Follow the connected 7-stage attack simulation targeting fictional company Apex Technologies and systems engineer Rahul Sharma. Each module demonstrates real-world threat mechanics and defense-in-depth countermeasures.
Adversaries rarely start with direct brute-force attacks. Instead, they gather Open Source Intelligence (OSINT) from legitimate public corporate materials—such as the Apex Technologies leadership bios, news releases, and job specifications.
Attackers craft spear-phishing lures that directly echo real business concerns. Because Rahul is leading the BioPrime project, an urgent notice regarding his BioPrime connector credentials feels authentic and critical.
@apex-internal-sso.com looks like Apex, but is registered externally.Open Rahul's simulated desktop to see the email in his corporate inbox and test both reporting to SOC vs following the link.
Open Rahul's Workstation Inbox ↗A common corporate misconception is that merely clicking an untrusted web link automatically gives an attacker full remote code execution on the computer.
Once Rahul's valid session token is captured, the threat actor does not need to compromise other computers. They simply replay his legitimate corporate session token across the internal network boundary to query the Apex Identity Provider and internal resources.
The adversary attempts to retrieve restricted corporate records (Executive Compensation and BioPrime Master Keys) from Apex SecureVault. We demonstrate what happens when server-side authorization is absent (BOLA) versus when strict Role-Based Access Control (RBAC) is enforced.
A single compromised systems engineer identity cascade-exposed Tier-3 board assets because authorization boundaries were client-side only. Enforcing server-side authorization limits blast radius strictly to the engineer's assigned scope.
To stop attacks of this nature, modern enterprises deploy a multi-layered defense-in-depth model addressing People, Identity, and Systems.
Hardware security keys tie authentication to the browser's origin, making typo-squatted phishing sites mathematically incapable of harvesting tokens.
Never trust client requests. Every sensitive endpoint must evaluate user roles and object ownership before returning confidential data.
Workstations on Subnet 10.240.14.0/24 should have no direct route to Restricted Vault nodes without explicit, monitored proxy authorization.