Lost in RAMslation
Premium roomInvestigate the third, memory forensics part of the HoneyNet Collapse!
hard
60 min
1,231
To access material, start machines and answer questions login.
Meet DeceptiTech
DeceptiTech is a fast-growing cyber security company specializing in development and deception technologies. At the heart of their success are DeceptiPots - lightweight, powerful, and configurable honeypots that you can install on any and capture every malicious action!
The internal DeceptiTech network is organized around a traditional on-premises Active Directory domain with approximately 50 active users. The product platform, however, is isolated and hosted entirely in the cloud:
Lost in RAMslation
One ordinary morning, DeceptiTech's entire network collapsed. Within minutes, all critical on-premises systems were locked down and encrypted. The IT department hurried to restore backups, while the security team rushed to their - only to find the backups corrupted and all data wiped clean.
This room is about the third attack stage (#3 on the network diagram). As part of an external unit, can you help DeceptiTech perform a full-scope investigation and explain how the attack started?
Let's go!
Ready to learn Cyber Security?
The Lost in RAMslation room is only available for premium users. Signup now to access more than 500 free rooms and learn cyber security through a fun, interactive learning environment.
Already have an account? Log in