# 📖 Glossary of Terms This glossary explains the key **cybersecurity, social engineering, and financial terms** used in *The Phisherman*. Use it to understand the world of high-stakes digital deception. ### aim of the game You play as a sophisticated cybercriminal working for a splinter cell of a notorious cyber syndicate. Your primary objective is to infiltrate and financially exploit Blackridge Capital, a high-stakes financial firm, through targeted social engineering, OSINT (Open-Source Intelligence), and psychological manipulation rather than brute-force hacking. To achieve this, you must: - Identify and Profile Targets: You scour through public data, LinkedIn profiles, and leaked internal documents to find vulnerabilities in Blackridge employees. Your main targets are key figures like Isabella Laurent (Director of Risk Oversight) and Marc Dubois (Analyst/Trader). - Manufacture Trust (Spear-Phishing): You craft a highly believable internal persona (like Elliot Cinder) and carefully interact with your targets. You must balance curiosity with caution to avoid tripping internal compliance alarms or raising suspicion. - Gather Actionable Intel: You are looking for specific, highly confidential information regarding Blackridge's market exposure, margin calls, and internal delay procedures (the "PRAP" dashboard). - Execute the Exploit: Your ultimate goal is to leverage this gathered intelligence to manipulate Blackridge's positions, force a fast payout, or capitalize on their financial vulnerabilities for your syndicate's gain (directed by your handler, Mango). TLDR: the game is a psychological cyber-thriller where you use information as a weapon. The core loop involves making calculated choices about who to pressure, what lies to tell, and how much risk to take before the firm's security apparatus catches on to your operation. --- ## 🔐 Cybersecurity & Social Engineering ### Core Concepts #### Social Engineering The art of manipulating people into revealing confidential information or performing actions that compromise security. *The heart of your mission.* #### Spear Phishing A targeted phishing attack aimed at a specific individual or organization, often using personalized information to increase credibility. *Your primary tool in this game.* #### OSINT (Open-Source Intelligence) The practice of gathering information from publicly available sources (e.g., LinkedIn, Facebook, public records). *How you research Isabella and Marc.* ### Attack Phases #### Reconnaissance The initial phase of gathering information about a target (e.g., researching Isabella Laurent or Marc Dubois). *The foundation of any successful attack.* #### Lure A deceptive message or file designed to trick the target into taking an action (e.g., opening a malicious attachment, clicking a link). *The bait in your trap.* #### Persona A fabricated identity used by attackers to appear legitimate during social engineering attacks. *You’ll create one to approach your targets.* #### Pretexting Creating a fabricated scenario (a *pretext*) to engage a target and gain their trust. *Example: Posing as a colleague or IT support.* #### Freeze A tactic to lock a target’s systems or accounts, preventing them from responding to an attack. *Used to buy time during a ransomware deployment.* ### Malware & Exploits #### Ransomware Malware that encrypts a victim’s files, demanding payment (usually in cryptocurrency) for the decryption key. *The Cell’s endgame.* #### Go Signal The moment when an attack (e.g., ransomware deployment) is authorized to proceed. *The point of no return.* #### Payload The malicious component of an attack (e.g., the ransomware itself). *Delivered via a lure.* #### Zero-Day Exploit A vulnerability in software that is unknown to the vendor and has no available patch. *Highly valuable for attackers.* ### Defensive Terms #### Audit Trail A chronological record of system activities, used to track and verify actions. *Manipulating or erasing an audit trail can hide malicious activity.* #### Paper Trail Evidence left behind by an attack (e.g., emails, logs, transactions). *A clean paper trail is critical for avoiding detection.* #### Active Directory Microsoft's directory service used by most large organisations to manage employee accounts, permissions, and email. Julian's third-party contractor role grants him **user provisioning rights** inside Blackridge's Active Directory, meaning he can create new accounts that appear legitimate to every internal system. *This is how the Elliot Cinder persona becomes a real Blackridge mailbox.