Healthcare · Incident Response · Incident Response
Hospital MR/CT devices in a cryptomining botnet · ICU monitor latency
At a 300-bed public hospital, IT noticed packet latency from the medical device network to the ICU monitors. 47 devices (MR, CT, biochemistry analyzers) are cryptomining with a Mirai variant + Monero miner. ICU monitor packet loss = a risk to vital monitoring. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown