Introducing Threat-eX™
6-month program of Live Webinars and CYBER RANGES cyberdrill-grade, simulation-based exercises
Threat-eX™ helps you and your team commit to ongoing, demonstrable, security and risk mitigation improvements as well as professional transformation, utilizing regular cyber-drills delivered on CYBER RANGES' world-class cyber range.
Best-In-Class Threat Emulation Experiences by CYBER RANGES
GARTNER (2024): The importance and criticality of training with "live ammunition" or simulated "live ammunition" cannot be over-emphasized.
'Meet The Drill Masters' On-Demand Webinar
Stay ahead of evolving threats against your critical infrastructure
Achieve an affordable balance between scalable solutions and personalized training
Focus on actionable outcomes
Adapt to the constant evolution of the global threat landscape
Threat-eX™ focuses on demonstrable, measurable cybersecurity practitioner abilities immediately employable in the Incident Response Room.
Threat-eX™ offers you:
Cloud-based access to Cyber Threat Intelligence (CTI)-informed and Advanced Persistent Threat (APT)-focused scenarios designed for immediate use in training and exercise programs for blue, red and purple teams.
Scenarios with live and after-action assessments.
Role-mapped, pre-exercise training content.
A wrap-up and hot-wash session after each exercise.
Post-event performance reports (individual and team).
Actionable insights.
Personal certificates of completion, digital badges, and CPE credits.
Evidence of participation in support of your organization’s compliance requirements.
Who would benefit from using Threat-eX™
Security leaders seeking to understand their organization’s potential threat exposure and attack surface, and how to effectively manage these risks.
Individuals aiming to hone their skills or gain a deeper understanding of the advanced persistent threat (APT) landscape.
Technical and cybersecurity teams (such as SOC, CERT, IR, DFIR) and their managers.
Organizations with large or multiple teams.
Critical industries requiring robust cybersecurity measures.
Governmental agencies, military, and non-governmental organizations (NGOs).
The Threat-eX™ schedule for 2025
This is the Calendar of Events for your Cyber Defense Team to join:
Wizard Spider
Past Event (new date coming)
Threat Actor
Wizard Spider
Threat Type
Ransomware
Attacker Tools
Ryuk , Emotet
Threat Rating
High
Threat Impact
Data Exfiltration Service Availability
Difficulty
Hard
MITRE ATT&CK® TTPs Covered:
– Acquire Infrastructure: Server – T1583.004
– Develop Capabilities – T1587
– Phishing: Spearphishing Attachment – T1566.001
– User Execution – T1204
– Defense Evasion – TA0005
– Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – T1547.001
– Process Discovery – T1057
– Gather Victim Host Information – T1592
– Compromise Client Software Binary – T1554
– Password Policy Discovery – T1201
– Account Discovery: Domain Account – T1087.002
– Remote System Discovery – T1018
– Valid Accounts: Local Accounts – T1078
– Windows Management Instrumentation – T1047
– Steal or Forge Kerberos Tickets – T1558
– OS Credential Dumping – T1003
– Compromise infrastructure – T1584
– Exfiltration Over C2 Channel – T1041
– Data Encrypted for Impact- T1486
Ransomware Rampage
Past Event (new date coming)
Threat Actor
LockBit
Threat Type
Ransomware
Attacker Tools
Custom Ransomware
Threat Rating
High
Threat Impact
Data Exfiltration Service Availability
Difficulty
Intermediate
MITRE ATT&CK® TTPs Covered:
– Active Scanning – T1595
– Brute Force – T1110
– Gather Victim Identity Information – T1589
– Command and Scripting Interpreter – T1059
– OS Credential Dumping – T1003
– System Owner User Discovery – T1033
– Remote System Discovery – T1018
– Permission Groups Discovery – T1069
– Valid Accounts: Local Accounts – T1078
– Valid Accounts: Domain Accounts – T1078.002
– Exploitation for Privilege Escalation – T1068
– Compromise infrastructure – T1586
– Archive Collected Data – T1560
– Data Encrypted for Impact – T1486
Atom Silo
Past Event (new date coming)
After a network configuration change, an application endpoint is exposed to the internet. Attackers successfully exploits a vulnerability on the exposed endpoint and gain code execution. They are able to bring additional malware on to the target and establish C2 communication. The attackers then proceed to perform post-exploitation procedures to gain privileges and move laterally accross various infrastructures on the organization’s internal networks. Once they have achieved the escalation objective, they proceed to deploy ransomware across the workstations of the network.
Your task is to unravel the intricate web of deception enabling the adversary’s infiltration.
