The day my garage got ransomwared

Who attacks a business that does not exist, what do they do once inside, when do they strike, where do they go, and why do they behave that way? This session answers those questions through a controlled experiment: a fictitious Australian financial services company built to attract real attackers.

A fictitious Australian financial services firm was built from the ground up and put on the internet to see what would happen. The company had a public website, Microsoft 365 tenancy and a full internal network running on enterprise hardware out of a residential garage.

What made it work wasn't the technical setup. It was the data. Using large language models, a full synthetic business ecosystem was created: fake customers with realistic profiles, fabricated payslips, internal financial records, a database that looked exactly like what a small financial services firm would hold. Because sophisticated threat actors know what staged environments look like, and they will walk away from them.

The intended entry point was an SSL VPN exposed to the internet, no multi-factor authentication, a generic account named "finance." The kind of misconfiguration that shows up in real incident response engagements every week. 

Initial activity appeared quickly, followed by months of silence. Then the attackers returned. Their actions were methodical: reconnaissance, lateral movement, data exfiltration and encryption. All of it playing out inside a network that looked and felt like a real business.

The final phase was negotiation. The threat actor made contact and negotiations happened over dark web chat and email. Real correspondence, real pressure tactics and real deadlines. The company was eventually posted publicly on a dark web leak site as a non-paying victim.

This session focuses on what unfolded. It shows ransomware as it happens, from entry to exposure, offering a practical view of attacker behaviour and decision-making.