 2.38, NULL, '2026-01-06 07:02:18', '2026-01-06 16:28:31', NULL),
(70, 65, 2, '2026-01-06 07:02:49', NULL, 0.00, NULL, '2026-01-06 07:02:49', '2026-01-06 07:02:49', NULL),
(71, 65, 6, '2026-01-06 08:12:49', NULL, 0.00, NULL, '2026-01-06 08:12:49', '2026-01-06 08:12:49', NULL),
(72, 66, 9, '2026-01-06 13:58:05', NULL, 0.00, NULL, '2026-01-06 13:58:05', '2026-01-06 13:58:05', NULL),
(73, 67, 9, '2026-01-07 03:07:05', NULL, 0.00, NULL, '2026-01-07 03:07:05', '2026-01-07 03:07:05', NULL),
(74, 68, 9, '2026-01-07 15:58:56', NULL, 0.00, NULL, '2026-01-07 15:58:56', '2026-01-07 15:58:56', NULL),
(75, 68, 1, '2026-01-07 16:03:06', NULL, 0.00, NULL, '2026-01-07 16:03:06', '2026-01-07 16:03:06', NULL),
(76, 69, 9, '2026-01-07 22:45:50', NULL, 0.00, NULL, '2026-01-07 22:45:50', '2026-01-07 22:45:50', NULL),
(77, 70, 9, '2026-01-08 14:51:54', NULL, 0.00, NULL, '2026-01-08 14:51:54', '2026-01-08 14:51:54', NULL),
(78, 71, 9, '2026-01-10 06:32:03', NULL, 0.00, NULL, '2026-01-10 06:32:03', '2026-01-10 06:32:03', NULL),
(79, 72, 9, '2026-01-10 14:11:37', NULL, 0.00, NULL, '2026-01-10 14:11:37', '2026-01-10 14:11:37', NULL),
(80, 72, 1, '2026-01-10 14:19:22', NULL, 0.00, NULL, '2026-01-10 14:19:22', '2026-01-10 14:19:22', NULL);

-- --------------------------------------------------------

--
-- Table structure for table `user_path_specialization`
--

CREATE TABLE `user_path_specialization` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `path_code` varchar(20) NOT NULL,
  `level` int(11) DEFAULT 1,
  `xp` int(11) DEFAULT 0,
  `alerts_completed` int(11) DEFAULT 0,
  `missions_completed` int(11) DEFAULT 0,
  `average_score` decimal(5,2) DEFAULT 0.00,
  `last_activity_date` datetime DEFAULT NULL,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `user_task_progress`
--

CREATE TABLE `user_task_progress` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `task_id` int(11) NOT NULL,
  `completed` tinyint(1) DEFAULT 0,
  `completed_at` timestamp NULL DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_task_progress`
--

