Every finding maps to an
offensive technique
and a defensive countermeasure.
// Every campaign opens with a written ATT&CK plan and closes with findings indexed against both ATT&CK techniques and D3FEND countermeasures. The matrix, the kill chain, the attack-path graph, and the deliverable artifacts below describe the engagement end to end.
The matrix.
// Click any technique tile to see the actors observed using it, the D3FEND countermeasures it maps to, and how the technique is replayed in your environment. Heatmap intensity weights by observed adversary frequency in 2024–2026 threat intelligence.
The groups we study.
// Each campaign emulates the actors most likely to target your sector. We rebuild their TTP chains from current threat intelligence and run them on your environment with their opsec, their dwell, and their tooling.
APT29
aka Cozy Bear / Midnight Blizzard
OAuth abuse, Golden SAML, living-off-cloud, subtle and patient C2.
APT28
aka Fancy Bear / Forest Blizzard
Credential phishing, Outlook exploits, router malware.
Volt Typhoon
aka Vanguard Panda
Living-off-the-land, SOHO router pivots, long dwell across critical infra.
Scattered Spider
aka UNC3944 / Octo Tempest
SIM swap, help-desk vishing, MFA fatigue, Okta abuse.
Lazarus
aka Hidden Cobra
Supply chain, 3CX / X_TRADER, fake recruiters, wipers.
Sandworm
aka Voodoo Bear / Seashell Blizzard
NotPetya, Industroyer, BlackEnergy. Destructive lineage.
FIN7
aka Carbanak / Sangria Tempest
POS malware, BadUSB, ransomware affiliate ops.
APT41
aka Wicked Panda / Brass Typhoon
Supply chain, 0-days, crypto theft, espionage plus crime.
A typical Day-1 timeline.
One attack path.
// Every engagement ships with BloodHound-style attack-path graphs. The sample below shows a tier-0 chain through ADCS template abuse, reconstructed from a recent engagement with all customer identifiers replaced.
What lands in your inbox.
// Every engagement ships seven artifacts. The board reads the executive narrative, the SOC reads the detection asks, the platform team reads the operator report, and the IR team gets the raw artifacts for tabletop and drill use.
Executive narrative
Plain English, board-ready, four pages max. One page per finding tier, one page on what changes if nothing is patched.
Operator report
Every finding with reproduction steps, evidence, ATT&CK technique, and a D3FEND-mapped fix. Indexed for triage.
Attack-path graphs
BloodHound-style, sanitized, owner-tagged. One graph per crown-jewel objective reached.
Detection asks
Sigma rules with Splunk SPL, Sentinel KQL, and Elastic ESQL translations, tuned against your data sources before handoff.
Retest window
Free retest within sixty days of patch on every finding, scoped to the original attack chain end to end.
Read-out call
Live walkthrough with your blue team, recorded for archive. Operator-led, slide-free.
Raw artifacts
Beacons, scripts, IOCs handed off for your IR drills, with a full chain-of-custody log of operator actions.