Enter the War Room- Crisis Simulations (Critical Infrastructure)

Everybody ready? It's our last Operation Blind Spot, enter the war room for HIP twenty twenty six. I'm super excited. And today we are doing a critical infrastructure meltdown. So there's lots of fun things we're gonna do throughout this exercise, but I'll give you a couple of housekeeping things before we get started. First, hi everyone. If you haven't met me yet, my name is Courtney Gus. I'm the AVP of Crisis Management here at Semperis. I lead up our Ready1 team. I'm joined by Sean Dube in the back and Dan Olemire, Matthew, all of your team leads for today's exercise. In today's exercise, we're going to be running through a critical infrastructure simulation where the red team and the blue team will be conducting strategic attacks and counter attacks to work through this scenario. As you guys know, critical infrastructure attacks happen every day. They're very, very severe in terms of the ripple effect and the supply chain impacts. I found this really phenomenal report through the federal government, if anybody ever wants to check it out. But it not only walks through where these are happening, but the individual impacts of these incidents itself. Really, really neat. Over on the left are the actual defined industries under what CISA classifies as The US critical infrastructure. We have a very tight timeline, so I hope you guys are all ready to get started. This is meant to be fun. Bring your flashlights because the power is about to go out. Just kidding. Please don't share any sensitive information. But with that being said, anything we do in here today, please keep in this room. This is meant to be a fun activity. Give everybody an opportunity to think outside the box. But again, this is not a real simulation. Where am I pointing? There we go. We actually only have forty five minutes. See? So that's your first test of the day. The red team and the blue team will each get a couple of minutes in each round to come up with their plan of attack, and then your team leaders will share that information back to the other side. We're gonna walk through a series of injects where you're gonna have to put your best defense or offense forward. When we get started, I'm going to ask the blue team to meet back in the back right hand corner. And the red team, if you guys want to come right up here by me and just kind of circle up here. You don't have to do it yet. Don't do it yet. We'll get started in just a second. For today's fictitious exercise, IronVale Power and Light is one of the region's largest electric utilities, organizations generating and delivering power to millions of homes, businesses, hospitals. They're known for reliability, operational discipline, and tightly managed load balancing. IronVale depends on seamless coordination across generation plants, transmission networks, and substations. At the center of this operation is their new AI enhanced grid operations command center, because we all love AI. Think I've heard the word about 10,000 times today. It's the company's pride and joy. It's designed to provide real time visibility across generation, transmission, and distribution, playing a critical role in their operations. Red team. There's a handful of you guys in here, the bad guys. Your motivation, cyber espionage, disruption, maybe financial incentive or financial gain, but you're really just here to cause chaos. Your name, Volt Typhoon. Blue team, Grid Command, a world class incident response team in SOC hired by electric utilities, independent power producers, and grid operators across The US motivated to be the very best and also very well paid. They have strong relationships with several federal and law enforcement agencies, and they have a well funded research team. So these guys are ahead of the curve. Blue Team, Grid Command. Bum bum bum. We really need ominous music. Future future exercise for sure. So today is the ribbon cutting ceremony for Iron Vale Power and Light's new regional partnerships. Big announcement. It's with Summit Independent Power, Regional Grid Authority, and Vobe Energy Services all designed to expand generation capacity. It also marks the launch of their new integrated technology and innovation center where generation dispatch, load scheduling, transmission operations, etcetera, are managed. The operations heart, it's still that AI enhanced command center, so lots of technology and interconnectivity here. But just as the event gets underway, the SOC receives an alert. The network supporting Ironvale's primary grid is showing signs of degradation. So big announcement, starting to see some activity. And this is where we get started. So in just a minute, I'm gonna split you guys up. Your first objectives. You guys will have four minutes. Red team, start to profile. Profile your target. Understand where their weak links might be. How are you getting in? How are you gaining access? What tools are you using or methods? Blue team, set up your perimeter. What does your cyber defense and SOC operation look like? And what do you need to be successful for anything, but especially for this oncoming attack? Blue team in the back, red team in the front, you have four minutes. Go. Three, two, one. You are out of time, red team and blue team. Did anyone hear the squeaky chicken? Alright. So red team is gonna start by by telling us how they profiled IronVail. You have one minute. Got it. Okay. So for red team, this is a this is an OT environment with a big data center, big network operations center. So the classic thing, we are a Volt Typhoon after all, is looking for OT devices on the Internet. The classic attack path. Lots of open source intelligence data, social media, what kind of tools they're they're their advertising, their new data center and their partners, whatever we can get on that. Profiling, high profile or high value individuals, maybe if we have enough time