Stage 0 · Select Adversary
Choose your threat actor Each adversary runs a distinct 11-phase kill chain. Difficulty is ranked by how few phases the Essential Eight (ML3) can block - harder actors need advanced controls to defeat.
Sandworm Russia (GRU Unit 74455)
Russian GRU (Destructive) Manageable· #11
Motive Disruption & Destruction
Target Critical Infrastructure, OT/ICS, Government 7 blockable 1 partial 3 bypass 32/100
APT29 / Cozy Bear Russia (SVR)
Russian SVR (Espionage) Severe· #2
Motive Espionage & Intelligence
Target Government, Think Tanks, Cloud Tenants 3 blockable 2 partial 6 bypass 64/100
Lazarus Group / APT38 DPRK (Reconnaissance General Bureau)
DPRK State-Sponsored Manageable· #12
Motive Financial Theft & Espionage
Target Financial Institutions, Crypto Exchanges, Defence 7 blockable 1 partial 3 bypass 32/100
Engage Lazarus Group / APT38
APT28 / Fancy Bear Russia (GRU Unit 26165)
Russian GRU (Espionage) Moderate· #7
Motive Espionage & Intelligence
Target Government, Military, Energy, Media 5 blockable 2 partial 4 bypass 45/100
Engage APT28 / Fancy Bear
Volt Typhoon People's Republic of China
PRC State-Sponsored Extreme· #1
Motive Pre-positioning / Disruption
Target US Critical Infrastructure (power, water, comms) 0 blockable 3 partial 8 bypass 86/100
SALT Typhoon People's Republic of China
PRC State-Sponsored (Telecom) Moderate· #6
Motive Telecom Espionage & Intelligence
Target Telecom Carriers, ISP Infrastructure, Lawful-Intercept Systems 5 blockable 1 partial 5 bypass 50/100
Charming Kitten / APT35 Iran (IRGC-linked)
Iranian State-Sponsored Moderate· #5
Motive Espionage & Credential Theft
Target Think Tanks, Journalists, Academia, NGOs 4 blockable 1 partial 6 bypass 59/100
Engage Charming Kitten / APT35
ELECTRUM Dragos-tracked (links to Sandworm)
ICS Disruption Operator Moderate· #8
Motive Grid Disruption & Destruction
Target Electric Sector, ICS/OT 6 blockable 1 partial 4 bypass 41/100
KAMACITE Dragos-tracked (overlap with Sandworm)
ICS Access/Enabler Manageable· #13
Motive Pre-positioning & Access Enabling
Target Critical Infrastructure, ICS/OT, Electric Utilities 7 blockable 1 partial 3 bypass 32/100
FLAX Typhoon People's Republic of China
PRC State-Sponsored (Botnet) Moderate· #9
Motive Pre-positioning & Botnet Infrastructure
Target SOHO Routers, IoT Devices, Taiwan & Southeast Asia 6 blockable 1 partial 4 bypass 41/100
Brass Typhoon / Gleaming Pisces People's Republic of China
PRC State-Sponsored (SE Asia) Moderate· #10
Motive Espionage (Southeast Asia)
Target Government, NGOs, Media (Vietnam, Thailand, Philippines, Indonesia) 6 blockable 1 partial 4 bypass 41/100
Engage Brass Typhoon / Gleaming Pisces
BlackCat / ALPHV Russia-based (RaaS affiliates)
Ransomware-as-a-Service Manageable· #14
Target Healthcare, Education, Critical Infrastructure 7 blockable 1 partial 3 bypass 32/100
Scattered Spider / Octo Tempest English-speaking Cybercrime
Cybercrime (Social Engineering) Severe· #3
Motive Extortion & Financial Theft
Target Telecom, Crypto, Large Enterprises 3 blockable 2 partial 6 bypass 64/100
Engage Scattered Spider / Octo Tempest
Shiny Hunters Cybercrime (alleged French-Algerian operator)
Financially Motivated Severe· #4
Motive Data Theft & Extortion
Target Tech, E-commerce, Telecom (Microsoft, Tokopedia, AT&T) 3 blockable 2 partial 6 bypass 64/100
FIN7 / Carbanak Cybercrime (multi-national)
Financially Motivated Manageable· #15
Motive Financial Theft (POS Fraud)
Target Retail, Hospitality, Restaurants 7 blockable 1 partial 3 bypass 32/100
MITRE ATT&CK® technique IDs and adversary TTPs are drawn from public threat-intelligence reporting for educational simulation. Each actor's kill chain is a representative model, not a live indicator feed.