Malware Mutiny Lesson Plan Malware Mutiny
Teacher Facilitation Guide • Grade 10-12 Cybersecurity
Mission Objectives
Identify 12 distinct types of malware based on behavior rather than just definitions.
Simulate the spread of a Worm vs. a Virus to understand propagation vectors.
Analyze simulated security logs to identify active threats in a network environment.
Evaluate the specific impact and "payload" of high-threat malware like Ransomware and Wipers.
Lesson Timeline (90 Minutes)
00-15m
Entry Vector: The "What's Wrong?" Prompt
Show a screenshot of a "Blue Screen of Death" or a fake Ransomware note. Ask students: "Is this a bug or an attack? How can you tell?"
15-35m
Threat Matrix Briefing (Slides)
Direct instruction focusing on the 12 types. Emphasize the difference between delivery (Trojan) and payload (Ransomware).
35-55m
Hands-On: Patient Zero Simulation
A physical activity where students "infect" classmates based on specific rules (e.g., Virus requires a "handshake", Worm spreads to everyone in a row).
55-80m
Log Hunter Challenge
Students work in "SOC Teams" to analyze a packet of security logs and identify which piece of malware is responsible for each anomaly.
80-90m
Post-Mortem Debrief
Discuss: Which malware is hardest to detect? Why is the "Human Element" the most common infection vector?
Essential Tech Terms
Propagation
How the malware moves from machine to machine.
Payload
The actual malicious action (stealing data, deleting files).
SOC
Security Operations Center - where analysts monitor for threats.
Required Materials
Threat Matrix Slides
Simulation Index Cards
Log Hunter Packet
Red/Green highlighters
Discussion Fire-Starters
"If a user clicks a link and their files are encrypted, is that a failure of technology or a failure of the person?"
Focus: The psychology of Social Engineering vs. software vulnerabilities.
"Why would an attacker use a Rootkit instead of Ransomware? Which is more dangerous to a bank?"
Focus: Persistence vs. immediate profit.
"A 'Wiper' looks like Ransomware but doesn't have a decryption key. What is the motive behind a Wiper?"
Focus: Destructive nation-state attacks vs. criminal profit.
"DDoS attacks use Botnets. How do we stop an attack coming from 10,000 different innocent 'smart' toasters?"
Focus: The vulnerability of IoT devices and network traffic filtering.
Cybersecurity Essentials • Module 4: Malware Analysis • Facilitator Reference
Threat Matrix Slides Threat Matrix
ANATOMY OF A CYBER ATTACK
[ SYSTEM SCANNING... ]
What is Malware?
"Short for Mal icious Software ."
It is any code specifically designed to disrupt, damage, or gain unauthorized access to a computer system.
> KEY METRICS:
Propagation: How does it spread?Payload: What does it actually do?Persistence: How does it stay hidden?
The Self-Replicators
Virus
Requires Human Action to spread (opening an email, running a .exe).
Needs a "Host" file to attach to.
Worm
Self-Spreading . Does not need a host or a human. It crawls across networks.
Uses vulnerabilities to hop machines.
Trojan Horse
Malicious code disguised as legitimate software . You think you're downloading a game, but you're installing a threat.
"Delivery method, not just a payload."
Backdoor
A hidden entrance that bypasses normal authentication. It lets the attacker return to the system whenever they want.
The Hostage-Takers
Ransomware
Encrypts your files and demands payment (usually Bitcoin) for the decryption key.
[!] ALL FILES ENCRYPTED. PAY 0.5 BTC.
Wiper
Looks like ransomware, but there is no key . It simply deletes or overwrites the hard drive permanently.
Motive: Sabotage
Rootkit
Malware that hides deep inside the operating system (the Kernel). It can hide its own files and processes from Task Manager and Anti-Virus.
// If the OS can't see it, it can't kill it.
The Silent Observers
Spyware
Secretly monitors your browsing habits, history, and personal information to sell to advertisers or hackers.
