Operation Cyber Shield

start

Maya Thomas - Chief Information Security OfficerTeam,We are facing a significant breach at the headquarters of Cyber Shield Inc., a leading tech company with high-profile clients and highly classified projects. Secure files have been accessed, system performance has slowed down, and now critical files are disappearing. This is a serious situation.The disruption is already impacting countless businesses, causing revenue loss. Worse still, if these secure files are leaked to the public, top-secret projects could be exposed, posing a risk to national security. We cannot afford to let that happen. We must act immediately.A ransom note has been posted online. Let me be clear—we will not pay. Giving in only invites further attacks from this group and others like them. Our initial analysis points to the breach originating from the laptop of our Chief Security Officer, Brian Clark. That’s where we need to focus our efforts. Head to Clark's office and begin the investigation. Time is of the essence.We need to work out who the hackers are so that we can stop them from causing any further damage.

We're here! We need to get into the laptop... Lets have a look around, there may be some clues that could help uncover the password...

Click here to show interactive elements

File Explorer

Task Manager

We're in! Now, maybe we can work out what the hackers were up to...

Click here to show interactive elements

Can we work it out now?

Back to the Cipher Page

How to decode a caesar cipher

"The messenger writes the number that the letters were moved by, next to the message..."

"And then, each letter is moved along the alphabet by a set number..."

"And then, each letter is moved along the alphabet by a set number"

Can we work it out now?

Back to the Cipher Page

How to decode a caesar cipher

"The messenger writes the number that the letters were moved by, next to the message..."

"And then, each letter is moved along the alphabet by a set number..."

"And then, each letter is moved along the alphabet by a set number"

Can we work it out now?

Back to the Cipher Page

How to decode a caesar cipher

"The messenger writes the number that the letters were moved by, next to the message..."

"And then, each letter is moved along the alphabet by a set number..."

"And then, each letter is moved along the alphabet by a set number"

File Explorer

Task Manager

Ok... Now we know what they're trying to do, we can stop them! Brian is heading to the server room to find the DDM Hard Drive, DDM is a very important client and it would be devistating if this data got into the wrong hands. To find the hard drive, we need to find it's serial number. I know theres a big spreadsheet with all of the project harddrives on it... but where...

File Explorer

Task Manager

Nope, nothing here. Try recents

File Explorer

Task Manager

Nothing here either... Lets look around the office again...

"This looks like morse code... Have we seen something that could help us decode this message? "

Password Protected... Looks like we need to put these numbers in order. Oh wait! Theres something on the back:

o o o o o o o o - - o o - - - o o o o - o - - - - - o o o o

File Explorer

Task Manager

Whats the serial number?

Remember, the name of the project was DDM!

The office is complete! We got everything we needed, lets get to the server room

Wow! Its so dark! Here, use this key card to get into the server room.Oh no! I dropped it! Can you see it anywhere?

Whats going on! Ah, looks like the hackers have disabled the cooling systems! This is bad, we need to fix this now or all the data stored in here could be destroyed!

Hurry! We don't have long before the system malfunctions and all data is lost! Lets get the wires in the right order.

Yes! You did it! Well Done. The data is safe.Hopefully they didn't manage to find the hard drive. Lets look for it. What was the serial number again?Ah yes, S42LKSB426N

We need to find out who is behind this. The phone! Yes, lets take it back to the office and try to get in!

Back to the office

The server room is complete! We got everything we needed, lets get back to the office

Lets look around see if we can find a finger print to use to get into the phone...We can use this tape to get the print

Click here to show interactive elements

10:47

Touch Finger To Unlock

We're In! Greatwork team. Now,we know they bribed Brian to help them...Lets check his bank statement, we may be able to find the bribe...

10:47

Lets look at the most recent statement, see if we can find anything...and its

BANKING APP

Statement: 17/08/24 - 17/09/24

Statement: 17/07/24 - 17/08/24

Statement: 17/06/24 - 17/07/24

Statement: 17/05/24 - 17/06/24

Statement: 17/04/24 - 17/05/24

Statement: 17/03/24 - 17/04/24

Statement: 17/02/24 - 17/03/24

Statement: 17/01/24 - 17/02/24

Touch Finger To Unlock

Back To Page

Touch Finger To Unlock

Back To Page

10:52

Touch Finger To Unlock

Ok, we found the bribe, and it was under DCrane. That doesn't give us much...We also know that the bribe was paid on the 17th September... Lets see if DCrane sent Brian anything else that day...

