Range Scenario · crucible · 35 min
Ransomware Indicator Clustering with an LLM
This cybersecurity training scenario simulates a working incident. Three suspected cybersecurity ransomware incidents this quarter. An LLM clusters the indicators across them to test the same-actor hypothesis. Verify the clustering, pick the right confidence statement.
Scenario briefing
You run threat intel for a private-sector cybersecurity ISAC. Three member firms reported ransomware incidents in the last 90 days: Acme Manufacturing (file rename to .lockedX), Beta Logistics (.encrypted), Gamma Retail (.lockedX). All three reported initial access via VPN credentials matching a known leaked-corpus.
An LLM clustering tool ingested the three incident reports and proposed: 'Same-actor cluster, confidence 0.78, common ransomware family Phantom.' You disagree because the file extensions differ and the ransom note formats vary.
This scenario tests indicator-clustering tradecraft, LLM verification on attribution, and the discipline of confidence calibration. Sources: MITRE ATT&CK TA0040 Impact, CISA #StopRansomware advisories.
What you will practice
- Distinguish strong and weak attribution evidence in ransomware
- Validate LLM clustering against base-rate of shared TTPs across crimeware
- Express confidence levels in line with the Admiralty system or ICD 203
- Frame attribution caveats in actor-cluster reporting
How this scenario is scored
The scenario has 6 ordered steps. Most steps are exact-match (a MITRE ATT&CK technique ID, a tool name, or a yes/no decision) or multiple choice. Free-text steps queue for manual review and do not affect the auto-final-score in the MVP.
Each step has a max score of 100 points. Hints deduct points up front, listed before you reveal them. Your final score is the sum across steps. Range Elo updates on completion based on scenario difficulty (Advanced) and your final score percentage.
Frequently asked questions
Why is shared initial-access vector a weak attribution signal?
Many ransomware operators buy access from the same Initial Access Brokers. A leaked-credential corpus is rented by dozens of affiliates simultaneously. Same-vector across three incidents fits both same-actor and shared-broker hypotheses with similar prior probability. Strong attribution requires unique tradecraft like custom tooling, infrastructure overlap, or rare technique combinations.
What confidence framework should attribution reporting use?
ICD 203 Analytic Standards (US Intelligence Community) define standard probability terms: almost certainly, very likely, likely, even chance, unlikely, very unlikely. The Admiralty system rates source reliability and information credibility separately. Either system beats untyped percentages because LLMs and analysts both anchor differently on raw numbers.
How do file-extension differences affect family attribution?
File extension is set by the encryptor binary. Same-family operators sometimes change extensions per affiliate or per campaign. Extension alone is weak. Combine with ransom note hash, lockfile structure, exclusion list, and YARA rules for stronger family identification.
Course content is for educational purposes only and does not constitute professional advice. All claims are supported by cited peer-reviewed academic research. DecipherU does not teach or reproduce any proprietary sales methodology. Verify all referenced sources independently.
Get cybersecurity career insights delivered weekly
Join cybersecurity professionals receiving weekly intelligence on threats, job market trends, salary data, and career growth strategies.
By subscribing you agree to our privacy policy. Unsubscribe anytime.