Threat Actor
Atom Silo
Threat Type
Ransomware
Attacker Tools
Atom Silo Ransomware
Threat Rating
High
Threat Impact
Data Exfiltration
Difficulty
Intermediate
MITRE ATT&CK® TTPs Covered:
– Active Scanning – T1595
– Exploitation of Remote Services – T1210
– Valid Accounts: Domain Accounts – T1078.002
– Deploy Container – T1610
– Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – T1547.001
– Exfiltration Over C2 Channel – T1041
– Impair Defenses: Disable or Modify Tools – T1562.001
Silverthorn
Power Plant Attack
An attacker successfully sends a phishing mail with link to a backdoored putty setup to a user. The user downloads and runs the backdoored putty file and the attacker manages to gain code execution on the server and establish C2 comms. The attacker can run various commands and enumerate various information on the workstation. The attacker was able to get the IP address, perform keylogging (capturing user credentials), list shares in the network, list running processes, list contents of the shares, exfiltrate contents in the shares, and retrieve browser history. Your task is to unravel the intricate web of deception enabling the adversary’s infiltration.
Threat Actor
Lazarus Group
Threat Type
Ransomware
Attacker Tools
Dtrack
Threat Rating
High
Threat Impact
Data Exfiltration
Difficulty
Easy
MITRE ATT&CK® TTPs Covered:
– Develop Capabilities: Malware – T1587.001
– Phishing: Spearphishing Attachment – T1566.001
– User Execution: Malicious File – T1204.002
– Gather Victim Host Information – T1592
– Gather Victim Network Information – T1590
– Account Discovery: Domain Account – T1087.002
– Data Encrypted for Impact – T1486
– Abuse Elevation Control Mechanism: Bypass User Account Control – T1548.002
– Access Token Manipulation – T1134
– Command and Scripting Interpreter: Windows Command Shell – T1059.003
– Inhibit System Recovery – T1490
Attacker in the Middle
Threat Actor
Lazarus Group
Threat Type
Ransomware
Attacker Tools
Proxy Mail Server
Wannacry
Threat Rating
High
Threat Impact
Data Exfiltration Service Availability
Difficulty
Hard
MITRE ATT&CK® TTPs Covered:
– Proxy – T1090
– User Execution: Malicious Link – T1204.001
– Browser Session Hijacking – T1185
– Account Discovery – T1087
– Remote Access Software – T1219
– Boot or Logon Autostart Execution – T1547
– Hijack Execution Flow: DLL Side-Loading – T1574.002
– Active Scanning – T1595
– External Proxy – T1090.002
– Bidirectional Communication – T1102.002
– Ingress Tool Transfer – T1105
– Input Capture: Keylogging – T1056.001
– Exploitation of Remote Services – T1210
– Server Software Component: Webshell – T1505.003
– Account Discovery: Domain Account – T1087.002
– OS Credential Dumping – T1003
– Exfiltration Over C2 Channel – T1041
– Network Denial of Service – T1498
– Disk Wipe – T1561
– Data Encrypted for Impact – T1487
– Account Access Removal – T1531
Alloy Taurus
Threat Actor
Alloy Taurus
Threat Type
Ransomware
Attacker Tools
Cobalt Strike
Mimikatz
Threat Rating
High
Threat Impact
Money Theft Data Exfiltration
Difficulty
Hard
MITRE ATT&CK® TTPs Covered:
– Develop Capabilities – T1587
– Hijack Execution Flow: DLL Side-Loading, Sub-technique T1574.002
– Defense Evasion – TA0005
– Gather Victim Network Information – T1590
– Account Discovery: Domain Account – T1087.002
– Network Share Discovery – T1135
– Command and Scripting Interpreter: Windows Command Shell – T1059.003
– System Network Connections Discovery – T1049
– Exploitation for Privilege Escalation – T1068
– Steal or Forge Kerberos Tickets: Kerberoasting –
T1558.003
– OS Credential Dumping – T1003
– Exfiltration Over C2 Channel – T1041
– Archive Collected Data – T1560
– Data Destruction – T1485
– Data Encrypted for Impact – T1486
Impersonating IFA
Threat Actor
ChamelGang
Threat Type
Espionage
Attacker Tools
Sarwent
Threat Rating
Medium
Threat Impact
Data Exfiltration Service Availability
Difficulty
Intermediate
MITRE ATT&CK® TTPs Covered:
– Acquire Infrastructure: Server – T1583.004
– Develop Capabilities – T1587
– Phishing mail – T1566
– User Execution – T1204
– Compromise Client Software Binary – T1554
– Command and Scripting Interpreter: Windows Command Shell – T1059.003
– System Network Connections Discovery – T1049
– Input Capture: Keylogging – T1056.001
– Application Window Discovery – T1010
– Exfiltration Over C2 Channel – T1041
– Archive Collected Data – T10560
– Data Encrypted for Impact – T1486
Midnight Blizzard
Threat Actor
Midnight Blizzard
Threat Type
Ransomware
Attacker Tools
MalRDP
Threat Rating
High
Threat Impact
Data Exfiltration Service Availability
Difficulty
Intermediate
MITRE ATT&CK® TTPs Covered:
– Acquire Infrastructure: Server – T1583.004
– Develop Capabilities – T1587
– Phishing: Spearphishing Attachment – T1566.001
– User Execution – T1204
– Hijack Execution Flow: DLL Side-Loading – T1574.002
– Create Account: Domain Account – T1136.002
– Valid Accounts: Domain Accounts – T1078.002
– OS Credential Dumping – T1003
– Steal or Forge Kerberos Tickets: Silver Ticket – T1558.002
– Application Window Discovery – T1010
– Exfiltration Over C2 Channel – T1041
– Use Alternate Authentication Material: Application Access Token – T1550.001
– Data Encrypted for Impact – T1486
Ragnar Locker
Threat Actor
FIN8
Threat Type
Ransomware
Attacker Tools
Ragnar Locker
Threat Rating
High
Threat Impact
Data Exfiltration Service Availability
Difficulty
Intermediate
MITRE ATT&CK® TTPs Covered:
– Acquire Infrastructure: Server – T1583.004
– Develop Capabilities – T1587
– Exploit Public-Facing Application – T1190
– Phishing mail – T1566
– User Execution – T1204
– Command and Scripting Interpreter: Windows Command Shell – T1059.003
– System Network Connections Discovery – T1049
– Brute Force – T1110
– OS Credential Dumping – T1003
– Exfiltration Over C2 Channel – T1041
– Archive Collected Data – T10560
– Data Encrypted for Impact – T1486
CYBER RANGES Threat-eX™ offers continuous enrolment throughout the year.