INSERT INTO `user_task_progress` (`id`, `user_id`, `task_id`, `completed`, `completed_at`, `created_at`, `updated_at`) VALUES
(1, 34, 1, 1, '2025-12-26 01:00:05', '2025-12-26 01:00:05', '2025-12-26 01:00:05'),
(2, 34, 5, 1, '2025-12-26 01:02:04', '2025-12-26 01:02:04', '2025-12-26 01:02:04'),
(3, 34, 2, 1, '2025-12-26 01:04:03', '2025-12-26 01:04:03', '2025-12-26 01:04:03'),
(4, 34, 3, 1, '2025-12-26 02:00:03', '2025-12-26 02:00:03', '2025-12-26 02:00:03'),
(5, 1, 1, 1, '2025-12-26 15:29:20', '2025-12-26 15:29:20', '2025-12-26 15:29:20'),
(6, 34, 349, 1, '2025-12-26 18:31:49', '2025-12-26 18:31:49', '2025-12-26 18:31:49'),
(7, 34, 350, 1, '2025-12-26 19:11:06', '2025-12-26 19:11:06', '2025-12-26 19:11:06'),
(8, 34, 6, 1, '2025-12-26 20:10:11', '2025-12-26 20:10:11', '2025-12-26 20:10:11'),
(9, 34, 7, 1, '2025-12-26 20:14:32', '2025-12-26 20:14:32', '2025-12-26 20:14:32'),
(10, 34, 8, 1, '2025-12-26 20:20:31', '2025-12-26 20:20:31', '2025-12-26 20:20:31'),
(11, 34, 9, 1, '2025-12-26 20:22:23', '2025-12-26 20:22:23', '2025-12-26 20:22:23'),
(12, 34, 10, 1, '2025-12-26 20:26:35', '2025-12-26 20:26:35', '2025-12-26 20:26:35'),
(13, 34, 11, 1, '2025-12-26 20:28:07', '2025-12-26 20:28:07', '2025-12-26 20:28:07'),
(14, 34, 12, 1, '2025-12-26 20:29:15', '2025-12-26 20:29:15', '2025-12-26 20:29:15'),
(15, 34, 32, 1, '2025-12-26 20:44:41', '2025-12-26 20:44:41', '2025-12-26 20:44:41'),
(16, 34, 33, 1, '2025-12-26 20:46:41', '2025-12-26 20:46:41', '2025-12-26 20:46:41'),
(17, 34, 54, 1, '2025-12-26 21:14:00', '2025-12-26 21:14:00', '2025-12-26 21:14:00'),
(18, 1, 771, 1, '2025-12-29 13:53:27', '2025-12-29 13:53:27', '2025-12-29 13:53:27'),
(19, 42, 1, 1, '2025-12-30 13:40:31', '2025-12-30 13:40:31', '2025-12-30 13:40:31'),
(20, 42, 2, 1, '2025-12-30 13:41:34', '2025-12-30 13:41:34', '2025-12-30 13:41:34'),
(21, 42, 3, 1, '2025-12-30 13:42:10', '2025-12-30 13:42:10', '2025-12-30 13:42:10'),
(22, 42, 4, 1, '2025-12-30 13:42:41', '2025-12-30 13:42:41', '2025-12-30 13:42:41'),
(23, 42, 5, 1, '2025-12-30 13:43:10', '2025-12-30 13:43:10', '2025-12-30 13:43:10'),
(24, 42, 22, 1, '2025-12-30 13:45:54', '2025-12-30 13:45:54', '2025-12-30 13:45:54'),
(25, 42, 23, 1, '2025-12-30 13:46:37', '2025-12-30 13:46:37', '2025-12-30 13:46:37'),
(26, 42, 24, 1, '2025-12-30 13:47:42', '2025-12-30 13:47:42', '2025-12-30 13:47:42'),
(27, 42, 25, 1, '2025-12-30 13:50:19', '2025-12-30 13:50:19', '2025-12-30 13:50:19'),
(28, 42, 26, 1, '2025-12-30 13:51:39', '2025-12-30 13:51:39', '2025-12-30 13:51:39'),
(29, 42, 27, 1, '2025-12-30 13:52:49', '2025-12-30 13:52:49', '2025-12-30 13:52:49'),
(30, 42, 28, 1, '2025-12-30 13:53:51', '2025-12-30 13:53:51', '2025-12-30 13:53:51'),
(31, 65, 1, 1, '2026-01-06 16:28:31', '2026-01-06 16:28:31', '2026-01-06 16:28:31');

-- --------------------------------------------------------

--
-- Table structure for table `user_xp`
--

CREATE TABLE `user_xp` (
  `user_id` int(11) NOT NULL,
  `total_xp` int(11) DEFAULT 0,
  `current_level` int(11) DEFAULT 1,
  `xp_to_next_level` int(11) DEFAULT 100,
  `streak_days` int(11) DEFAULT 0,
  `last_activity_date` date DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `user_xp`
--

