Twelve substations sit in a ring around a control hub, each carrying a slice of a city's load. An intruder who has already pivoted into the SCADA network starts opening breakers one by one — modeled on the 2015 cyberattack on Ukraine's power grid, the first confirmed blackout caused deliberately by malware. A simultaneous denial-of-service against the utility's phones and alarms delays how fast the operator even learns a breaker has tripped, and once it's flagged, restoring it means dispatching a crew to close it by hand rather than trusting the compromised control panel. Tune the breach tempo, the detection delay, and the manual restoration time, then click tripped substations in the 3D scene to race the intruder and keep the ring's lights on.