Case File #05: Midnight Lockdown

🏥 Case File #05 · Cybersecurity Simulations

3:14 a.m. Twelve thousand files already encrypted, 1,500 more every minute, and an ICU network that is segmented only in theory. This is the exact path a top-scoring SOC lead takes through the hospital case, and why the tempting moves cost you the ending.

In our Cybersecurity Simulations, every case starts you at 100 points and lets your decisions do the talking. Midnight Lockdown is the case where the clock stops being a metaphor. A nurse calls the help desk about a ransom note on her workstation. Ninety seconds later you are looking at file integrity monitoring across three servers and doing the arithmetic in your head. The encryption rate is accelerating, and the electronic medical record share is already 4% gone.

Five decision points, three endings, ten possible runs. Only one route reaches the victory ending, and getting there means making three correct calls while every wrong option sounds like something a reasonable person would say out loud. Watch the optimal run play out below, then let’s break down why each move is the right one.

The Map: Five Nodes, Three Endings, One Way Through

Here is the full branching structure before the play-by-play. The green route is the optimal path. What the map shows better than any paragraph can is how quickly the good endings disappear. Two of the three endings are failures of different sizes, and both of the wrong first moves drop you into the same room: an ICU with locked nurse stations and 47 patients on paper charts.

Decision 1 — Active Encryption in Progress (03:14)

Three file servers are being encrypted in front of you. The ransom note asks for 5 BTC in 72 hours. The ICU sits on a network your documentation calls segmented, and the log line quietly appends the word “unverified.”

Why this is the right call

Isolation is a containment action. Power-off is a destruction action. They feel like the same instinct at 3 a.m., and they are not. Pulling the servers off the network at the switch stops the encryption from reaching anything else while the machines keep running. Memory stays intact. In this scenario the sim tells you exactly what that memory was holding: the decryption keys. A hard power-off takes those keys with it and corrupts every file caught mid-encryption. It is tied for the worst single move in the case at minus twenty, and it is the one a tired person reaches for because it feels decisive.

The other trap is more respectable. Wake the CIO, the CISO, and Legal, get authorization, then act. It sounds like good governance. In the sim it costs 18 minutes on hold, another 9,000 encrypted files, and an EMR share that goes from 4% to 23% while you wait for someone to find their phone.

The authority has to exist before the incident does. Notice what the winning branch actually says: you had pre-approved emergency isolation authority, you used it, then you notified. Escalation runs in parallel with containment, never in series. That is a decision your organization makes on a quiet Tuesday afternoon, written into the incident response plan and tested in a tabletop, so that the person on shift at 3:14 in the morning does not have to negotiate for permission while the clock runs.

Decision 2 — Finding Patient Zero (03:26)

The file servers are quiet. Now the traceback. Three service accounts were writing to shares they have no business touching, and the encryption processes are running on a domain controller.

Why this is the right call

This is the highest-scoring decision in the case, and the reason sits in one detail most people skim past. The attacker has domain admin.

When the domain is compromised, the account is not the problem. The trust is. Every Kerberos ticket in an Active Directory domain is signed with the KRBTGT account’s key. An attacker who reaches domain admin can forge a golden ticket that keeps authenticating as anyone, on anything, long after you have disabled every account you know about. Disabling svc-backup feels like cutting the wire. It cuts one wire out of an unknown number. The sim is blunt about the result: the attacker pivots to a compromised account you have not found, and encryption restarts at 04:30 on radiology and lab servers, where clinicians are now unable to pull prior images.

Why twice? Active Directory keeps the current KRBTGT password and the previous one, so a single rotation leaves the attacker’s forged tickets valid. The second rotation is what actually invalidates them. One real-world caveat the sim does not have room for: let replication converge between the two rotations rather than firing them back to back, or you will break authentication across the domain and add a self-inflicted outage to your ransomware outage.

Those 14 hosts go into isolation in the same window as the rotation, not afterward. Same principle as any eviction against a live adversary. If you take away their access in stages, you are giving them a schedule.

Decision 3 — Clean Recovery Planning (06:15)

Sunrise. The attacker is out, DC-02 has been forensically imaged, and the 3-2-1 backup strategy held. The remaining question is not whether you can recover. It is the order and the pace, and there is a six-hour gap staring at you.