INSERT INTO `user_xp` (`user_id`, `total_xp`, `current_level`, `xp_to_next_level`, `streak_days`, `last_activity_date`, `created_at`, `updated_at`) VALUES
(1, 170, 2, 200, 1, '2026-01-11', '2025-12-26 10:00:34', '2026-01-11 00:54:03'),
(34, 760, 8, 800, 1, '2026-01-11', '2025-12-26 00:52:27', '2026-01-11 00:54:37'),
(40, 0, 1, 100, 0, NULL, '2025-12-27 04:17:43', '2025-12-27 04:17:43'),
(42, 630, 7, 700, 0, NULL, '2025-12-27 11:51:16', '2025-12-30 13:53:51'),
(43, 0, 1, 100, 0, NULL, '2025-12-27 17:35:51', '2025-12-27 17:35:51'),
(44, 0, 1, 100, 0, NULL, '2025-12-27 21:00:47', '2025-12-27 21:00:47'),
(45, 0, 1, 100, 0, NULL, '2025-12-28 17:13:20', '2025-12-28 17:13:20'),
(49, 0, 1, 100, 0, NULL, '2026-01-04 22:28:27', '2026-01-04 22:28:27'),
(50, 0, 1, 100, 0, NULL, '2025-12-28 22:58:56', '2025-12-28 22:58:56'),
(51, 0, 1, 100, 0, NULL, '2025-12-28 21:56:13', '2025-12-28 21:56:13'),
(52, 0, 1, 100, 0, NULL, '2025-12-29 08:08:59', '2025-12-29 08:08:59'),
(54, 100, 2, 200, 1, '2026-01-03', '2025-12-29 21:45:59', '2026-01-03 16:55:44'),
(56, 0, 1, 100, 0, NULL, '2025-12-31 07:27:18', '2025-12-31 07:27:18'),
(60, 0, 1, 100, 0, NULL, '2026-01-02 00:57:21', '2026-01-02 00:57:21'),
(61, 0, 1, 100, 0, NULL, '2026-01-02 06:48:50', '2026-01-02 06:48:50'),
(65, 70, 1, 100, 0, NULL, '2026-01-06 06:48:50', '2026-01-06 16:28:31'),
(68, 0, 1, 100, 0, NULL, '2026-01-07 16:01:15', '2026-01-07 16:01:15'),
(71, 0, 1, 100, 0, NULL, '2026-01-10 06:39:37', '2026-01-10 06:39:37'),
(72, 0, 1, 100, 0, NULL, '2026-01-10 14:15:16', '2026-01-10 14:15:16');

--
-- Indexes for dumped tables
--

--
-- Indexes for table `alerts`
--
ALTER TABLE `alerts`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `alert_grades`
--
ALTER TABLE `alert_grades`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `badges`
--
ALTER TABLE `badges`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `blog_posts`
--
ALTER TABLE `blog_posts`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `slug` (`slug`);

--
-- Indexes for table `feedbacks`
--
ALTER TABLE `feedbacks`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `investigations`
--
ALTER TABLE `investigations`
  ADD PRIMARY KEY (`id`),
  ADD KEY `user_id` (`user_id`),
  ADD KEY `alert_id` (`alert_id`);

--
-- Indexes for table `investigation_notes`
--
ALTER TABLE `investigation_notes`
  ADD PRIMARY KEY (`id`),
  ADD KEY `user_id` (`user_id`),
  ADD KEY `alert_id` (`alert_id`);

--
-- Indexes for table `learning_paths`
--
ALTER TABLE `learning_paths`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `lesson_content`
--
ALTER TABLE `lesson_content`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_task_content` (`task_id`);

--
-- Indexes for table `lesson_questions`
--
ALTER TABLE `lesson_questions`
  ADD PRIMARY KEY (`id`),
  ADD KEY `idx_task_order` (`task_id`,`question_order`);

--
-- Indexes for table `modules`
--
ALTER TABLE `modules`
  ADD PRIMARY KEY (`id`),
  ADD KEY `prerequisite_module_id` (`prerequisite_module_id`),
  ADD KEY `idx_modules_path` (`learning_path_id`);

--
-- Indexes for table `notifications`
--
ALTER TABLE `notifications`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `operations`
--
ALTER TABLE `operations`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `operation_alerts`
--
ALTER TABLE `operation_alerts`
  ADD PRIMARY KEY (`id`),
  ADD KEY `operation_id` (`operation_id`),
  ADD KEY `alert_id` (`alert_id`);

--
-- Indexes for table `password_resets`
--
ALTER TABLE `password_resets`
  ADD PRIMARY KEY (`id`);

