Operation Glass Shield

PRACTICAL · LINUX · difficulty 3 · ~20 min · 18 steps

Emergency network segmentation during a live ransomware spread.

Briefing

13:12 UTC. Detonation confirmed on three hosts in VLAN 20 (workstations). Ransomware is enumerating SMB shares — VLAN 30 (servers) and VLAN 40 (backups) are exposed. You are on the edge firewall. Every minute you wait is more encrypted data. Segment NOW, then prove the vault is sealed.

Objectives

• Map interfaces and current rules under pressure
• Write surgical firewall rules to stop lateral spread
• Protect the backup vault while keeping IR access open
• Trace the origin as far as the evidence honestly reaches

Return to the range lobby