Ransomware · Incident Response · Incident Response
ESXi vCenter Akira ransomware · 47 VMs encrypted · logistics operations halted
04:17 · a regional logistics company's VMware vCenter was hit by an Akira variant. 47 VMs (ERP, warehouse management, driver tablets, file server) are encrypted. The NAS replica was already encrypted 4 hours earlier. Demand is 320K USD in Bitcoin. Operational loss is 18,000 EUR per hour. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown