1.3.4 Lab - Visualizing The Black Hats

Lab - Visualizing the Black Hats
Objectives
Research and analyze cyber security incidents.
Background / Scenario
The FBI has estimated that cybercrime cost individuals and companies over 3.5 billion dollars in 2019.
Governments, businesses, and individual users are increasingly the targets of cyberattacks and cybersecurity
incidents are becoming more common.
In this lab, you will create three hypothetical cyber attackers, each with an organization, an attack, a motive.
In addition, suggest a method by which an organization could prevent or mitigate the attack.
Note: You can use the web browser in the virtual machine that was installed in a previous lab to research
security issues. By using the virtual machine, you may prevent malware from being installed on your
computer.
Required Resources
 PC or mobile device with internet access and virtual machine (optional)
Instructions
Scenario 1:
Hacktivist Group Targeting a Government Website
a. Who is the attacker?
A hacktivist named "ShadowNet".
b. What organization or group is the attacker associated with, if any?

ShadowNet is associated with an anonymous hacktivist collective advocating for free speech and
government transparency.
c. What is the motive of the attacker?

The motive is political activism—to protest against government censorship and promote the right to free
information.
d. What method of attack was used?

The group launched a DDoS (Distributed Denial of Service) attack, overwhelming the government’s
public portal and rendering it inaccessible for hours
e. What was the target and vulnerability used against the business?
 2018 - 2024 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 1 of 3 www.netacad.com
Target: The government’s online portal for public services.

Vulnerability: The website lacked traffic filtering systems capable of handling high volumes of malicious
traffic.
f. How could this attack be prevented or mitigated?

- Deploy a Web Application Firewall (WAF) to detect and block malicious traffic.
- Use anti-DDoS solutions such as rate limiting and traffic filtering.
- Partner with a CDN (Content Delivery Network) to distribute traffic across multiple servers.
Scenario 2:
Ransomware Attack on a Healthcare Organization
An attacker known as "CryptoDrake," a financially motivated cybercriminal.
b. What organization/group is the attacker associated with?

CryptoDrake is part of a cybercrime syndicate specializing in ransomware.

The motive is financial gain. CryptoDrake encrypted the hospital’s patient records and demanded a large
ransom in Bitcoin for the decryption key.

The attacker used phishing emails containing malicious links. Once clicked, ransomware was installed
on the system, encrypting all patient data.
Target: A hospital's patient management system.
Vulnerability: Employees were not trained to detect phishing emails, and the hospital lacked endpoint
protection systems.

- Conduct cybersecurity awareness training for employees to recognize phishing attempts.
- Implement regular backups to restore data without paying ransoms.
- Use endpoint detection and response (EDR) tools to detect and stop ransomware before it
spreads.
Scenario 3:
State-Sponsored Espionage Attack on a Tech Company

An advanced persistent threat (APT) group named "DarkPhoenix".
b. What organization/group is the attacker associated with?

DarkPhoenix is linked to a nation-state government conducting cyber-espionage for strategic
advantages.

The motive is industrial espionage. The group seeks to steal intellectual property and sensitive data
from a tech company to gain a competitive edge.

DarkPhoenix exploited an unpatched zero-day vulnerability in the company’s software to gain access
to its internal network and exfiltrate sensitive data.
Target: A tech company’s research and development servers.
Vulnerability: The company had unpatched software with a known zero-day exploit.

- Implement a robust patch management system to apply updates as soon as vulnerabilities are
discovered.
- Use network segmentation to limit access to critical servers.
- Monitor for unusual behavior using advanced intrusion detection systems (IDS).
End of document

1.3.4 Lab - Visualizing The Black Hats

Uploaded by

Copyright:

Available Formats

1.3.4 Lab - Visualizing The Black Hats

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1.3.4 Lab - Visualizing The Black Hats

Uploaded by

Copyright:

Available Formats

Lab - Visualizing the Black Hats

b. What organization or group is the attacker associated with, if any?

c. What is the motive of the attacker?

d. What method of attack was used?

Target: The government’s online portal for public services.

f. How could this attack be prevented or mitigated?

b. What organization/group is the attacker associated with?

c. What is the motive of the attacker?

d. What method of attack was used?

f. How could this attack be prevented or mitigated?

a. Who is the attacker?

b. What organization/group is the attacker associated with?

c. What is the motive of the attacker?

d. What method of attack was used?

f. How could this attack be prevented or mitigated?

You might also like