--
-- Indexes for table `system_settings`
--
ALTER TABLE `system_settings`
  ADD PRIMARY KEY (`key`);

--
-- Indexes for table `tasks`
--
ALTER TABLE `tasks`
  ADD PRIMARY KEY (`id`),
  ADD KEY `idx_tasks_module` (`module_id`),
  ADD KEY `fk_task_alert` (`alert_id`);

--
-- Indexes for table `user_alert_assignments`
--
ALTER TABLE `user_alert_assignments`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_alert_date` (`user_id`,`alert_id`,`assigned_date`),
  ADD KEY `idx_user_date` (`user_id`,`assigned_date`);

--
-- Indexes for table `user_badges`
--
ALTER TABLE `user_badges`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_badge` (`user_id`,`badge_id`),
  ADD KEY `badge_id` (`badge_id`),
  ADD KEY `idx_user_badges_user` (`user_id`);

--
-- Indexes for table `user_lesson_answers`
--
ALTER TABLE `user_lesson_answers`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_question` (`user_id`,`question_id`),
  ADD KEY `question_id` (`question_id`);

--
-- Indexes for table `user_lesson_grades`
--
ALTER TABLE `user_lesson_grades`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_task_grade` (`user_id`,`task_id`),
  ADD KEY `task_id` (`task_id`);

--
-- Indexes for table `user_operation_progress`
--
ALTER TABLE `user_operation_progress`
  ADD PRIMARY KEY (`id`),
  ADD KEY `user_id` (`user_id`),
  ADD KEY `operation_id` (`operation_id`);

--
-- Indexes for table `user_path_progress`
--
ALTER TABLE `user_path_progress`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_path` (`user_id`,`learning_path_id`),
  ADD KEY `learning_path_id` (`learning_path_id`),
  ADD KEY `current_module_id` (`current_module_id`),
  ADD KEY `idx_user_path_user` (`user_id`);

--
-- Indexes for table `user_path_specialization`
--
ALTER TABLE `user_path_specialization`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_path` (`user_id`,`path_code`);

--
-- Indexes for table `user_task_progress`
--
ALTER TABLE `user_task_progress`
  ADD PRIMARY KEY (`id`),
  ADD UNIQUE KEY `unique_user_task` (`user_id`,`task_id`),
  ADD KEY `idx_user_progress_user` (`user_id`),
  ADD KEY `idx_user_progress_task` (`task_id`);

--
-- Indexes for table `user_xp`
--
ALTER TABLE `user_xp`
  ADD PRIMARY KEY (`user_id`);

--
-- AUTO_INCREMENT for dumped tables
--

--
-- AUTO_INCREMENT for table `alerts`
--
ALTER TABLE `alerts`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `alert_grades`
--
ALTER TABLE `alert_grades`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `badges`
--
ALTER TABLE `badges`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=6;

--
-- AUTO_INCREMENT for table `blog_posts`
--
ALTER TABLE `blog_posts`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=30;

--
-- AUTO_INCREMENT for table `feedbacks`
--
ALTER TABLE `feedbacks`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `investigations`
--
ALTER TABLE `investigations`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=101;

--
-- AUTO_INCREMENT for table `investigation_notes`
--
ALTER TABLE `investigation_notes`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `learning_paths`
--
ALTER TABLE `learning_paths`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=11;

--
-- AUTO_INCREMENT for table `lesson_content`
--
ALTER TABLE `lesson_content`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=1004;

--
-- AUTO_INCREMENT for table `lesson_questions`
--
ALTER TABLE `lesson_questions`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=7110;

--
-- AUTO_INCREMENT for table `modules`
--
ALTER TABLE `modules`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=125;

--
-- AUTO_INCREMENT for table `notifications`
--
ALTER TABLE `notifications`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `operations`
--
ALTER TABLE `operations`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=60;

--
-- AUTO_INCREMENT for table `operation_alerts`
--
ALTER TABLE `operation_alerts`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=314;

--
-- AUTO_INCREMENT for table `password_resets`
--
ALTER TABLE `password_resets`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `tasks`
--
ALTER TABLE `tasks`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=791;

--
-- AUTO_INCREMENT for table `user_alert_assignments`
--
ALTER TABLE `user_alert_assignments`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=11;