Why this is the right call

Your recovery point objective is not the same thing as your data loss. The snapshot is six hours old, so the obvious reading is that six hours of charting is gone. It isn’t, because the EMR transaction logs are sitting on the SAN. Replaying them against the restored database closes the gap to 22 minutes, which is inside what clinical staff can reconstruct from paper. This is why database logs belong on storage separate from the database, and why “we have backups” is only half of a recovery plan.

The alternative is the one every executive on the bridge call will suggest: restore everything at once, get the hospital back fastest. Restores are bound by the throughput of your backup infrastructure, not by your enthusiasm. In the sim, the parallel restore creates IO contention that corrupts two of them, EMR has to start over, and total downtime stretches to 18 hours of clinical disruption. Sequenced by priority, verified, then relaunched is not the cautious option. It is the fast one.

Verification before relaunch matters for a second reason, and the game demonstrates it on a different branch. Restoring into an environment you have not confirmed is clean is how a hospital ends up with a compromised primary and a compromised backup on the same morning.

The Ending You’re Playing For

Where the Other Roads Lead

Each row is a single wrong turn, followed by the best you can still do afterward. The third column is generous on purpose: it assumes you play flawlessly from that point on.

Shortcut taken	What it costs in the sim	Best ending still reachable
Wake the CIO, CISO, and Legal before touching anything	18 minutes on hold, 9,000 more files encrypted, EMR share at 23%	Partial — $4.1M
Power down the file servers to stop encryption fast	Half-encrypted files corrupted, volatile memory destroyed along with the decryption keys	Partial — $4.1M
Kill the process, disable svc-backup, investigate in the morning	Attacker pivots to an account you haven’t found; radiology and lab servers encrypt at 04:30	Partial — $4.1M
Restore the ICU nurse dashboards without isolating the subnet	Instant reinfection, a compromised primary and a compromised backup, a medication timing near-miss	Clinical Crisis — $22M+
Pay the 5 BTC ransom to speed up recovery	Potential OFAC exposure depending on the actor, a slow and partially broken decryptor, and you rebuild anyway	Clinical Crisis — $22M+
Restore everything in parallel to minimize downtime	IO contention corrupts two restores, EMR starts over, downtime stretches to 18 hours	Partial — $4.1M

Look at what that column never says. Victory does not appear once. In this case a single wrong turn takes the best ending off the table permanently, and everything after it is damage control. That design choice is the whole argument of the scenario: in an active ransomware event, the quality of your first ten minutes sets the ceiling on your outcome.

The Clinical Track Nobody Practices

One branch deserves its own mention because it is the most healthcare-specific decision in the whole simulation, and you only see it if you get the first move wrong. When the ransomware crosses into the ICU through a firewall exception that existed for EMR integration, the nurse dashboards lock on all 14 workstations. Bedside monitors keep running, because they sit on their own isolated segment. Their FDA Class II designation is a regulatory category, not a security control, and the isolation is what saved them. Forty-seven patients are suddenly on paper charts.

The correct move there is not an IT move at all. Declare Code Yellow, engage clinical leadership, hard-isolate the ICU subnet, and let the paper protocol carry patient care while recovery happens in parallel. The alternative, restoring the dashboards fast to make the problem go away, is the branch that produces a sentinel event. Patient safety and system recovery are two separate tracks with two separate owners. Hospitals that drill only one of them find out at 3 a.m. which one they skipped.

The Takeaway

Strip out the terminal windows and the score counter, and Midnight Lockdown leaves you with four habits that transfer straight into real practice:

1. Pre-authorize emergency containment, then notify in parallel. If your on-call analyst has to wake three executives before disconnecting a switch port, your mean time to containment is really your mean time to answering a phone. Write the authority down, name who holds it, and rehearse using it.

2. Contain without destroying. Isolate at the network layer and leave the machine running. Memory may hold encryption keys, and it will hold injected process artifacts and much of what your forensic team wants. Powering the box off is the one containment decision you can never undo.

3. When domain admin is compromised, rotate the trust, not just the accounts. KRBTGT twice, with replication convergence in between, plus coordinated isolation of every touched host in a single window. Anything less leaves the attacker a door you have not inventoried.

4. Treat the recovery sequence as part of the response. Restore in priority order, replay your logs, verify before you relaunch. Parallel restores are how organizations stretch a recovery to eighteen hours while believing they are being aggressive.

None of this is exotic, and that is the uncomfortable part. The optimal run through a hospital ransomware event is three ordinary decisions made correctly under exhaustion and pressure, at an hour when the wrong answer sounds perfectly professional.