# Ransomware Incorporated

## Overview

**Specialization:** Ransomware & Crypto-Extortion
**Primary Cover:** "CryptoSecure Recovery Services" - Data recovery company (that also deploys ransomware)
**Infiltration Targets:** Healthcare facilities, municipalities, small businesses, schools, critical services
**Primary Territory:** Organizations with poor security and high pressure to maintain operations
**Philosophy:** Chaos is profitable; extract maximum value from digital hostage-taking. "We're not criminals—we're unlicensed business continuity consultants with aggressive pricing models."

**Cell Status:** Active
**Estimated Size:** 25-35 operatives (ransomware developers, cryptocurrency experts, negotiators)
**Threat Level:** Critical (Public Safety Risk, Economic Damage)

## Operational Model

**Controlled Corporation:** CryptoSecure Recovery Services is a "legitimate" data recovery company that also deploys the ransomware they later help recover from (for a price).

**Direct Action:** Unlike cells focusing on infiltration, Ransomware Inc. conducts direct attacks via network exploitation, phishing, and purchased access.

**Business Model:** Operates as actual business with pricing tiers, customer service, and operational efficiency—treating ransomware as product.

## Key Members

### **"Crypto Locker"** (Cell Leader)
- **Real Name:** Unknown (possibly Dimitri Volkov)
- **Background:** Former security researcher who specialized in cryptography and malware analysis. Realized ransomware authors made more in one attack than he made in a year doing legitimate work. Decided: "If I can't beat them, I might as well be them—but more professional." Created "business-like" ransomware operation treating victims as "customers."
- **Expertise:** Cryptography, ransomware development, malware obfuscation, encryption algorithms, exploit integration
- **Notable Operations:** Developed "LockStock" ransomware family used in hundreds of attacks; ransomware that is so well-coded it's almost respected by security researchers
- **Business Philosophy:** "We provide a service: teaching organizations to take backups seriously. The tuition is steep."
- **Personality:** Coldly professional, treats ransomware as business, maintains "customer satisfaction" metrics
- **Innovation:** Created ransomware with professional UI, detailed decryption instructions, and actual customer support
- **Weakness:** Business mindset means he negotiates rather than destroying—wants payment, not chaos
- **Signature:** Ransomware notes written in formal business language with contact information for "support"

### **"Payment Gateway"**
- **Real Name:** Sarah Chen
- **Background:** Former financial crimes investigator specializing in cryptocurrency tracking. Left law enforcement after frustration with low pay and lack of resources. Now uses same cryptocurrency expertise to help ransomware operations launder payments.
- **Expertise:** Cryptocurrency, blockchain analysis, money laundering, financial crimes, payment processing
- **Role:** Handles ransom payments, cryptocurrency tumbling, conversion to fiat, money laundering
- **Methods:** Sophisticated cryptocurrency mixing, conversion through multiple exchanges, obscuring payment trails
- **Notable Operations:** Successfully laundered millions in ransom payments; has evaded blockchain forensics for years
- **Personality:** Financially motivated, treats as technical problem, detached from victim impact
- **Innovation:** Created automated cryptocurrency laundering pipeline
- **Weakness:** Financial records exist—can be traced with sufficient resources

### **"Target Acquisition"**
- **Real Name:** Marcus Rodriguez
- **Background:** Business intelligence analyst who researched companies for investment firms. Expertise in identifying financially vulnerable but operational organizations. Left when he realized his research was being used unethically. Joined ENTROPY to use skills more "honestly."
- **Expertise:** Business analysis, financial investigation, vulnerability assessment, organizational research, OSINT
- **Role:** Identifies high-value, vulnerable targets for ransomware operations
- **Methods:** Analyzes financial statements, security posture, operational dependencies, backup status, cyber insurance
- **Target Profile:** Organizations that desperately need systems online, have poor security, and can pay
- **Notable Operations:** Identified healthcare targets during flu season; targeted municipalities before major events
- **Personality:** Analytical, detached from consequences, treats target selection as optimization problem
- **Ethical Blind Spot:** Doesn't consider human impact—just "business metrics"