The Threat-eX™ series will restart in 2025 introducing new threat emulations along the way.
Developing Cybersecurity Muscle Memory and Organizational Resilience
Threat-eX™ addresses the missing link in traditional training by integrating comprehensive, hands-on exercises that build practical skills and improve resilience against Advanced Persistent Threats (APTs).
'Meet The Drill Masters' On-Demand Webinar
Your Drill Masters
Csaba Virág
Head of Cyber Exercies
Csaba leads Cyber Capability Development at CYBER RANGES. Csaba’s expertise is rooted in both the technical and operational sides of cybersecurity, yet he places a significant emphasis on the importance of a human-centric approach to security and digital transformation.
Csaba collaborates with international organizations such as the International Telecommunication Union (ITU), European Cyber Security Organisation (ECSO), European Commission, and European Union Agency for Cybersecurity (ENISA), European Defence Agency (EDA).
Previously, as the Chief Strategy Officer at Nortal Csaba guided the strategic vision and direction of cybersecurity solutions, delivering future-ready solutions to harvest the benefits of cybersecure ecosystems, environments, and businesses.
Amarjit 'Labu' Labhuram
Threat Emulation Lead
His role involves regular training and guiding stakeholders on effective detection, response, and mitigation strategies. He has built strong field practitioner experience in Red Team and Adversary Simulation operations, with offensive capability development. Labu has led on the technical exercises during several cyberdrills for financial and government entities.
Labu is particularly drawn to the intricacies of Microsoft Windows system programming and is actively engaged in research, including the crafting of custom implants and refining Tactics Techniques and Procedures (TTPs) for Simulated Attack missions.
Labu proudly holds such industry certifications as CRTE, SEC565 Red Team Operations and Adversary Emulation, and CRTO, as evidence of his expertise in the security field.
James Billingsley OSCP
Range Master
James has gained 20 years’ experience as an Examiner, Consultant, Trainer and Speaker in the InfoSec and DFIR fields. He has developed tools for Internet Browser forensics used globally by a number of law enforcement agencies and international corporations.
James has led PCI investigations for major payment providers including Visa and Mastercard. As a Senior eDiscovery consultant James supported legal eDiscovery reviews for complex global litigation issues hosted on leading vendor platforms.
A course author and lead trainer for internal & external training for leading DFIR software vendors, James has worked together with UN’s ITU on a number of ITU cyberdrills, supporting their effort to build knowledge and skills for national CIRTs.
Beyond Technology - The Human Element
👇 What's Included in Threat-eX™ 👇
Threat-eX™ focuses on demonstrable, measurable cybersecurity practitioner abilities that are at once employable in the Incident Response Room.
Cloud-based access to Cyber Threat Intelligence (CTI)-informed and Advanced Persistent Threat (APT)-focused scenarios designed for immediate use in training and exercise programs for blue, red and purple teams.
Scenarios with live and after-action assessments.
Role-mapped, pre-exercise training content.
A wrap-up and hot-wash session after each exercise.
Post-event performance reports (individual and team).
Actionable insights.
Personal certificates of completion, digital badges, and CPE credits.
Evidence of participation in support of your organization’s compliance requirements.
All-In-One
$6,000 per user
$25,000 per 5-pax team
– Access to all 6 events in the calendar
– Role-mapped, pre-exercise training content provided
– Post-event Performance Reports and Insights (team and users)
– Certificate of completion / Digital Badge / CPE credits
Want to learn more?
Ready to buy?
Flexi
– Flexible Access to up to 5 events in the calendar
– Date confirmation is required minimum 72 hours before each event
– Role-mapped, pre-exercise training content provided
– Post-event Performance Reports and Insights
– Certificate of completion / Digital Badge / CPE credits
Want to learn more?
Ready to buy?
Got questions?
