# data[].attributes.headline
Wizard Spider: Lethally Poisonous Ransomware

# data[].attributes.subject
Wizard Spider: Lethally Poisonous Ransomware

# data[].attributes.body
Ransomware has become the cyberattack of choice for many criminal hackers due to its relative low-tech/high-yield character. This is seen across private, government, and personal data stores as cyber criminals use ransomware to “datanap” information stored on personal computers and devices, servers, and even cloud stores, then demanding payment for the encryption key to unlock and restore the valuable data. Nowhere has this been more effective than in the healthcare industry where hospitals and clinics are responsible for and dependent on the data and also liable for any harm that may come to patients physically. This is not to mention the fact that if patient personally identifiable information (PII) or Health Insurance Portability and Accountability Act (HI-PAA) medical data were to be kept and spread or used by the hackers, more consequences would cascade. A ransomware attack on the Druid City Hospital (DCH) Healthcare System in October of 2019 is a prime example of the con-sequences and ramifications of medical and patient data being held captive. In this case study, the attack itself will be recounted, issues and dilemmas will be characterized, and the implications of this attack will be discussed.

# data[].attributes.body
For more information see www.trendsglobal.org. To schedule a Case Study Workshop contact info@trendsglobal.org

# data[].attributes.body
This case examines allegations of Chinese state-sponsored cyber espionage directed at U.S. firms and research institutions, particularly for the purpose of stealing intellectual property and sensitive research data. It focuses on how cyber intrusions have been used as part of China’s broader economic and strategic efforts to acquire technological and commercial advantages. The case also explores the continuation of these activities despite a 2015 agreement between the United States and China intended to curb cyber-enabled intellectual property theft. Particular attention is given to attempts to obtain COVID-19 vaccine and treatment research during the pandemic, including reported targeting of pharmaceutical companies, universities, healthcare organizations, and government agencies involved in the global coronavirus response.

# data[].attributes.headline
Starfruit Lab: A Cybersecurity Dilemma Case Study

# data[].attributes.subject
Starfruit Lab: A Cybersecurity Dilemma Case Study

# data[].attributes.body
StarFruit Labs is a decision-forcing perspective case that places students in the position of examining complex dilemmas from multiple stakeholder viewpoints rather than through traditional role-play. The case explores both short-term issues at the intersection of cybersecurity policy and risk management and longer-term concerns involving state-sponsored hacking, genetic manipulation, human rights, and claims of ethnic superiority. By engaging with these overlapping technological, ethical, and geopolitical challenges, students analyze how emerging threats and policy decisions may shape future global security and governance.

# data[].attributes.headline
Starfruit Lab: A Cybersecurity Dilemma Case Study - Teaching Notes

# data[].attributes.subject
Starfruit Lab: A Cybersecurity Dilemma Case Study - Teaching Notes

# data[].attributes.body
This hypothetical decision-forcing case examines the complex dilemmas faced by artificial intelligence systems and the humans who design or oversee them when confronted with situations in which no ideal option exists. The case explores the legal, ethical, policy, operational, and technical challenges involved in decision-making under extreme circumstances, highlighting the growing role of AI in high-stakes environments. By placing students in situations marked by uncertainty and moral tension, the case encourages critical thinking and the development of innovative, paradigm-shifting approaches to problem solving.

# data[].attributes.body
Digital forensics plays a critical role in modern criminal and civil investigations by enabling practitioners to preserve, analyze, and interpret digital evidence that may be volatile, encrypted, or intentionally concealed. Investigators often face situations where technical constraints and legal protections intersect, requiring them to make urgent decisions that balance evidentiary integrity with constitutional rights and procedural fairness. These scenarios highlight the importance of both technical expertise and sound judgment under pressure.