attending a conference to see to learn more about it. What is their identity configuration? Their IT Active Directory and their OT Active Directory, which is highly vulnerable in a lot of organizations. Maybe even take a physical tour. So this is the physical aspect. Actually get a tour of some of the power facilities. What is the okay, there we go. And I got some other stuff there too. You wanna say them real quick? Yeah, third party. Who are their third parties? Who are their vendors? The vendors. Alright, so it's third party vendors and physical c, okay, and remote sites. You guys, the best encryption is your handwriting. Have to tell you, every round. I don't know what you're talking about. Alright. Blue team, what does your perimeter look like? I should have been a doctor. So we've got a whole bunch of the alphabet, Supa Tech, IDS, IPS, AV, NDR, EDR, SOAR, SIM, PAM, MFA, the whole works right? IR team on retainer, pretty robust risk management and understanding of our environment. We got, what did I write right there? I don't even remember. Full security awareness training. We got mice and men, some OT technology for segmentation and monitoring. We got fences, cams, moats with alligators. We got full network segmentation. We got honey pots deployed strategically throughout the environment. We got physical switches. We're not just relying upon digital technology. We got some crash cards supporting our physical security. We also have armed guards. We hired Delta Force. And out of band communication suite and tool that's off network and gonna be hard to find. And I wrote jump host right there too. So and we did it on time. Impressed you did it on time. And alligators and Delta Force, is that what you said? That's gonna be interesting, Redeem. Endless boys retire, they need something new. Got it for us. Got a hell of a security team over here. Start a podcast or Oh, start a pod start a podcast or, you know, be physical security. Alright. Alright. So we forgot to mention its endless budget on both sides. Okay. So red team, for your next step, you're gonna look to gain initial access, recon the network, conduct evasion and persistence techniques. Can you identify any high value targets? What do those look like? Blue team, we saw that network degradation. You started to see some slowdown. Things are going on. Are you going to initiate your incident response? If so, your crisis management plan, what does that look like? You have three minutes and thirty seconds. Go. Time's up. That chicken is never gonna get old. Alright, red team. Tell me how you're getting started here with your initial access and network recon. Woah. Go. Well, they have Delta Force, we have SEAL Team. Session takeovers, phishing attacks to get, to get tokens. Compromising equipment communications because equipment communications from the OT network are critical. If you compromise that, you're in. Bribes, physical bribes to high value employees or just whoever has access of things. Along that line, we have honeypot, which is physical honeypot. Well, let's just say not the the network honeypot along that same line. Vendor compromise. Vendors are always a source of trouble and vulnerabilities in an OT network. Dark web credentials as well and new hires as threat actors. Threat actors as new hires. Nice job. Have a time. Alright. So new hires are our weak link evidently. Blue team, have you initiated your IR plan? Sorry. I'm moving. I'm moving. Alright. So we're gonna set our sock forth on analyzing the wealth of data we're collecting from our environment because we got amazing tools. And we're looking at everything from hunting a pot output to PCAPS to just going through the tool stack and do some correlation and feed that into threat intel. We're gonna do our network tracing in PCAPs. We're teeing up all of our support, our partners, and our security. So we want our vendors to be aware. We're preparing for this big day. Right? So our partners, we talk to them about all that. We're gonna any technology we can switch from detect to prevent, we're gonna make some of those configuration change. We're gonna dust off our IRP and our specific playbooks, make sure we're well aware of that. A key thing is our crisis management authorization matrix, so we can make decisions fast. Open out of band comms. And what? Open out of band comms. Yeah. You're on time. Alright. Okay. So they've initiated their response plan, it sounds like. Okay. So red team, based on that, look to conduct privilege escalation and start exfiltrating data or more data. Are you looking to stage ransomware payloads? Question mark. Blue team. Maybe. There we go. Conduct counter exfiltration. Are you seeing data move? Where is it going? How are you gonna do that? Contain and isolate the threat, if possible. You have three minutes. Go. Alright. Time is up. I'm stealing the rubber chicken. Okay. Red Team, were you able to exfiltrate any data? What were you looking for? How are you staging your attack? Okay. So first thing, and I need a little help from the experts here, is compromising grid management, for the other regional energy suppliers. If the if the grid is compromised, they they get disconnected from the grid. Right? For Right. So they get disconnected from the grid. Power outages. New hire the yep. The new hire act activities on the network, also to deploy ransomware since we're supposed to be causing trouble on the network and social media attack. So spreading disinformation on what's going on is to lose trust in the environment, especially when it's coupled with the fact that we've taken them offline. Starting to cause some disruption, load balancing, making people upset on social media. Blue team, how will you respond? So we're gonna double check our backup status, make sure that the integrity is there. We're gonna take our IOC profile, funnel that back into our threat intel, and make sure our partners are getting all that