Interactive Simulation

Adversary Kill-Chain Simulation

Choose a threat actor, deploy your controls, then watch the adversary bypass them - or learn why they fail.

Prepare· Select
→
Defend
→
Respond & Debrief

Stage 0 · Select Adversary

Choose your threat actor

Each adversary runs a distinct 11-phase kill chain. Difficulty is ranked by how few phases the Essential Eight (ML3) can block - harder actors need advanced controls to defeat.

MITRE ATT&CK® technique IDs and adversary TTPs are drawn from public threat-intelligence reporting for educational simulation. Each actor's kill chain is a representative model, not a live indicator feed. APT 299 / Belligerent Samoyed is a constructed profile, not an observed actor - its assumptions are stated on the debrief.

Case studyVolt Typhoon · Silent Train

Silent Train: the relay chain the Essential Eight never sees

Before touching a victim, Volt Typhoon staged access through cloud relays and compromised small-office routers. Each hop was reached with credentials taken from the hop before it, so the intrusion arrived as an ordinary HTTPS session from a domestic residential address - and produced nothing for endpoint controls to detect.

Non-U.S. infrastructureOperator staging and cloud relays
01
Volt Typhoon
State-sponsored operator
Operator tasking
02
UCloud
Cloud VPS - relay
SSH/22SSH/8236
03
Alibaba Cloud
Cloud VPS - relay
HTTPS/443SSH/2222
04
TP-LINK WR*
End-of-life SOHO router
Relay boundary
HTTPS/8443SSH/2222
U.S. infrastructureCompromised residential routers and target edge
05
Netgear Orbi*
Residential router - relay node
HTTPS/10443
06
FortiGate
SSL-VPN appliance
Credential and session reuse
07
Victim
Target environment
  • TP-LINK WR* calls back to Alibaba Cloud over HTTP/8281 for tasking, so no inbound session has to stay open.
  • Every hop after the routers is reached with credentials recovered from the previous device - no malware is dropped, so nothing is quarantined or signatured.
  • Compromised residential routers give the operator U.S. egress addresses, so victim-side logs show domestic, consumer ISP traffic.

How the chain defeats each Essential Eight mitigation

Patch applicationsDefeatedHops 3-5This is where the chain actually breaks in. Internet-facing VPN appliances and end-of-life SOHO routers sat on unpatched, vendor-abandoned firmware. A 48-hour internet-facing patch SLA only protects assets on the register and still supported - consumer routers and forgotten edge kit are neither.
Restrict administrative privilegesBypassedHops 3-6The privileged accounts in play are appliance administrators on routers and firewalls, which normally sit outside PAM, jump hosts and the tiered admin model. Recovered device credentials were then reused hop to hop, so each new device inherited standing privilege the tier model never saw.
Multi-factor authenticationBypassedHops 4-6MFA gates application logins, not appliance management planes, SSH keys or pre-authentication VPN endpoints. Traffic arriving from the residential relay network also looked domestic and benign, so geo and behaviour scoring raised nothing to challenge.
Application controlNot engagedNot reachedAllow-listing governs what executes on workstations and servers. The chain runs in firmware and with native admin utilities on network devices, and nothing is installed on a managed endpoint for the control to judge.
Patch operating systemsNot engagedNot reachedEmbedded appliance firmware is not an operating system image in a patch pipeline. End-of-life routers receive no vendor updates at all, and appliance OS updates are usually change-managed separately, if at all.
Restrict Office macrosNot engagedNot reachedNo phishing, attachment or document stage exists. The intrusion never passes through email, Office or a user's decision, so macro policy has nothing to act on.
User application hardeningNot engagedNot reachedBrowsers and document readers on user endpoints are not on the path. The HTTPS sessions hit appliance admin and SSL-VPN portals programmatically, so endpoint browser hardening never applies.
Regular backupsImpact onlyAfter the chainBackups change the consequence of a disruptive follow-on action, not the intrusion. They do not detect a quiet, credential-driven foothold, and only help if they are offline or immutable and excluded from the same credential set.
Five of the eight controls never see this chain

Patch applications and restrict administrative privileges are the only Essential Eight mitigations that touch the Silent Train path, and both were defeated at the network edge. Application control, macros, application hardening, OS patching and MFA all govern assets the operator never needed to touch. Backups change what a disruption costs, not whether the foothold exists.

  • -The Essential Eight is endpoint and identity centric - it assumes the fight happens on managed workstations, servers and logins.
  • -Edge and consumer-grade network devices are frequently outside the asset register, the patch pipeline and privileged access management, which is exactly why they were chosen.
  • -Nothing in the Essential Eight is a detection control. An intrusion built on valid credentials, native tools and domestic residential egress has no signature to trip.

Chain reconstruction from Black Lotus Labs (Lumen) Silent Train reporting and the ASD-led joint advisory on Volt Typhoon (AA24-038A). Router models are anonymised as published. Mapped against the ACSC Essential Eight mitigations; illustrative for training, not a statement of any single victim's defensive posture.

Source: public threat-intelligence reporting · MITRE ATT&CK® is a registered trademark of The MITRE Corporation · Educational simulation