To: Brian ClarkFrom: Anonymous

Did you get it?

File Message Help

Move to FolderOpen Delivery ReportResend or RecallProperties

This is it! Lets find the IP address, then we can figure out where the hacker is and get them...Click on File and then properties to find the IP address...

10:57

Touch Finger To Unlock

10:57

Touch Finger To Unlock

We have Damon's Location, we've got him!Now we can end this. Great job team, you stopped the cyber attack!!!

BREEZE

IP Address Look Up

Nov 1, 2024 . Lookup a geolocation of an IP address including latitude, longitude, city, region and country...

What is an IP Address

June 29, 2022 . Internet Protocol (IP) address: unique number given to every device that is connected to the internet, allowing each device to be identified and located...

What is my IP Address

May 1, 2024 . An IP address is an individual number associated with your device. This site will show your public IP Address...

Videos on "IP ADDRESS LOOK UP"

November 12, 2024. Click here to see educational videos on IP addresses and their uses in cybersecurity...

IP Address Look Up

Insert IP Address...

IP Address: 192.0.2.1

Country: United Kingdom

Region: England

City: Nottingham

Latitude: 52.9548

Longitude: -1.1581

INTRODUCTION HERE

We Stopped The Hacker!

INTRODUCTION HERE

Write an awesome subtitle here to provide context

We Stopped The Hacker!

Great Job Team! You did it! Damon Crane was arrested before he could cause any more havok. No Data from Cyber Shield INC was destroyed or stolen, the business is back to full working capacity!Brian Clark has made a huge mistake. He should have disclosed his financial troubles to his superiors, to warn them that he may be vulnerable to bribery. He should have gone to them when he received the bribe.Time to refresh the Anti-Bribery training with the rest of the team...

Ok, we're so close to stopping them! I just need to block them for as long as it takes for the police to shut them down and make their arrests...Lets get to the Cyber Operations Room... from there, we can start putting barriers in place...

Click here to show interactive elements

We got everything we needed from the phone! Right, lets get to the cyber operations room and start slowing down these hackers...

SECURITY BREACH

This is bad! There are security breaches in many of our most secure rooms. We need to stop this!

We need a lock down code... then we can stop them from getting in...Lets have a look around...

Task Manager

AppsInternet ExplorerFile ExplorerTask ManagerBackground ProcessesAntimalware service executableCOM SurrogateColor WatcherRBN Monitoring34667431345MailSearch

End Task

ERROR !

Oh no! It wont let us shut down the task. We'll have to stop them another way...

Hmmm... I don't recognise these processes... It could be the hackers. Lets try and end these tasks...

Home

Docs

Downloads

Recents

ERROR !Your request has timed out.

Hmmm... Maybe in downloads?

There are some letters in the bin. Looks like the Secuirt officer Brian is having some financial troubles, and the hackers tried to bribe him for information. Do you think he took the bribe?

"The Wires have been disconnected. But how do we know what order they go in? We need to figure this out... Quickly!"

How to decode a caesar cipher

A Caesar Cipher is one of the most widely known encryption methods, used by roman emporer Julius Caesar to secretly send messages. A message is written like so:"A monkey is in the fridge"And then, each letter is moved along the alphabet by a set number, lets say four...A -> b c d e M -> n o p q Once every letter is moved along by four, the message is illegible, like so:"e qsroic mw mr xli jvmhki"The messenger would write the number that the letters were moved by, next to the message, like so:"e qsroic mw mr xli jvmhki" 4The intended reader would then move the letters back four letters along the alphabet to crack the code!

Click here for a video on Caesar Ciphers

Hmmm... Why would Brian want to know how to decipher a caesar cipher? Oh!!! Maybe this could tell us how to understand the note from the bin. Lets take a look...

Name: Brian ClarkAge :42Position: Security Officer

Family:Name: Maria ClarkRelationship: WifeAge: 39Name: Sophie ClarkRelationship: DaughterAge: 13

On the shelf, theres a personel file on Brian. Maybe this could give us some clues on what the end of the password might be...

S/N: NM987GH246G

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

S/N: OM876HG45CG

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

Touch Finger To Unlock

I recognise the dog, it looks like the picture from the office. Maybe this is Brian's phone. Maybe he talked to the hackers over the phone. If we get into it, we could find out who is behind the attack.

How to decode a caesar cipher

A Caesar Cipher is one of the most widely known encryption methods, used by roman emporer Julius Caesar to secretly send messages. A message is written like so:"A monkey is in the fridge"And then, each letter is moved along the alphabet by a set number, lets say four...A -> b c d e M -> n o p q Once every letter is moved along by four, the message is illegible, like so:"e qsroic mw mr xli jvmhki"The messenger writes the number that the letters were moved by, next to the message, like so:"e qsroic mw mr xli jvmhki" 4And then, each letter is moved along the alphabet by a set number four letters along the alphabet to crack the code!

Click here for a video on Caesar Ciphers

Hmmm... Why would Brian want to know how to decipher a caesar cipher? Oh!!! Maybe this could tell us how to understand the note from the bin. Lets take a look...

Task Manager

AppsInternet ExplorerFile ExplorerTask ManagerBackground ProcessesAntimalware service executableCOM SurrogateColor WatcherRBN Monitoring34667431345MailSearch

End Task

ERROR !

Oh no! It wont let us shut down the task. We'll have to stop them another way...

Hmmm... I don't recognise these processes... It could be the hackers. Lets try and end these tasks...

BREEZE

IP Address Look Up

Nov 1, 2024 . Lookup a geolocation of an IP address including latitude, longitude, city, region and country...

What is an IP Address

June 29, 2022 . Internet Protocol (IP) address: unique number given to every device that is connected to the internet, allowing each device to be identified and located...

What is my IP Address

May 1, 2024 . An IP address is an individual number associated with your device. This site will show your public IP Address...

Videos on "IP ADDRESS LOOK UP"

November 12, 2024. Click here to see educational videos on IP addresses and their uses in cybersecurity...

S/N: S42LKSB426N

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

Nothing here...

They have disabled the cameras. Lets have a look back, find the last thing we saw before they went down...

Internet Headers:

Received From: mail.Outlook.comby mx.google.com with ESMTPS id x3si1234567qkf.7.2024.11.11.09.15.29 for <BrianClark@Mail.com>;Tuesday 17th September, 21.04.23 (PST) dkim=pass header.i=@Mail.com header.s=2024 key.status=good;x-sender= 'DamonCrane@Mail.com'SPF: ip=192.0.2.1Subject: BlankMIME-Version: 1.0Content-Type: text/plain; charset="UTF-8"

Thats it! The Hacker is called Damon Crane and now we have his IP address...Go back to the homepage and then we can look up this IP address...

Name: Brian ClarkAge :42Position: Security Officer

Family:Name: Maria ClarkRelationship: WifeAge: 39Name: Sophie ClarkRelationship: DaughterAge: 13

Nothing on here...

S/N: P9356TH132

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

Home

Docs

Downloads

Recents

ERROR !Your request has timed out.

Hmmm... Maybe in downloads?

S/N: GF86WR34M09

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

Sophie's Birthday

Theres a USB stick on the desk... that symbol... its one of ours... Maybe its important...

There are some letters in the bin. Looks like the Security officer Brian is having some financial troubles, and theres a note but it looks like its encrypted... Maybe the hackers were trying to bribe him. Do you think he did this?

Home

Docs

Downloads

Recents

ERROR !Your request has timed out.

Hmmm... Maybe in downloads?

They have disabled the cameras. Lets have a look back, find the last thing we saw before they went down...

S/N: LPK98734

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

How to decode a caesar cipher

Click here for a video on Caesar Ciphers

Hmmm... Why would Brian want to know how to decipher a caesar cipher? Oh!!! Maybe this could tell us how to understand the note from the bin. Lets take a look...

There are no fingerprints on these notes...

Task Manager

AppsInternet ExplorerFile ExplorerTask ManagerBackground ProcessesAntimalware service executableCOM SurrogateColor WatcherRBN Monitoring34667431345MailSearch

End Task

ERROR !

Hmmm... I don't recognise these processes... It could be the hackers. Lets try and end these tasks...

Oh no! It wont let us shut down the task. We'll have to stop them another way...

"The Wires have been disconnected. But how do we know what order they go in? We need to figure this out... Quickly!"

Home

Docs

Downloads

Recents

ERROR !Your request has timed out.

" Ah no, the hacker has gotten into these files. This is not good "

"The request keeps timing out. The hacker must be clogging up the task list to slow down processes. If people can't do their tasks, Cyber Shield and all of their clients could lose a lot of money. Lets take a look at the task manager..."

Its a picture of Brian's dog. Hey! Look at the creased corner. Maybe there is something on the back...

Daisy's Third Birthday! 16/09/24

Mail

01/10/24: Mark Tully "Good Morning Brian, I just wanted to touch base w..."

30/09/24: Rochelle Good "Hi Brian, your insurance payments are overdue, co..."

28/09/24: Ace Trust Bank " Good Morning Mr Clark, update on your p..."

25/09/24: Amazon " Your order has been shipped!"

25/09/24: Alison Graham "Hi Brian, I have sorted those forms you were as..."

21/09/24: Sarah Moffit "Brian, I really urgently need that money that I leant..."

19/09/24: LinkedIn "New job opportunities in your area relating to..."

17/09/24: Anonymous " Did you get it?"

15/09/24: NEWS" News updates in your area, a 23 year old man was cha..."

Task Manager

AppsInternet ExplorerFile ExplorerTask ManagerBackground ProcessesAntimalware service executableCOM SurrogateColor WatcherRBN Monitoring34667431345MailSearch

End Task

ERROR !

Oh no! It wont let us shut down the task. We'll have to stop them another way...

Hmmm... I don't recognise these processes... It could be the hackers. Lets try and end these tasks...

Nothing...

Home

Docs

Downloads

Recents

ERROR !Your request has timed out.

Hmmm... Maybe in downloads?

Name: Brian ClarkAge :42Position: Security Officer

Family:Name: Maria ClarkRelationship: WifeAge: 39Name: Sophie ClarkRelationship: DaughterAge: 13

On the shelf, theres a personel file on Brian. Maybe this could give us some clues on what the end of the password might be...

This is it! Remember the order of the wires

Sophie's Birthday

How to decode a caesar cipher

Click here for a video on Caesar Ciphers

Hmmm... Why would Brian want to know how to decipher a caesar cipher? Oh!!! Maybe this could tell us how to understand the note from the bin. Lets take a look...

No Fingerprints...

Touch Finger To Unlock

HINT! Remember we could see the wires on one of the cameras, before they were disconnected!

Daisy's Third Birthday! 16/09/24

Its a picture of Brian's dog. Hey! Look at the creased corner. Maybe there is something on the back...

It's corrupted!!!It's all broken up. Maybe we can put this back together..and its

Click when you've solved the puzzle

It looks like Brian wrote his password down. Not very safe practice but it helps us right now! Ah no!... looks like he spilled coffee on the Post-It, we can't read the end. Maybe something lying around here could help us figure it out...

Task Manager

AppsInternet ExplorerFile ExplorerTask ManagerBackground ProcessesAntimalware service executableCOM SurrogateColor WatcherRBN Monitoring34667431345MailSearch

End Task

ERROR !

Oh no! It wont let us shut down the task. We'll have to stop them another way...

Hmmm... I don't recognise these processes... It could be the hackers. Lets try and end these tasks...

S/N: HYU765FH98P

S/N: S42LKSB426NJLKUIIEJHDjioij

Cyber Shield Inc

Touch Finger To Unlock

Ah yes! The USB. Lets plug it in and see what happens

How to decode a caesar cipher

Click here for a video on Caesar Ciphers

Hmmm... Why would Brian want to know how to decipher a caesar cipher? Oh!!! Maybe this could tell us how to understand the note from the bin. Lets take a look...

Sophie's Birthday

Theres a USB stick on the desk... that symbol... its one of ours... Maybe its important...

There! We've got one. We'll use the tape to get it off of the laptop. Then we can use it to get into the phone...

Operation Cyber Shield

Over 30 million people build interactive content in Genially.

CEVICHE ESCAPE GAME

THUNBERG CASE. TIME SOLDIERS

SPACE INVADERS GAME

A WORLD OF SPORTS

HARRY POTTER ESCAPE GAME

MISSION SANTA: MATH BREAKOUT

KINGDOM HEARTS ESCAPE ROOM

Transcript