Building on this context, the case emphasizes practical trade-offs that arise with contemporary storage and security technologies—particularly solid-state drives (TRIM and wear-leveling effects), full-disk encryption, and the evidentiary value of volatile memory. Students evaluate competing actions (e.g., immediate shutdown to halt further data loss, live acquisition to preserve access to unlocked data, or targeted memory capture to recover decryption material), and consider how each choice affects recoverability, contamination risk, and later admissibility. Attention is also given to documentation and chain-of-custody practices, articulation of investigative rationale, and the ethical framing necessary to defend actions in technical and legal forums. In this case study, we recount the incident, outline the central dilemmas, and discuss their practical implications.

Please note that this case study is based on a real incident but has been adapted for educational purposes.1

# data[].attributes.headline
Digital Forensics Under Pressure Teaching Notes

# data[].attributes.subject
Digital Forensics Under Pressure Teaching Notes

# data[].attributes.body
The scenario involves important air operations in a forward theater that are potentially impacted by computer system downtime required to install a patch to close a known cybersecurity vulnerability. Multiple considerations are introduced, including US strategy, cybersecurity risks, host nation interests, allied nation interests, deterrence, conflict escalation, and the perception of US actions.

# data[].attributes.headline
The 72-hour Ghost: AI vs the ticking clock

# data[].attributes.subject
The 72-hour Ghost: AI vs the ticking clock

# data[].attributes.body
This case places students inside a high-pressure digital forensics investigation in which law enforcement must identify the source of cyber-delivered terror threats within a fixed 72-hour window to stop an imminent bombing. Investigators obtain a massive dataset that is impossible to examine manually and must decide whether to rely on a proprietary AI-powered stylometric analysis tool to identify a suspect and justify a warrant. The tool produces a statistically confident match that leads to a successful seizure of the bomb and arrest of the suspect.

However, once the crisis is over, the legal battle begins. The defense challenges the core of the prosecution’s case, arguing that all recovered evidence must be suppressed because the AI’s decision-making process is a “black box” that cannot be independently evaluated or cross-examined. This case invites analysis of how far investigators can and should trust AI in life-or-death cyber investigations, how courts must adapt evidentiary rules to rapidly evolving technology, and what precedent such rulings will set for the future of digital forensics.

# data[].attributes.headline
Th 72-hour Ghost: AI vs the Ticking Clock - Teaching Notes

# data[].attributes.subject
Th 72-hour Ghost: AI vs the Ticking Clock - Teaching Notes

# data[].attributes.body
Updates are very important for the proper working of modern computer systems, as they provide up to date security, bug fixes and improved performance. Thus, they allow administrators to patch vulnerabilities, remove any issues with bugs which have been discovered by the software provider or other parties and allow the software to be kept current with any new technologies that are developed. Maybe the most important part of the updates is that they “plug in security holes” (patch management) that otherwise would allow attackers to damage or take over the vulnerable systems. However, updates can come with risks or challenges, and there are always tradeoffs. They can introduce instability in the updated systems, and can create compatibility issues with already installed software, or with previous updates. Worse, they can insert new vulnerabilities. These vulnerabilities can lead to systems crashes, as happened on July 19, 2024, when an update from CrowdStrike resulted in a massive outage which affected 8.5 million Windows devices, in sectors ranging from airlines and banking to hospitals and emergency systems. 1 The outage resulted in the disruption of infrastructure systems for a few days, leading to financial losses in the billions. In this case study, we will analyze this outage, will define a dilemma and then use this dilemma to discuss the effects and possible solutions for the outage. This dilemma centers on how stakeholders can balance timely updates with avoiding catastrophic outages. It also raises the question of where liability stands if an outage occurs even after precautions are taken. The case study is designed for use in courses covering areas like cybersecurity, information technology, computer science, criminal justice, law and ethics, public policy, and business management, but might be adapted to any field affected by an update outage.

# data[].attributes.body
Attacking Maria is a high-fidelity, inter-governmental crisis table-top exercise (TTX) simulating a sophisticated cyber-attack resulting in a large-scale humanitarian crisis. The scenario takes players to Poland, situating the exercise amidst tensions in Europe fueled by the ongoing war between Russia and the Ukraine. Participants are assigned to teams representing national governmental agencies, non-governmental organizations, private sector operators and alliance-level organizations. The various teams are tasked with coordinating response efforts under conditions of uncertainty, complexity and time pressure.