### **"Negotiator"**
- **Real Name:** James Park
- **Background:** Former hostage negotiator for law enforcement. Used psychological expertise to resolve tense situations. Career ended after ethical violation. Now uses same skills to maximize ransom payments from victims.
- **Expertise:** Negotiation, psychological manipulation, crisis psychology, stress exploitation, communication
- **Role:** Handles victim communications and ransom demands, maximizes payment while maintaining "customer" cooperation
- **Methods:** Psychological pressure tactics, deadline manipulation, selective file release, fear exploitation
- **Notable Operations:** Successfully negotiated multi-million dollar ransoms; maintained victim cooperation even during extortion
- **Personality:** Superficially empathetic, manipulative, understands victim psychology precisely
- **Disturbing Trait:** Refers to victims as "clients" and maintains professional demeanor while ruining lives
- **Signature:** Negotiation transcripts that are simultaneously empathetic and ruthless

### **"Double Down"** (NEW)
- **Real Name:** Angela Martinez
- **Background:** Data theft specialist who realized stolen data could be weaponized for additional extortion beyond encryption.
- **Expertise:** Data exfiltration, sensitive data identification, double extortion tactics, threat analysis
- **Role:** Executes "double extortion" - steal data before encrypting, then threaten to leak if ransom not paid
- **Methods:** Identifies most sensitive data, exfiltrates before ransomware deployment, threatens public release
- **Innovation:** Pioneered double extortion model now standard in ransomware operations
- **Notable Operations:** Successfully extorted even organizations with good backups by threatening data leaks
- **Personality:** Calculating, understands that data exposure can be worse than encryption
- **Signature:** Threat communications including samples of stolen sensitive data

### **"RaaS Admin"** (NEW)
- **Real Name:** Viktor Sokolov
- **Background:** Software developer who built Ransomware-as-a-Service platform allowing less technical criminals to deploy ransomware.
- **Expertise:** Platform development, affiliate management, ransomware distribution, service infrastructure
- **Role:** Manages RaaS platform, recruits affiliates, handles revenue sharing
- **Business Model:** Provides ransomware to affiliates who find targets, splits ransom payments
- **Notable Operations:** Built platform serving dozens of affiliate ransomware operators
- **Personality:** Pure businessperson, treats as SaaS company, maintains uptime and "customer service"
- **Innovation:** Applied legitimate SaaS business models to criminal enterprise

### **"Backup Killer"** (NEW)
- **Real Name:** Thomas Wright
- **Background:** Backup and disaster recovery specialist who understood backup vulnerabilities intimately.
- **Expertise:** Backup systems, disaster recovery, data protection, storage systems, backup exploitation
- **Role:** Specializes in destroying victim backups before ransomware deployment
- **Methods:** Identifies and compromises backup systems, corrupts backups, exploits backup vulnerabilities
- **Notable Operations:** Successfully destroyed backups at multiple organizations, forcing ransom payment
- **Personality:** Methodical, understands that backups are the primary ransomware defense
- **Signature:** Leaves notes explaining how backups were inadequate (teaching while attacking)

### **"Healthcare Hunter"** (NEW)
- **Real Name:** Dr. Lisa Chung (former hospital IT administrator)
- **Background:** Worked in healthcare IT, watched hospitals ignore security for budget. Left frustrated, now targets healthcare specifically.
- **Expertise:** Healthcare IT systems, medical device security, HIPAA, hospital operations, healthcare infrastructure
- **Role:** Specializes in healthcare ransomware operations, understands patient care pressure
- **Methods:** Times attacks for maximum operational pressure, understands which systems are most critical
- **Controversy:** Most controversial cell member—targets organizations where ransomware can harm patients
- **Moral Conflict:** Claims she's "forcing healthcare to invest in security," but operations endanger patients
- **Status:** Other cell members uncomfortable with her methods but don't stop her

## Typical Operations

### Ransomware Deployment via Initial Access
**Method:** Gain network access through exploitation, phishing, or purchased access; deploy ransomware.

**Technical Approach:**
- Target Acquisition identifies vulnerable organization
- Purchase initial access from access brokers (often Zero Day Syndicate exploits)
- Or conduct phishing campaign to gain access
- Backup Killer identifies and destroys backup systems
- Lateral movement to gain domain admin access
- Double Down exfiltrates sensitive data
- Deploy LockStock ransomware across network
- Negotiator handles victim communication

**Timeline:** Days to weeks of preparation, hours for deployment

### Double Extortion Operations
**Method:** Steal data before encryption, threaten to leak if ransom not paid.

**Technical Approach:**
- Double Down identifies most sensitive data during initial access
- Exfiltrate data to external servers
- Deploy ransomware encryption
- Ransom note includes both decryption demand and data leak threat
- Provide samples of stolen data as proof
- Even organizations with backups face data exposure pressure
- Negotiate separate payments for decryption and data deletion

**Effectiveness:** Forces payment even from organizations with good backup practices

### Healthcare System Attacks
**Method:** Target healthcare facilities when operational pressure is maximum.

**Technical Approach:**
- Healthcare Hunter identifies target hospitals and timing (flu season, pandemic, etc.)
- Access gained through medical device vulnerabilities or staff phishing
- Critical systems encrypted: EHR, PACS imaging, lab systems, patient monitors
- Pressure maximized because delayed care can harm patients
- Negotiator exploits healthcare urgency
- Hospitals often pay quickly due to patient safety concerns

**Ethical Concerns:** Potentially causes patient harm, delays emergency care

### Municipal Infrastructure Ransomware
**Method:** Target city and county governments with limited security budgets.

**Technical Approach:**
- Target Acquisition identifies municipalities with poor security
- Often timed before major events (elections, holidays, festivals)
- Encrypt critical city services: 911 dispatch, utilities billing, government services
- Municipalities under pressure to restore services quickly
- Often pay because rebuilding is more expensive than ransom
- Public pressure accelerates decision to pay

**Political Impact:** High visibility, demonstrates government vulnerability

### Ransomware-as-a-Service (RaaS)
**Method:** RaaS Admin provides ransomware platform to affiliates who execute attacks.

**Technical Approach:**
- RaaS platform provides ransomware, infrastructure, negotiation support
- Affiliates recruit themselves (or through Insider Threat Initiative)
- Affiliates identify targets and gain access
- Platform handles encryption, communication, payment processing
- Revenue split: 70% affiliate, 30% platform
- Scales ransomware operations by distributing execution
- RaaS Admin maintains "customer support" for affiliates

**Business Impact:** Enables less technical criminals to deploy sophisticated ransomware

## Example Scenarios

### **"Hospital Hostage"**
**Scenario Type:** Emergency Response
**Setup:** Hospital systems encrypted by ransomware during flu season. Patient care systems offline.
**Player Objective:** Help hospital respond to incident, investigate attacker, advise on payment decision
**Educational Focus:** Ransomware response, healthcare IT, incident management under pressure, backup recovery
**Difficulty:** Very Hard—time pressure with lives at stake, ethical dilemmas
**Twist:** Healthcare Hunter timed attack for maximum pressure; negotiator demands escalating payment as deadline approaches

### **"City Shutdown"**
**Scenario Type:** Incident Response & Investigation
**Setup:** Municipal government under ransom attack, city services offline.
**Player Objective:** Coordinate incident response, investigate attackers, advise city leadership
**Educational Focus:** Ransomware forensics, municipal IT security, incident coordination, ransom decision analysis
**Difficulty:** Hard—complex infrastructure, political pressure, public scrutiny
**Twist:** Target Acquisition chose timing to coincide with major event, maximizing pressure and embarrassment

### **"Double Extortion"**
**Scenario Type:** Data Breach & Ransomware Combined
**Setup:** Company systems encrypted AND sensitive data stolen, with threat to leak.
**Player Objective:** Respond to dual threat, analyze stolen data scope, advise on negotiation
**Educational Focus:** Double extortion tactics, data breach response, threat analysis, negotiation strategies
**Difficulty:** Hard—must address both encryption and data theft simultaneously
**Twist:** Double Down already leaked some data as "proof"—time pressure to prevent full leak

### **"RaaS Takedown"** (NEW)
**Scenario Type:** Infrastructure Disruption
**Setup:** RaaS platform identified as source of multiple ransomware campaigns. Dismantle operation.
**Player Objective:** Infiltrate RaaS platform, identify operators and affiliates, coordinate takedown
**Educational Focus:** Ransomware business models, platform security, criminal infrastructure, coordinated operations
**Difficulty:** Very Hard—distributed operation, international, must coordinate multiple law enforcement agencies
**Twist:** RaaS Admin receives tip about investigation, begins destroying evidence

### **"Backup Betrayal"** (NEW)
**Scenario Type:** Forensic Investigation
**Setup:** Organization with supposedly robust backups still paid ransom. Investigate why backups failed.
**Player Objective:** Analyze backup compromise, determine how Backup Killer succeeded, recommend improvements
**Educational Focus:** Backup security, disaster recovery, backup testing, storage security
**Difficulty:** Medium—technical forensic analysis
**Twist:** Backup system had vulnerability that allowed ransomware to corrupt backups—organization's backup testing was inadequate

### **"CryptoSecure Exposed"** (NEW)
**Scenario Type:** Controlled Corporation Investigation
**Setup:** Data recovery company suspiciously successful at ransomware recovery. Investigate connection to attacks.
**Player Objective:** Determine if CryptoSecure is legitimate or ENTROPY front, gather evidence
**Educational Focus:** Corporate investigation, digital forensics, pattern analysis, criminal enterprise identification
**Difficulty:** Hard—CryptoSecure has legitimate business mixed with criminal activity
**Twist:** Some CryptoSecure employees are innocent, unaware company also deploys ransomware—must distinguish knowing participants

## Educational Focus

### Primary Topics
- Ransomware operations and lifecycle
- Incident response procedures
- Backup and disaster recovery
- Cryptocurrency and ransom payments
- Double extortion tactics
- Business email compromise (BEC)
- Ransomware negotiation (defensive)
- Healthcare IT security

### Secondary Topics
- Malware analysis and reverse engineering
- Cryptocurrency forensics and tracking
- Network forensics and investigation
- Access broker marketplaces
- Business continuity planning
- Cyber insurance
- Legal and ethical considerations of ransom payment
- Ransomware-as-a-Service models

### Defensive Techniques Taught
- Ransomware prevention strategies
- Backup security and testing
- Network segmentation
- Privilege escalation prevention
- Early detection of ransomware indicators
- Incident response planning
- Business continuity and disaster recovery
- Ransom negotiation tactics (defensive)

### Ethical Discussions
- **To Pay or Not to Pay:** Ethical considerations of ransom payment
- **Healthcare Attacks:** Morality of targeting organizations where attacks endanger lives
- **Attribution vs. Recovery:** Balance between investigation and restoration
- **Cyber Insurance:** Does insurance incentivize payment and encourage attacks?
- **Law Enforcement:** When to involve authorities vs. negotiate directly?

## LORE Collectibles

### Documents
- **"Crypto Locker's Business Plan"** - Actual business plan treating ransomware as professional operation
- **"Target Acquisition Assessment"** - Analysis of potential victims with financial and security evaluation
- **"Negotiator's Psychology Manual"** - Guide to victim manipulation and pressure tactics
- **"Double Extortion Playbook"** - Procedures for data theft and leak threats
- **"RaaS Platform Documentation"** - User guides for ransomware affiliates
- **"CryptoSecure Recovery Records"** - Evidence of company involvement in ransomware deployment

### Communications
- **"Crypto Locker to The Architect"** - Discussion of ransomware's strategic value to ENTROPY
- **"Victim Negotiations Transcripts"** - Actual negotiation exchanges (sanitized)
- **"RaaS Affiliate Recruitment"** - Messages recruiting new ransomware operators
- **"Healthcare Hunter Justification"** - Her attempting to justify targeting hospitals

### Technical Data
- **LockStock Ransomware Code** - Samples of ransomware (safe, for analysis only)
- **Encryption Keys** - Examples of cryptographic keys (educational demonstration)
- **Backup Destruction Scripts** - Code used to compromise backup systems
- **Exfiltration Tools** - Data theft tools used before encryption
- **RaaS Platform Backend** - Infrastructure for ransomware distribution

### Financial Data
- **Ransom Payment Records** - Cryptocurrency transactions (blockchain evidence)
- **Revenue Sharing Calculations** - RaaS platform profit splits
- **Money Laundering Trails** - Payment Gateway's cryptocurrency mixing
- **Cyber Insurance Analysis** - Target Acquisition's research on victim insurance

### Audio Logs
- **"Crypto Locker's Business Philosophy"** - Explaining ransomware as "service"
- **"Negotiator-Victim Call"** - Actual negotiation (demonstrates pressure tactics)
- **"Healthcare Hunter's Rationalization"** - Attempting to justify patient endangerment
- **"Payment Gateway Tutorial"** - Explaining cryptocurrency laundering process

## Tactics & Techniques

### Initial Access
- **Phishing:** Email campaigns with malicious attachments
- **Exploit Kits:** Automated exploitation of vulnerabilities
- **RDP Exploitation:** Brute force or stolen remote desktop credentials
- **VPN Vulnerabilities:** Exploitation of remote access systems
- **Purchased Access:** Buy initial access from access brokers

### Reconnaissance & Preparation
- **Network Mapping:** Identify critical systems and data
- **Privilege Escalation:** Gain domain administrator access
- **Backup Identification:** Locate and assess backup systems
- **Data Reconnaissance:** Identify most sensitive data for exfiltration
- **Business Intelligence:** Research victim's financial situation and pressure points

### Data Exfiltration (Double Extortion)
- **Sensitive Data Targeting:** Identify valuable or embarrassing data
- **Exfiltration Tools:** Rclone, Mega, custom tools for data theft
- **Stealth Transfer:** Exfiltrate data without triggering DLP alerts
- **Proof Collection:** Gather samples to prove data theft

### Ransomware Deployment
- **Lateral Movement:** Spread across network for maximum encryption
- **Backup Destruction:** Delete or encrypt backups first
- **Synchronized Encryption:** Encrypt many systems simultaneously
- **Critical System Targeting:** Focus on systems that cause most disruption
- **Persistence Evasion:** Encrypt and exit before detection

### Extortion & Negotiation
- **Professional Communication:** Maintain business-like tone
- **Psychological Pressure:** Deadlines, escalating demands, partial leaks
- **Proof of Capability:** Provide decryption of sample files
- **Payment Facilitation:** Instructions for cryptocurrency purchase
- **"Customer Service":** Answer questions, provide technical support

### Payment & Laundering
- **Cryptocurrency:** Bitcoin, Monero for payments
- **Multiple Addresses:** Different payment addresses per victim
- **Mixing Services:** Tumbling cryptocurrency to obscure trails
- **Exchange Hopping:** Convert through multiple exchanges
- **Cash Out:** Eventually convert to fiat currency

## Inter-Cell Relationships

### Primary Dependencies
- **Zero Day Syndicate:** Primary supplier of exploits for initial access
- **Insider Threat Initiative:** Provides insider access to target organizations
- **Digital Vanguard:** Shares intelligence about vulnerable corporations

### Secondary Collaborations
- **Ghost Protocol:** Occasionally receives intelligence about target organizations
- **Critical Mass:** Rare collaboration on infrastructure targets
- **Crypto Anarchists:** Uses HashChain Exchange for cryptocurrency services

### Business Relationships
- **All ENTROPY Cells:** Ransomware operations provide funding for other operations
- Ransomware Inc. is highly profitable, subsidizes less profitable cells
- Crypto Locker reports financial performance to The Architect

### Tensions
- **Healthcare Hunter's Methods:** Other cells uncomfortable with targeting hospitals
- Some ENTROPY members see ransomware as crude compared to sophisticated operations
- Crypto Locker's business focus sometimes conflicts with chaos goals

## Scenario Design Notes

### When Using This Cell
- **Response Scenarios:** Active ransomware incident requiring immediate response
- **Investigation Scenarios:** Forensic analysis of ransomware attack
- **Prevention Scenarios:** Stopping ransomware deployment before encryption
- **Strategic Scenarios:** Dismantling RaaS infrastructure or CryptoSecure operation
- **Ethical Scenarios:** To pay or not to pay dilemmas

### Difficulty Scaling
- **Easy:** Post-incident forensics with clear indicators
- **Medium:** Active incident response with some time pressure
- **Hard:** Critical infrastructure ransomware with lives at stake
- **Very Hard:** Double extortion with data already leaked, or RaaS platform takedown

### Atmosphere & Tone
- **Urgent:** Time pressure in active incidents
- **Stressful:** High stakes with real consequences
- **Frustrating:** Often no good options, only less bad ones
- **Ethical Complexity:** Payment decisions have no clear right answer
- **Serious:** Ransomware causes real harm to real organizations

### Balancing Education & Gameplay
- Technical: 40% (ransomware analysis, response procedures, forensics)
- Response: 35% (incident management, decision-making under pressure)
- Strategic: 25% (prevention, infrastructure disruption, investigation)

### Ethical Sensitivity
- **Healthcare Scenarios:** Handle carefully—patient harm is serious
- **Payment Decisions:** Present both sides fairly, no easy answers
- **Victim Blame:** Avoid blaming victims, emphasize attacker responsibility
- **Realism:** Acknowledge real organizations face these decisions
- **Education Focus:** Emphasize prevention and preparedness

### Common Mistakes to Avoid
- Don't make ransomware seem easy to defeat—it's genuinely difficult
- Don't ignore victim perspective—show human impact
- Don't provide actual ransomware creation instructions
- Don't oversimplify payment decisions—they're genuinely difficult
- Don't glamorize ransomware operators—show harm they cause

## Character Appearance Notes

### Crypto Locker
Can appear in scenarios involving:
- Major ransomware operations
- Cell leadership and strategy
- Business-like ransomware operations
- RaaS platform management

### Negotiator
Can appear in scenarios involving:
- Active ransom negotiations
- Psychological pressure tactics
- Victim communication analysis
- Hostage negotiation parallels

### Healthcare Hunter
Can appear in scenarios involving:
- Healthcare ransomware attacks
- Ethical dilemmas about targeting critical services
- Most controversial operations
- Character others find disturbing

### Other Members
- Double Down: Double extortion scenarios
- Target Acquisition: Victim selection and intelligence
- Backup Killer: Backup security and disaster recovery
- Payment Gateway: Cryptocurrency forensics
- RaaS Admin: Platform operations and affiliate management

## Progression & Status Tracking

### Initial Status (Game Start)
- **Status:** Active and highly profitable
- **CryptoSecure:** Operating as seemingly legitimate recovery service
- **RaaS Platform:** Serving multiple affiliates
- **Operations:** Regular ransomware campaigns
- **Threat Level:** Critical—frequent attacks with significant impact

### After First Player Encounter
- **Status:** Active, more careful
- **Operations:** Increased operational security
- **Crypto Locker:** Aware of SAFETYNET focus
- **Tactics:** Evolve techniques to avoid detection patterns

### If Major Operation Disrupted
- **Status:** Disrupted temporarily
- **Response:** Rapid recovery, new ransomware variants
- **Business Impact:** Lost revenue but quickly replaced
- **Adaptation:** Learn from disruption, improve techniques

### If CryptoSecure Exposed
- **Major Impact:** Loss of cover business and recovery revenue
- **Public Relations:** ENTROPY embarrassed by exposure
- **Adaptation:** Establish new front company
- **Temporary Disruption:** Operations reduced during transition

### If RaaS Platform Taken Down
- **Significant Impact:** Loss of affiliate distribution
- **Revenue Reduction:** Fewer operations without affiliates
- **Recovery:** Eventually rebuild platform with better security
- **Focus Shift:** More direct operations while rebuilding

### Potential Long-Term Arc
- Players respond to multiple ransomware incidents, identify patterns
- Investigation traces attacks to common infrastructure
- CryptoSecure connection discovered
- Coordination with law enforcement for major operation
- Simultaneous takedown of RaaS platform and CryptoSecure
- Crypto Locker and key members arrested or escape
- Healthcare Hunter's operations exposed, public outrage
- Ransomware Inc. severely disrupted but eventually rebuilds
- Crypto Locker (if escaped) continues operations for other ENTROPY cells
- Long-term: Ransomware remains ongoing threat, requiring constant vigilance