Keylogger
A specific type of spyware that records every keystroke you type. Used to steal passwords and credit card numbers.
Botnet
A network of "Zombie" computers controlled by a single attacker (the Botmaster). Your computer could be a zombie right now and you wouldn't know it.
> C&C Server: ONLINE
Patient Zero Simulation Patient Zero Simulation
Unplugged Malware Propagation Lab
SESSION: MALWARE MUTINY MISSION TYPE: LIVE SIMULATION
Setup
Arrange students in a grid (rows and columns).
Each student is a Node .
Give each student a Node ID (e.g., 192.168.1.XX).
Select one student to be Patient Zero .
Threat Types
The Virus
Spread only via physical "Handshake". If you touch a neighbor, they are infected.
The Worm
Spread to everyone in your row automatically at the end of the round. (Network-based).
The Trojan
You must trick a node. Ask: "Want a free game?" If they say Yes, they are infected.
Infection Log
NETWORK SEGMENT NAME
SIMULATION LEAD
ROUND THREAT TYPE NEWLY INFECTED (NODE IDs) TOTAL DOWN 1 2 3 4 5
Post-Incident Report
Briefly explain why the chosen malware type was either successful or contained.
Cyber Defense Tactics
How could the network have stopped these threats?
Firewall: Blocks "Worm" propagation between rows.User Training: Stops "Trojans" (No one says 'Yes' to the game).Air-Gapping: Stops "Viruses" (Nodes stay 6ft apart).
// Simulation Rules
> IF (malware == 'rootkit') THEN persistence = TRUE;
> Rootkits cannot be removed by basic scan.
> Ransomware ends simulation for that Node (Files Locked).
-- END OF PROTOCOL --
Log Hunter Challenge SOC ANALYST CHALLENGE
CASE #99-X // INCIDENT RESPONSE TEAM
SYSTEM STATUS: COMPROMISED
LEVEL: 12TH GRADE CYBERSECURITY
MISSION BRIEFING:
Analyze the following log snippets from the corporate network. Identify which type of malware is active in each scenario. Use the "Behavioral Indicators" learned in the Threat Matrix to justify your findings.
INCIDENT LOG 001: SYSTEM_SERVICE_MONITOR
[14:02:11] ALERT: Unidentified kernel module loaded: "sys_hide_v3.ko"
[14:02:15] WARNING: Process ID #402 deleted from Task Manager visible list.
[14:02:20] SYSTEM: 40,293 files reporting "Hidden" attribute changed by SYSTEM user.
[14:02:22] CRITICAL: Antivirus scan requested, but service "AV_Agent" failed to start (Access Denied).
MALWARE TYPE:
PRIMARY EVIDENCE:
INCIDENT LOG 002: FIREWALL_OUTBOUND_TRAFFIC
[02:00:00] TRAFFIC: Outbound connection established to 104.22.31.201 [Port 8080]
[02:00:15] TRAFFIC: Sent 5,000 packets (SYN) to target target-server.gov in 0.5s
[02:00:30] TRAFFIC: Received encrypted command: "EXECUTE_FLOOD_PROTOCOL"
[02:01:00] ALERT: 14 other machines on local subnet establishing identical connections.
MALWARE TYPE:
PRIMARY EVIDENCE:
INCIDENT LOG 003: FILE_SYSTEM_AUDIT
[11:45:01] FILE_MOD: C:\Users\Finance\Budget_2026.xlsx -> Budget_2026.xlsx.ENC_KEY_09
[11:45:02] FILE_MOD: C:\Users\Finance\Payroll.csv -> Payroll.csv.ENC_KEY_09
[11:45:05] ALERT: Desktop background changed to "README_RESTORE_FILES.txt"
[11:45:10] NOTIFY: VSS (Volume Shadow Copies) deleted by process "untrusted_sys.exe"
MALWARE TYPE:
PRIMARY EVIDENCE:
INCIDENT LOG 004: BROWSER_EXT_MONITOR
[09:12:33] REGISTRY_CHANGE: Default_Search_Provider changed to "secure-look-up.biz"
[09:12:45] WARNING: Extension "Coupon_Finder_v2" installed without user prompt.