* #### Hold-30 Exception Rule A compliance rule requiring a 30-day hold on certain transactions unless an exception is approved. *Exploiting this rule could allow attackers to bypass security checks.* --- ## 💼 Financial & Compliance Terms ### Blackridge Capital Systems #### PRAP (Portfolio Risk and Authorisation Platform) A fictional system used by Blackridge Capital to manage and authorize high-speed financial transactions. *Compromising PRAP would paralyze Blackridge’s ability to react to market changes. The Cell’s primary target.* #### Exposure Bands Risk categories (e.g., Green, Amber, Red) used to classify the potential impact of investments or breaches. *Example: A "Red" exposure might trigger immediate action.* #### Margin Call A demand by a broker for an investor to deposit additional funds to cover potential losses. *A margin call can trigger panic in financial markets and force liquidations.* #### Margin Call Executes The moment a margin call is enforced, often leading to forced sales of assets. *A critical vulnerability for Blackridge.* ### Investment & Trading #### Assets Under Management (AUM) The total market value of assets that a financial institution manages on behalf of clients. *Blackridge has $3 billion in AUM.* #### Equity Ownership in a company, typically represented by shares. *Blackridge’s portfolio is mostly equity.* #### Investment Thesis A documented reasoning for why an investment is expected to be profitable. *Marc Dubois drafts these for Blackridge.* #### Portfolio A collection of investments owned by an individual or institution. *Blackridge’s portfolio is diverse and high-value.* ### Risk & Compliance #### Risk Oversight The department responsible for identifying, assessing, and mitigating risks to an organization. *Isabella Laurent heads this at Blackridge.* #### Compliance Adherence to laws, regulations, and internal policies. *A key area to exploit for bypassing security measures.* #### Internal Escalation Ladder The hierarchy of who to contact for approvals or issues within a company. *Understanding this can help navigate Blackridge’s bureaucracy.* #### Silent Alerts Security alerts that are suppressed or hidden from certain users. *Example: A compromised system might trigger a silent alert to IT.* --- ## 🎯 The Cell & Its Operations ### Organization #### The Cell A small, agile group of cybercriminals, successor to the **Wizard Spider** group. *Your team.* #### Wizard Spider A **real-world** Russian-linked cybercriminal syndicate active from roughly 2016 to 2022. They operated the TrickBot banking trojan, Ryuk ransomware, and ultimately the Conti ransomware-as-a-service platform. At its peak, Wizard Spider functioned like a mid-sized software company, with HR, salaries, and performance reviews. After internal leaks and law-enforcement pressure in 2022, the group **fragmented into smaller, independent cells**. *The Cell in this story is one such successor.* #### Conti One of the most prolific **ransomware operations** in history, run by Wizard Spider. Between 2020 and 2022, Conti extorted hundreds of millions of dollars from hospitals, governments, and corporations worldwide. The group’s internal chats were leaked in February 2022 (the “Conti Leaks”), exposing its corporate-like structure. The operation formally shut down in mid-2022, but its tools, playbook, and personnel dispersed into new cells. *The Cell inherited Conti’s methods and contacts.* ### Roles #### Field Agent / Affiliate Your role. In the Ransomware-as-a-Service model, you operate as an independent contractor or "affiliate." You execute the social engineering attacks, gather intelligence, and open doors for the technical team. *The ghost in the machine.* #### Initial Access Broker (IAB) A specialized cybercriminal who breaches corporate networks and sells that access (credentials, VPN sessions, RDP access) to ransomware operators on dark web forums like Exploit or XSS. *Julian acts as a highly specialized, targeted IAB for the Cell.* #### Crypto Mixers (Tumblers) Services that mix potentially identifiable or "tainted" cryptocurrency funds with others, obscuring the trail back to the original source. *How the syndicate pays you without leaving a paper trail.* #### Ransomware-as-a-Service (RaaS) A business model where ransomware developers lease their malware to "affiliates" (like Julian and his cell) for a cut of the ransom payouts. *The corporate structure of modern cybercrime.* #### General Manager (Mango) The leader of the Cell. *Your ultimate boss.* #### Dane Your handler and liaison to Mango. *He translates your work into something Mango can tolerate.* --- ## 🔗 Useful Links - [[Glossary - Techniques]] (Detailed breakdown of social engineering methods) ---