Operation
Patient Zero
A phishing campaign was launched against the organization this morning. You will be handed the incident dashboard exactly as the security team sees it. Read the evidence, find Patient Zero, and answer three follow-up questions before the clock runs out.
3:00time limit
250pts / correct answer
+300bonus for finishing early
Team Mode
Name your team
Multi-Player Mode
Enter player names
Multi-Player Mode
Pass the device to Player 1
The clock starts the moment you begin your turn. You'll see the same dashboard every other player sees.
Incident Dashboard — Operation: Patient Zero
A phishing attack was launched this morning. Analyze the evidence and identify who was compromised.
250Emails Sent
178Opened · 71.2%
22Clicked · 8.8%
15Reported · 6.0%
4Flagged Accounts
09:00 AMCampaign Launched
Employee Activity Timeline
- 09:00All RecipientsEmail delivered
- 09:07Ahmed KhanOpened email
- 09:09Sarah ChenOpened email
- 09:11Sarah ChenClicked link
- 09:12Sarah ChenEntered credentials
- 09:14Fatima AliOpened email
- 09:18David LeeOpened email
- 09:19David LeeReported as phishing
- 09:20Ahmed KhanClicked link
- 09:23Ahmed KhanEntered credentials
- 09:31Fatima AliReported as phishing
Security Alerts
- HIGH 09:13 — New-device login from an unrecognized IP (Lagos, NG) on Sarah Chen's account, 1 minute after credential entry.
- MED 09:24 — MFA push fatigue: 6 rapid approval requests on Ahmed Khan's account.
- LOW 09:19 — Employee-reported phishing email from David Lee.
- LOW 09:31 — Employee-reported phishing email from Fatima Ali.
Email Analysis
- Subject
- "Action Required: Q3 Payroll Update"
- Sender (spoofed)
- payroll@simuphish-hr-support.co
- Link destination
- simu-portal-login.co/sso
- Attachment
- None
- Page behavior
- Lookalike SSO login form, captures username + password
Department Click-Through
1
Who is Patient Zero — the first employee whose credentials were compromised?
250 pts
2
What technique did the attacker use to steal credentials?
250 pts
3
Which department should be prioritized for follow-up training?
250 pts
4
Based on the Security Alerts, what is the correct first containment step?
250 pts
Debrief
Cyber Rangers
1050 pts
Debrief
Final Standings
All Sessions
Leaderboard
| Rank | Name | Mode | Score | Time |
|---|
No sessions recorded yet.