[09:13:00] REDIRECT: User attempted "google.com" -> Redirected to "ad-portal-77.ru"
[09:13:10] UI_ALERT: Multiple pop-up windows spawned (24 instances).
MALWARE TYPE:
PRIMARY EVIDENCE:
ANALYST NAME: _________________________
DATE: 2026-02-27
CLEARANCE: TOP SECRET
Log Hunter Answer Key Log Hunter Key
Teacher Reference • Internal Use Only
SEC_LEVEL: ALPHA
1
Incident Log 001: Rootkit
Key Indicators
"Kernel module loaded" (System level access)
"Deleted from Task Manager" (Self-hiding)
"AV_Agent failed to start" (Disabling security)
Analyst Notes
Rootkits are distinctive because they hide below the OS level. The fact that the process disappeared from Task Manager but is still modifying files is the "smoking gun."
2
Incident Log 002: Botnet / DDoS
Key Indicators
"Encrypted command: EXECUTE_FLOOD"
"Outbound SYN packets" (Traffic flooding)
"Identical connections on subnet" (Swarm behavior)
Analyst Notes
The "Command & Control" (C&C) communication and the coordinated action of multiple machines indicate a Botnet. The SYN packets identify the payload as a DDoS attack.
3
Incident Log 003: Ransomware
Key Indicators
File extensions changed to ".ENC_KEY"
"README_RESTORE_FILES.txt" (Ransom note)
"Volume Shadow Copies deleted" (Preventing easy recovery)
Analyst Notes
Mass encryption of personal files followed by a text file instruction is the classic Ransomware signature. Deleting Shadow Copies is a common tactic to force the victim to pay.
4
Incident Log 004: Hijackware
Key Indicators
"Default_Search_Provider changed"
"Unprompted extension install"
"Redirected from google.com"
Analyst Notes
Unlike more destructive malware, Hijackware's goal is to control the user's web experience for ad revenue or phishing. Redirection and browser setting modification are the primary behaviors.
Scoring Rubric Suggestions
Mastery (4/4)
Correctly identifies all 4 malware types and links specific log lines to behavioral definitions.
Proficient (3/4)
Correctly identifies 3-4 types but may have vague justifications or miss one key indicator.
Developing (2/4)
Identifies 1-2 types. Struggles to distinguish between Rootkit and Ransomware.
Malware Matching Worksheet Signature Match
Threat Identification Protocol // Module 4.2
Analyst:
Date:
INSTRUCTIONS: Below are 12 behavioral profiles observed in the field. Match the correct Malware Type from the Code Bank to its corresponding Payload/Behavior . Write the letter of the correct malware type in the space provided.
[A] Virus
[E] Ransomware
[I] Spyware
[B] Worm
[F] Rootkit
[J] Keylogger
[C] Trojan Horse
[G] Wiper
[K] Botnet
[D] Backdoor
[H] Hijackware
[L] DDoS Attack
Profile 01: Disguises itself as helpful software (like a media player) but delivers a malicious payload once installed.
Profile 02: A destructive attack that overwrites or deletes the Master Boot Record, making recovery impossible.
Profile 03: Secretly records every button pressed on the keyboard to capture credentials and passwords.
Profile 04: Self-replicating malware that spreads across network connections without requiring any human interaction.
Profile 05: Encrypts user data and demands a cryptocurrency payment in exchange for a decryption key.
Profile 06: Takes over browser settings, changing search engines and redirecting the user to unintended sites.
Profile 07: A hidden point of entry into a system that bypasses standard authentication protocols for future access.
Profile 08: Requires a host file and human action (like opening an attachment) to activate and replicate.
Profile 09: Deeply embedded malware that hides its own presence by modifying the operating system's kernel.
Profile 10: A collection of infected "zombie" computers controlled by a central Command & Control server.
Profile 11: Monitors and collects information about a user's browsing habits and personal data without consent.
Profile 12: An event where multiple systems flood a target server with traffic until it becomes unreachable.
VERIFIED THREAT DATASET 4.2
CYBERSECURITY FUNDAMENTALS // GRADE 12
Malware Matching Answer Key Matching Key
Signature Match // Facilitator Guide
VERSION: 1.0_FINAL
01
[C] Trojan Horse
Disguise as legitimate software
02
[G] Wiper
Destructive; deletes/overwrites MBR
03
[J] Keylogger
Records individual keystrokes
04
[B] Worm
Self-replicating; network spread
05
[E] Ransomware
Encrypts data for payment
06
[H] Hijackware
Takes control of browser settings
07
[D] Backdoor
Hidden entry bypasses authentication
08
[A] Virus
Requires host and human action
09
[F] Rootkit
Hides in the OS kernel
10
[K] Botnet
Network of controlled "zombie" computers
11
[I] Spyware
Monitors habits and collects data
12
[L] DDoS Attack
Traffic flood to crash target servers
Teaching Tip: Delivery vs. Payload
Remind students that these categories often overlap. For example, a Trojan [C] is a delivery method that might carry Ransomware [E] as its payload. A Worm [B] is a propagation method that might be used to build a Botnet [K] . Encourage them to think about "How does it move?" vs. "What does it do when it gets there?"
© 2026 Cybersecurity Education Division // Case File: Malware Mutiny
Gatekeeper Protocol Lesson Plan Gatekeeper Protocol
Teacher Facilitation Guide • Grade 12 Cybersecurity
Mission Objectives
Define the function of a firewall as a policy-based network filter.
Distinguish between Stateless and Stateful packet inspection.
Identify the purpose and security implications of Ports 20, 21 (FTP), 80 (HTTP), and 443 (HTTPS).
Configure simulated firewall rules (ALLOW/DENY) based on traffic requirements.
Lesson Timeline (90 Minutes)
00-15m
The Great Wall Discussion
Hook: "If you were a bouncer at a club, what information do you check before letting someone in?" Bridge to IP addresses and port numbers.
15-40m
Port Patrol Briefing (Slides)
Instruction on 20/21 (FTP - insecure), 80 (Cleartext web), and 443 (Secure web). Explain how firewalls use these to make decisions.
40-70m
Hands-On: Packet Filter Lab
Students receive a set of "Inbound/Outbound Traffic Requests" and must write firewall rules to maintain security while allowing business operations.
70-90m
The Zero-Trust Debrief
Discussion: Why is "Default Deny" the gold standard? Why do we still use port 80 at all in 2026?
Essential Tech Specs
ACL
Access Control List - The "Rulebook" for the firewall.
Ingress / Egress
Traffic coming in vs traffic going out .
TCP Handshake
Critical for understanding stateful inspection (SYN -> SYN/ACK -> ACK).
Required Materials
Port Patrol Slides
Packet Filter Activity Sheet
Firewall Logic Answer Key
Critical Thinking Prompts
"If a port is 'Open', does that mean a computer is infected? What is the risk of an open port 21?"
Focus: Attack surface reduction vs. business requirements.
"Should a company allow traffic on Port 80 if they have Port 443 configured? Why or why not?"
Focus: Redirection (HSTS) vs. legacy system compatibility.
"Why is FTP (Ports 20/21) considered a 'dead protocol' in modern secure environments?"
Focus: Cleartext credentials and the evolution to SFTP/SCP.
"If your firewall blocks Port 80, but a user changes a web server to listen on Port 81, will the traffic pass? How do we stop this?"
Focus: Port-based filtering vs. Next-Gen Firewalls (Layer 7).
