🔍 The Art Gallery Murder Mystery

BFE Digital Forensics Lab

The Quantum Breach

Analyze digital evidence, identify the attack pattern, connect the suspects and solve the cyber-forensics case.

INCIDENT REPORT | QB-2025-001

Location: Quantum Dynamics Research Facility

Incident: Critical Data Breach and System Compromise

Status: Active Investigation

Classification: Level 5 | Highest Priority

Investigation Progress 0%

Digital Forensics Toolkit

Initial System Analysis

System breach detected at 02:34 AM

Multiple failed SSH attempts from internal IP

Unusual data transfer patterns detected

Quantum research database accessed

Emergency shutdown initiated at 03:17 AM

What does the initial analysis suggest about the attacker?

Consider the origin of the SSH attempts and the access patterns.

Suspect Database

Dr. Sarah Chen | Lead Quantum Researcher

Access Level: Alpha

Last Login: 02:15 AM

Recent Activity: Late night access to research servers

Marcus Wong | Network Administrator

Access Level: Omega

Last Login: 02:30 AM

Recent Activity: Security patch deployment

Dr. James Cooper | Visiting Researcher

Access Level: Beta

Last Login: Failed attempts at 02:33 AM

Recent Activity: Multiple access attempts to restricted areas

NETWORK ANALYSIS REPORT

SSH_LOG

02:30:15 - Successful login: admin_wong
02:32:45 - Failed login: j_cooper
02:33:01 - Failed login: j_cooper
02:33:15 - Failed login: j_cooper
02:34:01 - Successful login: system_admin
02:34:30 - Database query: quantum_results
02:35:15 - Large file transfer initiated
        

What suspicious pattern appears in the network logs?

Look at the sequence of events and user permissions.

Malware Analysis Results

Detected: Custom SSH Credential Harvester

Origin: Internal Development Server

Compilation Date: January 1, 2025

Signature: Matches Internal Code Structure

Target: Quantum Research Database

What does the malware analysis reveal about the perpetrator?

Consider who would have access to internal development resources.

Recovered Data Fragments

FILE_TRANSFER_LOG

/quantum/results -> 192.168.1.45
/research/prototype -> 192.168.1.45
/security/access -> 192.168.1.45
        

IP Trace: Research Lab Terminal 45

User Assignment: Dr. James Cooper

Based on the data fragments, what was the attacker's primary goal?

Look at the types of files being transferred.

Final Analysis

• Custom malware matches visiting researcher's coding style
• Data transferred to external destination matches stolen research
• Failed login attempts followed by system administrator access
• Transfer destination linked to a competing research facility

Who is responsible for the quantum breach?

Connect the malware origin, access patterns and data destination.

Case Solved: The Quantum Breach

Outstanding digital forensics work. You uncovered the truth.

Perpetrator: Dr. James Cooper

Evidence Trail

• Custom malware created on internal servers
• Failed login attempts followed by stolen administrative access
• Research data transferred to a competing research facility
• Matching code signatures and access patterns

The visiting researcher attempted to steal quantum research data using internally developed malware and compromised credentials. The attack was sophisticated but left traces in network logs and file transfers.

Investigation Rating: Master Cyber Detective

0 / 5

Investigation Score

Network Traffic Analysis

Large data transfers detected to external IP addresses. The pattern suggests an automated exfiltration attempt using custom protocols.

Malware Scan Results

Custom SSH credential harvester detected. Malware signature matches internal development patterns and targets the research database.

Access Log Analysis

Multiple failed login attempts were followed by successful system administrator access. This represents an unusual activity pattern.

Cryptographic Analysis

Encrypted data transfers use modified internal protocols. Encryption keys match development server signatures.