Deploy The Freeze - Hero Quest

You let the cell move. Nothing on your screen explodes; there is no Hollywood countdown. It fails the way modern catastrophe usually does, quietly first, then all at once. Dane does not break down PRAP's front door. He uses the blind spot you already mapped: the same habit that once let a missing escalation disappear without anyone deciding to hide it. A hold does not only delay a decision; it keeps the system's attention on the market while the cell's code goes in through the door nobody is watching. Then PRAP simply stops answering. Authorisations stall. The clean path from alert to approval thickens. People refresh. People call people. Somewhere a desk phone rings with the urgency of money that does not care about anyone's internal story. You watch your own hands as if they belong to someone else. You only opened a door, you tell yourself, and you can feel the draught through the whole building anyway. The hold, the amber screens, the polite discipline of "awaiting confirmation," all of it turns into a different kind of trap now that the system meant to restore order cannot be reached at the moment order is most expensive. The quiet is worse than noise. [[Cybercrime/The_Phisherman/Freeze Takes Hold|See if the freeze takes hold]] <details> <summary>🔎 Behind the curtain: how the ransomware locks PRAP</summary> This part is very close to how real ransomware behaves. Before it scrambles anything, modern ransomware usually phones home to a server the attackers control (a command-and-control, or C2, server) for its encryption key, then hunts down the victim's safety nets. It deletes Windows shadow copies (the automatic restore points, wiped with built-in tools like vssadmin) and tries to stop or destroy backup software before a single file is locked. Security teams treat shadow-copy deletion as a klaxon, because it usually means encryption is seconds away. Families like LockBit, Conti and BlackCat all do this as standard, and most now also steal the data first, so they can threaten to leak it as well as lock it (so-called double extortion). Does it really happen? Constantly, and to exactly this kind of target. In 2021 the Conti group froze Ireland's national health service, the HSE, for weeks. In February 2024 the group BlackCat/ALPHV hit Change Healthcare, which processes roughly a third of all US medical claims: they got in through a single remote-access account with no multi-factor authentication, stole about 6 terabytes of data, were reportedly paid 22 million dollars, and still knocked pharmacies and hospital billing offline nationwide for weeks. Around 190 million people were affected, the largest health-data breach on record. What is story here: the idea that Isabella's "observation hold" quietly switches off the system's own monitoring is a simplification, a neat way to tie a business decision to a security gap. In real breaches the blind spot is messier and more human: attackers sit inside for days or weeks, and alarms often do fire but nobody acts on them in time. That is exactly what the official review found at the HSE, where alerts were raised and missed. Defender's lesson: the one thing that most reliably beats an extortion demand is backups the malware cannot reach, kept offline or immutable and tested regularly. Watch for anything deleting shadow copies or stopping backup services, and make sure a raised alarm actually reaches a human who acts on it. </details>