War Room Debrief: How a Fictional Grocery Chain Got Crushed by APT 64
A tabletop exercise at Infosecurity Europe put ransomware, AI poisoning, and deepfake CEO videos inside a simulated supermarket attack. The blue team held the line. The red team shorted the stock anyway.
Semperis ran its 'Enter the War Room' tabletop exercise at Infosecurity Europe this month, and the fictional victim — a grocery chain called BlueCart — took a thorough beating before the two-hour session was done.
The adversary group on paper was APT 64, alias Checkout Chaos, described as a nation-state-linked outfit with motives split between financial gain and reputational destruction. That hybrid objective shaped every move the red team made.
BlueCart's crown jewel was an AI-enhanced supply chain command centre: a centralised hub governing inventory, logistics, warehouse scheduling, and store fulfilment. The red team's opening play was supply-chain compromise — identify a logistics partner with trusted API access, use stolen developer credentials and weak MFA enforcement, and pivot through over-privileged service accounts into planning and inventory systems. Loyalty card data came out the other side. Active Directory was probed via phishing and credential theft. The building-management network, poorly segmented from IT, offered a secondary path to disrupt heating, cooling, and ventilation.
The blue team refused to pay. Standard response. The red team leaked the loyalty data anyway.
From there the attack went wider than most ransomware playbooks. Thousands of false alerts flooded the SOC to slow analyst response — defenders countered with out-of-band comms channels. Payroll operations were disrupted. On social platforms, the red team seeded rage-bait content blaming AI-driven job cuts, attempting to recruit opportunistic hacktivists. A deepfake of BlueCart's CEO — shot to look like a superyacht confession — had him celebrating layoffs as a path to higher margins.
Fake delivery orders for perishable goods and sex toys were injected to generate logistical chaos.
The blue team claimed it had corralled the attackers inside a honeypot the entire time, meaning no real customer data was ever exposed. The red team disputed that. Semperis, acting as game master, didn't adjudicate.
Simon Hodgkinson, strategic advisor at Semperis, noted that even without a paid ransom, the red team found a revenue stream. 'Despite the motivation not being financial they did take the opportunity to make money through media manipulation and shorting stock,' he said. The deepfake and the hacktivist recruitment weren't noise — they were parallel income.
Guido Grillenmeier, principal technologist at Semperis, was clear the exercise wasn't a technical drill. No log files, no telemetry. The point was decision-making under pressure, not detection engineering.
Hodgkinson framed the core lesson bluntly: real resilience runs on people and process, not tooling. The blue team's discipline in thinking about minimal viable business continuity — what to stand up first if destructive payloads deployed — was the takeaway worth carrying into an actual incident.
