Skip to content

The room is designed to test advanced endpoint investigation skills. It requires you to piece together a complete attack timeline by correlating artifacts from multiple sources.

Investigating DeceptiTech: A Guide to "The Last Trial" on TryHackMe

is a sophisticated incident response and digital forensics (DFIR) room on TryHackMe , serving as the final challenge in the Honeynet Collapse CTF series from 2025 . This room tasks players with helping "DeceptiTech," a cybersecurity firm whose entire network has collapsed due to a massive ransomware attack that encrypted systems and corrupted all backups.

: Building a narrative of how the attacker moved through the DeceptiTech network—from initial access to the final "Stage 6" collapse. Recommended Preparation

Before attempting "The Last Trial," it is highly recommended to complete earlier rooms in the module to understand the full context of the DeceptiTech breach:

Conduct memory forensics and log analysis to identify the threat actor's "Actions on Objectives". Walkthrough Highlights