Ransomware Tabletop Scenario: Double Extortion on a Friday

Ransomware is the scenario most organisations exercise first, for good reason: it combines a technical emergency, a business outage, a legal and regulatory problem and a public-relations crisis, all under time pressure. This scenario models a modern double-extortion attack in which the attacker both encrypts systems (including the virtualisation layer) and steals data to threaten publication.

Run it with a mixed group of technical leads and executives. It tests escalation, containment authority, backup assumptions, the ransom decision process and crisis communications. If your team is new to tabletops, read how to run a tabletop exercise first.

Scenario at a glance

Exercise objectives

1. Declare incident severity and activate the crisis team within 30 minutes of exercise time, using the documented severity matrix.
2. Identify who has authority to approve a production-wide containment action (isolating the virtualisation platform) and the criteria they use.
3. Confirm the process for engaging external parties: incident-response retainer, cyber insurer, outside counsel and law enforcement.
4. Validate that restoration priorities for critical business services are documented, agreed and grounded in tested restore times.
5. Rehearse the decision-making process for a ransom demand, including legal and sanctions considerations.
6. Agree the approval chain and first message for internal and external communications.

Starting situation

Read this aloud to players:

It is Friday, 22:40. Most staff have left for the weekend. The SOC is staffed by one analyst on the late shift, with an on-call escalation to the IR lead. The CFO is on a long-haul flight until Saturday morning. Monday is the start of your busiest trading week of the quarter.

Over the past month nothing unusual has been reported. Three weeks ago, the service desk reset the password of a contractor account used for remote support after the contractor reported being locked out.

Injects timeline

Module 1 — Detection and escalation (T+00:00 to T+00:45)

Inject 1. The late-shift SOC analyst sees a high-severity EDR alert: an unsigned process running as SYSTEM on file server FS-02 has renamed more than 1,200 files with a .locked extension in 90 seconds. A similar alert fires on FS-03 two minutes later.

Inject 2. The service desk receives calls from three sites: shared drives will not open, and some files show strange extensions.

Inject 3. IT operations cannot reach the hypervisor management console. Several virtual machines display a text file named README_RESTORE.txt claiming the network has been encrypted and data exfiltrated, with a link to a negotiation portal.

Discussion questions:

• Who does the SOC analyst call first, and how? What if the IR lead doesn't answer?
• At what point does this become a Severity 1 incident under your plan? Who declares it?
• How is the crisis team activated at 23:00 on a Friday? Which channel do you use if you suspect corporate email and chat are compromised?
• What do you tell the service desk to say to callers?
• Is anyone keeping an incident log yet?

Module 2 — Containment and external support (T+01:10 to T+02:30)

Inject 4. The IT operations lead joins the bridge: "We can stop the spread by disconnecting the virtualisation management network, but every VM on the cluster goes down, including order processing and the warehouse system. I need a go/no-go in 15 minutes."

Inject 5. Legal calls the cyber-insurance hotline. The insurer (played by the controller) says coverage requires using one of its panel incident-response firms and asks for the policy number, a description of the incident and whether any ransom communication has occurred.

Discussion questions:

• Who can approve taking production offline at night? Is that written down?
• What evidence might be lost by shutting down versus disconnecting? Who decides the balance?
• Should you reset privileged credentials now, and how, if the domain controllers are virtualised on the affected cluster?
• Where are the policy number and IR retainer details? Is your retainer firm on the insurer's panel?
• When do you engage outside counsel, and why might counsel engage the IR firm?

Module 3 — Extortion, communications and recovery (T+06:00 to T+26:00)

Inject 6. Threat intelligence reports that your company is listed on the attacker's leak site with a seven-day countdown. Posted samples include a spreadsheet of employee names and bank details, and a folder of customer contracts.

Inject 7. A journalist from a trade publication emails the press inbox: "We've seen your company listed on a ransomware leak site. Can you confirm you've suffered a cyberattack? We're publishing in one hour."

Inject 8. IT operations reports that the offline backup copies are intact, but restoring the priority systems will take roughly five days, because the restore procedure has never been run at this scale and the hypervisor platform must be rebuilt first.

Inject 9. Through the negotiation portal, the attacker offers a discount if payment is made within 24 hours. The CEO asks the crisis team for a recommendation by the end of the day.

Discussion questions:

• Does the leak-site data trigger personal-data breach notification obligations? Who decides, and by when? (See the data breach notification scenario.)
• Who approves the reply to the journalist? Do you have a pre-approved holding statement?
• What do you tell employees, whose data may be exposed, and through which channel?
• Which business services are restored first? Who agreed that order, and when?
• Who is involved in any ransom decision? How would you check the payment would not breach sanctions rules? Would you inform law enforcement?

Discussion questions

Consolidated themes for the hotwash and for facilitators who need prompts:

• Authority: Which decisions required someone who wasn't in the room? Were deputies clear?
• Communications: Which channels did you rely on, and would they still work if the identity platform were compromised? See out-of-band communications.
• Recovery: Are recovery time objectives for critical services documented and tested? See recovery time objective.
• Legal and regulatory: Which clocks started, and when? Who tracks them?
• Ransom policy: Does the organisation have a documented position, or at least a documented decision process?

Curveballs / optional injects

Use one or two if the group is moving quickly:

• The backup console was also compromised, and the attacker deleted online backup copies (T1490).
• The IR lead is on holiday, unreachable for 12 hours.
• A major customer's CISO calls asking whether their data, stored on your systems, is affected.
• Staff start posting on social media about the outage.

Facilitator notes

Expected decisions. A well-prepared team declares Severity 1 by inject 3, activates the crisis team through a channel that doesn't depend on the compromised environment, engages legal early (often before the IR firm, to support privilege), makes a recorded containment decision with a named approver, and separates the ransom question into a structured process rather than a gut reaction.

Common pitfalls.

• Nobody owns the containment decision, so it is deferred until the damage is done.
• The contact list, IR plan and insurer details are stored on the encrypted file server.
• The team assumes backups guarantee fast recovery without knowing tested restore times.
• The ransom discussion becomes a debate about ethics rather than a decision process with clear inputs: business impact, recovery options, legal advice, insurer position, sanctions screening and law-enforcement engagement.

On ransom payments. Treat this as a governance question, not a technical one. In the United States, the Treasury's Office of Foreign Assets Control (OFAC) has issued advisories warning that facilitating ransomware payments to sanctioned persons can violate sanctions regulations, and it encourages victims to report to and cooperate with law enforcement. Other jurisdictions have their own rules. Players should know whom they would consult; the exercise should not pretend to settle the legal question.

Adapting the audience. For an executive-only session, compress Module 1 into a briefing ("At 23:30 the IR lead declared Severity 1…") and spend the time on injects 4, 6, 7 and 9. For a technical session, expand Module 2 with injects on credential resets, domain controller recovery and forensic preservation, and reduce the executive decisions.

Evaluating the exercise

Related

• Designing tabletop injects and the MSEL (uses this scenario as its worked example)
• Data breach and regulatory notification scenario
• Writing the after-action report
• Glossary: incident commander, playbook, recovery time objective