The situation

For three weeks, an unidentified, state-aligned threat actor has been working its way into two organizations that span all three of our borders: Prut Interconnect, the transmission operator running the tie lines between Romania, Moldova and Ukraine, and Black Sea Commercial Bank, with branches in Bucharest, Chișinău and Odesa.

Feeders tripped at a border substation. Fraudulent payments left the bank. Rumors of a blackout and a bank run filled social media. Your team is a joint response cell: work out what happened, how, and who did it, then stop what comes next.

All organizations, people, accounts and infrastructure in this exercise are fictional.

Getting started

1. Log in with the username and password on your slip. Your team is already set up.
2. Open Challenges and start with Welcome to Prut.
3. Five challenges run in your team's private lab. Click Lab in the top menu to open it; your scoreboard login gets you in.

Schedule (Moldova time, EET)

Day 1, 11:15	Onboarding and Set 1: First contact
Day 1, 13:45	Set 2: Energy and Finance tracks
Day 2, 09:00	Set 3: Connecting the dots
Day 2, 10:50	Final round: Trident
Day 2, 13:30	Scoring, solution walkthrough and lessons learned

Rules

• Attack only the targets a challenge gives you, inside your own team's lab. This site and the lab login page are off limits.
• Flags look like RT{...} and are not case-sensitive.
• Hints cost points. Questions to a proctor about the platform are free.
• Don't share flags between teams. In the final round you'll need to share information, and that's allowed.
• Treat every file as hostile: analyze, don't execute.