Siberian Hunt

Validate Tactical Readiness Using Doctrinal Military Standards.

Siberian Hunt is the first cyber warfare exercise designed to validate mission-readiness for high-stakes environments using doctrinal military standards.

Representing a fundamental shift in the cyber simulation market, from broad, enterprise-focused labs to deep, mission-authentic tactical edge defense.

Join a 5 Minute Webinar Overview

Webinar Host: Dr Cosimo Melella

Threat Hunter at NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)

Webinar Title:

Siberian Hunt: Validate Tactical Readiness Using Military Doctrine Standards

Combat-Ready Tactical Edge Defense

Deployed On-Demand (Not Weeks)

While the cybersecurity industry focuses on securing the corporate data center, the battlefield has moved to the tactical edge, where Starlink-connected systems, and combat control tablets and mobile devices are the primary targets of state-sponsored actors like Sandworm.

Beyond the Server Room : Mission-Critical Incident Containment

A combat control system relies on mobile tablets with a specialized application to coordinate its emergency response teams.

One of these tablets was lost and fell into the hands of an attacker. The device was not locked, allowing the attacker to extract VPN credentials and gain unauthorized access to the internal network.

Once inside, the attacker conducted network reconnaissance, identifying exposed services, including open ADB ports on other tablets.

Exploiting these vulnerabilities, the attacker gained full control over all devices,
exfiltrating sensitive and operational data from the internal combat control system server.

The security team has been alerted to unusual activity and must now respond, identify the extent of the breach, and implement measures to prevent further data leaks.

Siberian Hunt, v3

Why Siberian Hunt?

Mission-Authentic Fidelity

High-fidelity emulation of Sandworm malware strains (NETD, STL, TOR) on actual Android tactical tablets.

Doctrinal Accountability

100% alignment with military CYBER-DCO and MIG-OPNS task lists, providing audit-verifiable readiness metrics.

Operational Agility

High-fidelity, on-demand, browser-based deployment that runs in hours, not weeks, with persistent After-Action Review (AAR) visibility.

Download The Siberian Hunt Product Datasheet

PRACTICAL SKILLS DEVELOPMENT

Primary Objective

Identify the compromised VPN account and analyze the attacker’s access patterns.

A coordinated cyber operation designed to exploit a physical device loss and leverage
Android-based vulnerabilities to access and exfiltrate sensitive data from a military
control system.

Threat Type

Advanced Persistent Threat (APT)

Intent

Operational Disruption & Data Exfiltration

Style

Covert, Technically Sophisticated, Modular Cyber Warfare Exercise

(T&R-aligned, Mobile/Network Breach Lifecycle)

Level

Intermediate – realistic mobile-based compromise and internal network exploitation

Difficulty

Persistent, Mobile-Based, Multi-Stage Threat

INTERMEDIATE

Duration

(core DFIR), extendable to 1–3 days

4-8 Hours

Vector

Mobile / VPN / Destructive Vectors

Impact

CRITICAL

Key Emulated Threat Actions

Type	Emulated Threat Actions
Device Exploitation	Access via lost, unlocked Android tablet with stored VPN credentials
Network Breach	VPN used to infiltrate internal systems
Reconnaissance	Scanning for vulnerable services (e.g., ADB ports)
Privilege Gain	netd exploited for root access and persistence
Lateral Spread	ADB used to control peer tablets
Data Theft	Sensitive data exfiltrated via SOCKS/SSH tunnels
Credential Theft	Extraction of stored keys and passwords
Low Profile	Actions kept stealthy to avoid detection

Training Focus Areas

Focus	Training Areas
Strategic Incident Containment	Use ELK/Arkime to triage and isolate compromised systems
Adversary TTP Analysis	MITRE ATT&CK mapping (e.g., T1078, T1059, T1626, T1572)
Threat Hunting	Detect HTA/VBS artifacts, registry keys, scheduled tasks
User Awareness	Understand and prevent spearphishing success
Forensic Readiness	Extract IOCs from Android logs, VPN records, and malware samples
Countermeasures	Block lateral access, secure VPN infrastructure, and redeploy trusted configurations

Blue Team Operations

Tactical Operators (17XX/DFIR)

Advanced Tradecraft Training

Deep technical exploitation of mobile-specific vectors, including Android ADB ports, netd root escalation, and SOCKS/SSH tunnel exfiltration.

Certification & Outcomes

Direct engagement with real-world Sandworm TTPs, specifically the theft of Starlink-connected data (STL strain emulation).

Flexible Delivery

Access to a persistent “Wizard” mode and full technical stack (Ghidra, ELK, Proxmox), eliminating the “no solution” stall-out common in gamified platforms.

Unit Commander/CISO’s

Advanced Tradecraft Training

Quantifiable mission-readiness data mapped to Operational Task domains (DCO 65%, DODIN 25%, OCO 10%).