information including our ISAC counterparts because we know you're gonna be targeting some of our affiliates and stuff. We are gonna go ahead and start our employee contractor review. The beauty about new hires is they really don't do much for you for the first you know years. So if we go ahead and just lock people out, that's cool. We're gonna play the classic game of host isolation and doing some scraping, Pulling all the logs out of it, maybe getting forensic images so we can start pulling that info. Email review, we're gonna make sure that all our USB ports are disabled on all computers because, you know, people like to find flash drives and plug them in. Assigning our incident commander. Who's Courtney? Oh, I'm the incident commander. Oh, you know I'm not very nice. Alright. I love that. Okay. So they're starting to respond or trying to respond, but the red team continues their attack. They will deploy malware and potentially detonate ransomware. And the blue team is going to work to counter and eradicate the threat, if possible, on the network. Can maybe deal with some of the other mayhem that the red team's causing. You have two minutes? Didn't they get two? Okay. Two minutes. Go. Alright. You're out of time. Red team, have you started to unleash your attack? What does that look like? Because this is critical infrastructure, we're not necessarily worried about direct, ransomware on the network. Rather, we are disrupting their demand change control, which means they can't tell me again what it is. Help me when when when They can't manage their their network responsibilities to their partners. Right. Got it. Got it. Okay. Got it. Also, we are able to grab customer information, so we're sending them bad invoices. And then we yeah. That's it. Alright. So rolling brownouts, blackouts, and making our customers mad by sending them bad invoices. Blue team, how will you respond? We're cutting all our VLANs and going with non critical infrastructure first. We're gonna disable the Internet, turn off exchange. We're notifying our federal government partners. We're also releasing a public statement because we want people to be aware that you guys are doing all this nefarious stuff. We're all over in our full out of band comms doing command and control, so it's gonna be tough to kind of listen in on us. I don't know what I wrote there. Cyber. Cyber legal brought in. Review any sort of new accounts, privileged accounts, make sure our backup connections are severed. Basically every step of the way we're gonna double and triple check our backups. Sounds like a very, very busy blue team. Resources. That's true. Hopefully, you guys are sleeping. Red team. It sounds like maybe ransom isn't what you're after, but if so, what are you looking for? Blue team, how will you respond? Depending on their demands, will you negotiate? Will you pay? Will you cave? Or will you just tell them to go away? You have two minutes. Go. Alright. You are out of time. Red team, what are your demands? $100,000,000. Okay. I can have it back. That was it. Wait. Wait. Wait. Wait. Wait. And we offer we offer nice payment plans for it. And then while we can, since we have a customer list, we're smishing text to say, oh, your bill is overdue. Maybe we'll catch some folks and get some extra money on the side. Steal from the company and the customers. That's really messy. Alright. So $50,000,000, blue team. I know you're well funded, but yeah. Okay. Alright. So we're gonna engage in negotiation with you, mostly just to draw time out and to get you guys feeling like you might be getting somewhere, but our plan is no pay. You don't need to pay. We've got a recovery plan, we're gonna start executing on that which is gonna be standing up restorative environment in isolation, so we're not as worried about going back to the basics. We're gonna continue to do all of our forensics and do information sharing with all our partners and groups. We continue to inform in the public. You know. So, that was just like a normal BAU, right? Like not paying and we're just gonna keep doing our thing. Okay. Alright. I like it. No. That's what you do. Okay. So they said no in case you guys missed that. They said no to your $50,000,000. Alright. Red team, you have one more try. Do you have a lever to pull for any additional extortion? Blue team, have you moved on? Sounds like you're not paying. You're just gonna move on to your after action report. What does it look like? What is your response to the bad guys? Alright. You are out of time. Bad guys and gals, what are you up to over here? Physical coercion of the principles involved to encourage cooperation by Seal Team six. Very good. Very good. Alright. Alright. Now they're coming after you, you people, your families. What's your plan? Oh, I like this. Well, we're gonna hack back because this is 2026. We don't play. We're gonna take that profile of information, give it to our friends at the FBI, who are gonna give it to their friends at the CIA, who are gonna hire some mercenaries, and the end result is ouchie mama, no fun. Still not gonna pay. As we rebuild everything, it's set up in a zero trust environment. We wrote it down successful restoration so like we did good. And of course a full AAR and public disclosure of everything that happened because we want to build trust with people. Alright. So it sounds like a stalemate. You're not getting your money, but you caused disruption and the mercenaries are on the loose now. Lots of bloodshed. That's horrible. Alright. All out cyber war here. Well, we have concluded the exercise. Thank you guys so much for playing. Hopefully, this gave you guys an opportunity to think outside the box, maybe play on a different team for once. You know, as we saw, the red team only has to be right once. The blue team has to be right every single time. You can't miss any of those doors. So thank you guys all so much for playing, and enjoy the rest of HIP.