# data[].attributes.body
This fictional, cautionary tale explores a complex cyber-physical security breach at Chaco Culture National Historical Park in New Mexico. The incident was initiated by a cross-border drug cartel that exploits a stale contractor account which lacked multi-factor authentication and oversight, to infiltrate the park’s new Geographic Information System (GIS) and drone monitoring platforms. By manipulating GIS data and drone feeds, the attackers create coordinated diversions that reroute ranger patrols away from intended smuggling routes. The crisis escalates when the hackers facilitate the physical sabotage of a natural gas pipeline node within the park, causing cascading power outages across four states (Texas, New Mexico, Arizona, and California) and degrading critical federal communication and surveillance systems. The case highlights both the strategic danger of integrated data pipelines, demonstrating how a localized breach can be used to "ride the pipeline upstream" to compromise national-level servers with ransomware or malicious data, as well as the manipulation of drones to implement a physical attack. Ultimately, the scenario underscores the urgent need for comprehensive Zero Trust Mandates implementation and rigorous administrative oversight to protect critical infrastructure from hybrid criminal threats.

# data[].attributes.attachment_link.description
Discover the latest trends with Trends Global.

# data[].attributes.body
The 2024 Snowflake data breach incident was primarily caused by attackers using stolen customer credentials to access Snowflake customer accounts that lacked multi-factor authentication (MFA). The incident affected approximately 165 organizations, resulting in the unauthorized access and theft of large volumes of sensitive customer and corporate data. In addition to exposing sensitive information, the breach led to significant financial losses and reputational damage for many of the affected organizations.

This case study examines the 2024 Snowflake data breach incident and provides an in-depth analysis of a real-world cloud security event. The study explores the shared responsibility model in cloud computing, highlighting the respective security responsibilities of cloud service providers and their customers. It also discusses major cloud security threats and the expanded attack surface that organizations may face when migrating sensitive data to cloud environments, where increased accessibility can introduce additional security risks.

Furthermore, the case study analyzes the root causes of the breach, the incident response measures implemented by Snowflake and affected organizations, and the broader lessons learned from the event. Finally, it encourages critical discussion regarding the advantages and challenges of cloud-based versus non-cloud-based data storage solutions, particularly in the context of data security, access control, risk management, and regulatory compliance.

This case encourages critical thinking, ethical reasoning, and practical application of cloud computing and cloud security principles, preparing students to anticipate and respond to security challenges in real-world cloud environments.

# data[].attributes.headline
Snowflake 2024 Data Breach Teaching Notes

# data[].attributes.subject
Snowflake 2024 Data Breach Teaching Notes

# data[].attributes.headline
Colonial Pipeline Case Study: When Private Infrastructure Meets National Security

# data[].attributes.subject
Colonial Pipeline Case Study: When Private Infrastructure Meets National Security

# data[].attributes.body
On May 7, 2021, Colonial Pipeline, an American oil pipeline system that originates in Houston, Texas, and carries gasoline and jet fuel to the Southeastern United States and along the Atlantic seaboard, suffered a ransomware cyberattack that afflicted computerized equipment managing the pipeline. The attack forced the company to proactively shut down its entire 5,500-mile pipeline system for six days, creating fuel shortages across the Southeast and exposing critical vulnerabilities in America’s energy infrastructure.

This case examines the intersection of cybersecurity, business continuity, and national security when private companies controlling critical infrastructure face cyber threats. This pipeline transports over 100 million gallons of fuel daily within a system extending from Houston, Texas, to Linden, New Jersey.

# data[].attributes.headline
Colonial Pipeline Case Study Teaching Notes

# data[].attributes.subject
Colonial Pipeline Case Study Teaching Notes