TCO Reduction

Significant reduction in Total Cost of Ownership (TCO) by eliminating the potential $160,000+/year internal maintenance overhead required by enterprise range mirrors.

Lost, Found, Comprimised

Immediate visibility into critical tactical vulnerabilities, such as the “Lost, Found, Compromised” lifecycle of unmanaged mobile hardware.

Training Officer/Exercise Planner

Doctrinal Mapping

T&R-aligned mission templates (CYBER-DCO-XXXX) that simplify exercise design and ensure doctrinal compliance.

Certification & Outcomes

Modular “Scenario Implementation” that allows for 4-8 hour core DFIR cycles or multi-day extended operations without platform latency.

AAR Continuity

Built-in AAR continuity that allows participants to review finished event materials without restarting the exercise from the beginning.

Mission and Objectives

Identify the compromised VPN account and analyze the attacker’s access patterns.

A coordinated cyber operation designed to exploit a physical device loss and leverage Android-based vulnerabilities to access and exfiltrate sensitive data from a military control system.

Doctrinal Backbone

MODULE	MISSION AREA	FOCUS
DCO	Defensive Cyberspace Operations	Detection, containment, response, resilience
DODIN	DOD Information Network Operations	Network architecture, VPN access control cyber hygiene, uptime
OCO	Offensive Cyberspace Operations	Adversary engagement, target exploitation

Emulation Structure – Doctrinal Mapping

OPERATIONAL TASK	DOCTRINAL MAPPING
Identify & dismantle adversary footholds	CYBER-OCO-3001, CYBER-OCO-5002
Defend critical infrastructure & networks	CYBER-DCO-3001, CYBER-DCO-5001
Contain & respond to destructive vectors	CYBER-DCO-3002, CYBER-DCO-6002, CYBER-DCO-7001
Execute coordinated cyber incident response	MIG-OPNS-8006, CYBER-DCO-6001
Restore trust in network & reimage affected devices	CYBER-DCO-4001, CYBER-DCO-5002
Disrupt persistence & C2 channels	CYBER-OCO-6001, CYBER-OCO-7001

Doctrinal Backbone

MODULE	MISSION AREA	FOCUS
DCO	Defensive Cyberspace Operations	Detection, containment, response, resilience
DODIN	DOD Information Network Operations	Network architecture, VPN access control cyber hygiene, uptime
OCO	Offensive Cyberspace Operations	Adversary engagement, target exploitation

Emulation Structure – Doctrinal Mapping

OPERATIONAL TASK	DOCTRINAL MAPPING
Identify & dismantle adversary footholds	CYBER-OCO-3001, CYBER-OCO-5002
Defend critical infrastructure & networks	CYBER-DCO-3001, CYBER-DCO-5001
Contain & respond to destructive vectors	CYBER-DCO-3002, CYBER-DCO-6002, CYBER-DCO-7001
Execute coordinated cyber incident response	MIG-OPNS-8006, CYBER-DCO-6001
Restore trust in network & reimage affected devices	CYBER-DCO-4001, CYBER-DCO-5002
Disrupt persistence & C2 channels	CYBER-OCO-6001, CYBER-OCO-7001

We can no longer afford the “Complexity Tax” of costly and massive enterprise mirrors.

To defend the tactical edge, we need agile, doctrinal readiness. It’s time to stop training for the office and start training for the mission.

Takeaways

Key Events

• Lateral movement
• Domain compromise
• Ransomware
• Wiper Attack

Technical Requirements

• Cyber Range
• Inject Engine
• ELK Stack
• Ghidra
• Proxmox
• Windows VMs

Expected Outcomes

• Threat Containment
• System Recovery
• C2 Reporting

Target Audience

Siberian Hunt is designed for:

Blue/Red Teamers
17XX Marines
DFIR Units
Planners
CDOC Ops

Recommended Experience

Intermediate to advanced knowledge of defensive security, Windows internals, Active Directory, and scripting is required.

Flexibile

Delivery Options

SaaS

National CERTs and Incident Response Teams

On-Premises

Military & Critical Enterprise Cyber Defense Units

Portable

NATO and Allied Defense Organizations

Practical Skills Development

How It Works

1

Purchase Access

Purchase Siberian Hunt access (see purchase options below)

2

Access Scenarios

Once purchased access the Siberian Hunt scenario and read each description and start the lab when ready

3

Self-Paced Learning

Progress through the scenario at your own speed

4

Measure & Improve

Review dashboards, refine skills

Purchase Options

Personal Access (Buy Now) or (Contact Us)

Register/login to the CYBER RANGES app and search in the Scenarios Side Menu for Siberian Hunt.

Team/Multi-User Access

Access Siberian Hunt as a team, simply contact us below to discuss your requirements.

On-Premises/Portable

If you require on-premise or portable access please speak to our sales team with your requirements.