--
-- AUTO_INCREMENT for table `user_badges`
--
ALTER TABLE `user_badges`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=5;

--
-- AUTO_INCREMENT for table `user_lesson_answers`
--
ALTER TABLE `user_lesson_answers`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=77;

--
-- AUTO_INCREMENT for table `user_lesson_grades`
--
ALTER TABLE `user_lesson_grades`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=31;

--
-- AUTO_INCREMENT for table `user_operation_progress`
--
ALTER TABLE `user_operation_progress`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=10;

--
-- AUTO_INCREMENT for table `user_path_progress`
--
ALTER TABLE `user_path_progress`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=81;

--
-- AUTO_INCREMENT for table `user_path_specialization`
--
ALTER TABLE `user_path_specialization`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

--
-- AUTO_INCREMENT for table `user_task_progress`
--
ALTER TABLE `user_task_progress`
  MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=32;

--
-- Constraints for dumped tables
--

--
-- Constraints for table `investigations`
--
ALTER TABLE `investigations`
  ADD CONSTRAINT `investigations_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `investigations_ibfk_2` FOREIGN KEY (`alert_id`) REFERENCES `alerts` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `investigation_notes`
--
ALTER TABLE `investigation_notes`
  ADD CONSTRAINT `notes_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `notes_ibfk_2` FOREIGN KEY (`alert_id`) REFERENCES `alerts` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `lesson_content`
--
ALTER TABLE `lesson_content`
  ADD CONSTRAINT `lesson_content_ibfk_1` FOREIGN KEY (`task_id`) REFERENCES `tasks` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `lesson_questions`
--
ALTER TABLE `lesson_questions`
  ADD CONSTRAINT `lesson_questions_ibfk_1` FOREIGN KEY (`task_id`) REFERENCES `tasks` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `modules`
--
ALTER TABLE `modules`
  ADD CONSTRAINT `modules_ibfk_1` FOREIGN KEY (`learning_path_id`) REFERENCES `learning_paths` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `modules_ibfk_2` FOREIGN KEY (`prerequisite_module_id`) REFERENCES `modules` (`id`) ON DELETE SET NULL;

--
-- Constraints for table `tasks`
--
ALTER TABLE `tasks`
  ADD CONSTRAINT `fk_task_alert` FOREIGN KEY (`alert_id`) REFERENCES `alerts` (`id`) ON DELETE SET NULL,
  ADD CONSTRAINT `tasks_ibfk_1` FOREIGN KEY (`module_id`) REFERENCES `modules` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `user_badges`
--
ALTER TABLE `user_badges`
  ADD CONSTRAINT `user_badges_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_badges_ibfk_2` FOREIGN KEY (`badge_id`) REFERENCES `badges` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `user_lesson_answers`
--
ALTER TABLE `user_lesson_answers`
  ADD CONSTRAINT `user_lesson_answers_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_lesson_answers_ibfk_2` FOREIGN KEY (`question_id`) REFERENCES `lesson_questions` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `user_lesson_grades`
--
ALTER TABLE `user_lesson_grades`
  ADD CONSTRAINT `user_lesson_grades_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_lesson_grades_ibfk_2` FOREIGN KEY (`task_id`) REFERENCES `tasks` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `user_path_progress`
--
ALTER TABLE `user_path_progress`
  ADD CONSTRAINT `user_path_progress_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_path_progress_ibfk_2` FOREIGN KEY (`learning_path_id`) REFERENCES `learning_paths` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_path_progress_ibfk_3` FOREIGN KEY (`current_module_id`) REFERENCES `modules` (`id`) ON DELETE SET NULL;

--
-- Constraints for table `user_task_progress`
--
ALTER TABLE `user_task_progress`
  ADD CONSTRAINT `user_task_progress_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
  ADD CONSTRAINT `user_task_progress_ibfk_2` FOREIGN KEY (`task_id`) REFERENCES `tasks` (`id`) ON DELETE CASCADE;

--
-- Constraints for table `user_xp`
--
ALTER TABLE `user_xp`
  ADD CONSTRAINT `user_xp_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE;
COMMIT;


