Ransomware Reaction — Cybersecurity Game
A corporate awareness game about the first minutes of a suspected ransomware incident. You are at work, something starts going wrong, and how fast you disconnect and how clearly you report matter far more than trying to fix it yourself.
Ransomware Reaction is a free browser-based cybersecurity game. A corporate awareness game about the first minutes of a suspected ransomware incident. You are at work, something starts going wrong, and how fast you disconnect and how clearly you report matter far more than trying to fix it yourself.
Difficulty: Intermediate. Estimated play time: 36 minutes.
Seven scenarios on the same finance floor at Acme Corporation, from a desk orientation through to a randomised assessment with no hints: The First Warning, Locked Out, The Attachment, Shared Damage, Executive Target and Final Incident.
The workstation, the desk phone and the network socket in the wall are physical objects you walk to. The screen holds mail, chat, files, CloudDrive, a browser, a security monitor and the help desk — and the wrong buttons are right there beside the right ones: open the odd file, delete it, send copies to a coworker.
The infection runs on its own clock whether or not you have noticed it, moving from suspicious to local encryption to network propagation, and the impact meter climbs from this computer only to shared services and business disruption.
Scoring is five categories out of a thousand: detection 200, containment 250, reporting 250, evidence 150, and 150 points of avoidance you start with and can only lose — by plugging in a USB, contacting the attacker, rebooting, deleting files or carrying on working. Hints cost 25 points each.
The debrief gives the score breakdown, what happened minute by minute, what you did well, what made things worse, and the one lesson the scenario existed to teach. The ransomware is fictional: nothing on the real computer is encrypted, and there is no wallet, payment page or attacker to contact.
What you will learn
- Ransomware usually looks like "the file just broke" long before any ransom message appears
- Spotting it early is a judgement call — one error is normal, several at once is a pattern
- Cause and effect are often separated by a few minutes; memory is part of the job
- Availability problems on a share can be a symptom of spread, not a reason to keep clicking
- Ransomware is a business incident, not an IT inconvenience
- Some things you fix on the screen; others you fix by getting up — a cable, a phone
How to play
- Walk around a normal office: W A S D to walk, mouse to look.
- Follow one step at a time — the card in the corner always tells you what to do next.
- Press E to use whatever the reticle is on: the screen, the phone, the network socket.
- See what your choices caused — every step ends with the reason it mattered.
- Read the debrief: the score breakdown, the timeline, and the one lesson.
Platforms and languages
- Platforms: Desktop, Tablet
- Languages: English, Română, Français, Deutsch, Nederlands, Italiano, Español, Polski, Українська
Practise with these games
Game screenshots
Related cybersecurity topics
- Phishing Awareness Games
Practise spotting deceptive messages, suspicious sign-in pages and payment requests with free phishing awareness games.
- Ransomware Awareness & Response Games
Explore ransomware decisions through interactive games covering suspicious attachments, containment, reporting and recovery planning.