Network Defense • Module 5: Firewalls • Facilitator Reference
Port Patrol Slides Port Patrol
GATEKEEPER PROTOCOL v1.0
Firewall Logic Traffic Control
The Network Bouncer
A firewall is a Security Guard for your network.
"It inspects every packet of data trying to enter or leave the system."
The "Checklist":
1 Source IP Address
2 Destination IP Address
3 Port Number
4 Protocol (TCP/UDP)
Packet Inspection
Stateless
Treats every packet as an individual. It doesn't remember previous traffic.
// Very fast, but easy to trick.
Stateful
Tracks the "state" of connections. It remembers the 3-way TCP handshake.
// If the connection wasn't requested, it's blocked.
Ports 20 & 21
FTP: File Transfer Protocol
The "legacy" way to move files between computers.
Port 21: Control (The handshake)Port 20: Data (The file transfer)
The Security Risk:
"FTP sends usernames and passwords in Cleartext . Anyone sniffing the network can steal your credentials instantly."
Port 80
HTTP: Hypertext Transfer Protocol
The standard for unencrypted web traffic.
Used for basic browsing and non-sensitive information.
Modern Usage:
Usually used just to Redirect users to a secure connection (Port 443).
Port 443
HTTPS: HTTP Secure
Web traffic encrypted via SSL/TLS .
"Protects data in transit from being read by attackers."
The Gold Standard
Mandatory for logins, banking, and modern apps.
ACL Actions
Allow
Let the packet through to its destination.
Deny
Blocks the packet and sends an ICMP error message back to the sender.
Drop
Silently discards the packet. The sender gets No Response .
The Golden Rule
Implicit Deny
"If a packet isn't explicitly allowed by a rule, it is automatically blocked."
Start Secure. Open only what is necessary.
Firewall Logic Activity Sheet Firewall Logic Lab
Operation: Gatekeeper Protocol
ANALYST:
TIMESTAMP:
Network Briefing
You are the lead network security engineer for CyberDyne Systems . Your mission is to configure the Access Control List (ACL) to secure the perimeter.
LAN Segment: 192.168.1.0/24
Web Server: 10.0.0.50
FTP Server: 10.0.0.100
Rule Syntax Guide
[ACTION] [SOURCE] [DEST] [PORT]
ALLOW: Permit traffic.DENY: Block + Notify sender.DROP: Block + Silent discard.ANY: Wildcard for any value.
Traffic Configuration Tasks
Task 1: Secure Browsing
Configure a rule that allows all internal users (ANY) to access secure websites on the internet (ANY) using encrypted traffic.
Action
Source
Dest
Port
Task 2: Block Insecure Web
The company policy forbids unencrypted browsing. Silently discard all traffic from any source attempting to use standard HTTP.
Action
Source
Dest
Port
Task 3: Legacy File Transfer
A legacy partner requires file uploads. Allow the Partner IP (203.0.113.5) to access the FTP Server (10.0.0.100) . Hint: FTP requires two ports!
Action
Source
Dest
Port
Action
Source
Dest
Port
Security Analysis
Q1: Based on Task 3, why is allowing FTP a significant security risk, even if you restrict it to a specific Partner IP?
Q2: Your last rule in any firewall is always "DROP ANY ANY ANY". Why is this "Implicit Deny" crucial for zero-trust security?
System ID: GATEKEEPER-FW-01 // Integrity: VERIFIED
Firewall Logic Answer Key ACL Key
Packet Filter Lab // Facilitator Guide
STATUS: AUTHORIZED
Task 1: Secure Browsing
ALLOW
ANY
ANY
443
HTTPS (Port 443) is the required port for secure, encrypted web traffic.
Task 2: Block Insecure Web
DROP
ANY
ANY
80
Port 80 is used for unencrypted HTTP. "DROP" is preferred over "DENY" here to silently discard packets and avoid giving information back to a potential scanner.
Task 3: Legacy File Transfer
ALLOW
203.0.113.5
10.0.0.100
21
ALLOW
203.0.113.5
10.0.0.100
20
FTP is dual-port. Port 21 is for Control (commands) and Port 20 is for Data (the actual file content).
Analysis Answer Guide
Question 1 (FTP Risks)
FTP is inherently insecure because it sends credentials in cleartext . An attacker performing a Man-in-the-Middle (MitM) attack or sniffing the network can capture the password easily. Modern alternatives like SFTP (Port 22) should be used instead.
Question 2 (Implicit Deny)
Implicit Deny follows the principle of Least Privilege . It ensures that the network is "secure by default." If a port or service isn't specifically authorized, it doesn't get in. This prevents "shadow IT" and forgotten services from becoming attack vectors.
© 2026 Cybersecurity Education Division // Gatekeeper Protocol Module
Gatekeeper Quiz Gatekeeper Quiz
Level 1: Network Traffic Analysis
Analyst:
Date:
Part 1: Multiple Choice
1. Which port is primarily used for the "Control" channel in an FTP session, where commands and handshakes occur?
A) Port 20
B) Port 21
C) Port 22
D) Port 80
2. A "Stateful" firewall differs from a "Stateless" firewall because it:
A) Inspects packets based only on the individual header information.
B) Blocks all traffic on Port 80 by default.
C) Tracks the 3-way TCP handshake and ensures traffic was requested.
D) Operates only on the Physical Layer of the OSI model.
3. When a firewall "DROPS" a packet, what happens from the perspective of the sender?
A) They receive an ICMP "Destination Unreachable" message.
B) The connection is redirected to Port 443 automatically.
C) They receive no response and the connection eventually times out.
D) The packet is held in a buffer for later inspection.
4. Which port must be open to allow encrypted web traffic (HTTPS)?
20
21
80
443
Part 2: Security Scenarios
Scenario A: The Redirect
A company wants to ensure all employees use encrypted browsing. They have configured their web servers to listen on Port 443. However, many employees still type URLs without "https://". How should the firewall admin handle Port 80 traffic to balance security and usability?
Scenario B: Implicit Deny
Explain why placing a "DENY ANY ANY ANY" rule at the top of an Access Control List would be a catastrophic mistake for a network administrator.
Scenario C: Cleartext Capture
An analyst detects traffic on Port 21. What specific piece of sensitive information is likely being transmitted in cleartext, and why is this a risk?
OFFICIAL GATEKEEPER ASSESSMENT // SECURE-UNIT-05
CYBERSECURITY // GRADE 12
Gatekeeper Quiz Answer Key Quiz Key
Gatekeeper Assessment // Facilitator Guide
SEC_LEVEL: ALPHA
Part 1: Multiple Choice Answers
Question 1 (FTP Control Port)
B) Port 21
Question 2 (Stateful vs Stateless)
C) Tracks the 3-way TCP handshake
Question 3 (DROP Packet Behavior)
C) No response / eventual timeout
Question 4 (HTTPS Port)
443
Part 2: Scenario Sample Responses
Scenario A: The Redirect
"The admin should allow traffic on Port 80 but configure the web server to immediately perform a 301 Redirect to the HTTPS version of the site on Port 443. Alternatively, the firewall can be configured to block Port 80 while the company uses HSTS (HTTP Strict Transport Security) to force browsers to use 443."
Scenario B: Implicit Deny Placement
"Firewalls process rules from top to bottom. If a 'DENY ANY ANY ANY' rule is at the top, it will block every single packet before it reaches the 'ALLOW' rules lower down. This would effectively disconnect the entire network from the internet and all internal services."
Scenario C: Cleartext Capture
"The sensitive information being transmitted is the user's login credentials (username and password). Because Port 21 is unencrypted FTP, an attacker can use a protocol analyzer (like Wireshark) to read the password in plain text, potentially gaining access to the entire file server."
© 2026 Cybersecurity Education Division // Official Key
