mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
121 lines
8.2 KiB
Markdown
121 lines
8.2 KiB
Markdown
# APTs Adversary Simulation
|
|
[]() []() []() []() []()
|
|
---
|
|
|
|
A comprehensive collection of simulated Advanced Persistent Threat (APT) attacks based on real world tactics, techniques, and procedures (TTPs) used by state sponsored APT Groups from `Russia, China, Iran, and North Korea`
|
|
|
|
<img width="1500" height="578" alt="hollywood-Comp-02" src="https://github.com/user-attachments/assets/72dc8468-35bc-403c-b0e5-28b8a7efb954" />
|
|
|
|
|
|
> [!CAUTION]
|
|
> **Important Notice**: This project is strictly for educational, research, and defensive security purposes only. Unauthorized use of these techniques may violate laws and result in serious legal consequences.
|
|
|
|
## 🧠 Overview
|
|
|
|
This repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom tools, command and control (C2) servers, backdoors, exploitation techniques, stagers, bootloaders, and other malicious artifacts that mirror those used in real world attacks. The simulations are based on extensive research from leading cybersecurity firms, including PaloAlto Unit42, Kaspersky, Microsoft, Cisco, Trellix, CrowdStrike, and WithSecure.
|
|
|
|
**Learn More About the Importance and Outcomes of the Experience:**
|
|
- [**Why Adversary Simulation?**](https://medium.com/@S3N4T0R/why-adversary-simulation-a1c69e8bd93a) - Understanding the strategic value of simulating advanced threats
|
|
- [**Adversary Simulation VS Adversary Emulation**](https://medium.com/@S3N4T0R/adversary-simulation-vs-adversary-emulation-381b920a12f6) - Key differences and when to use each approach
|
|
- [**How do I simulate an APT**](https://medium.com/@S3N4T0R/adversary-simulation-is-not-a-methodology-its-the-outcome-of-experience-4dfeafdba6da?postPublishedType=initial) - Adversary Simulation Is Not a Methodology It's the Outcome of Experience
|
|
|
|
## 🎯 Simulated APT Groups
|
|
|
|
The naming convention for APT groups follows CrowdStrike's taxonomy.
|
|
|
|
|
|
|
|
**Below is the complete list of simulated APT Groups:**
|
|
|
|
<div align="center">
|
|
|
|
<table>
|
|
<tr>
|
|
<th align="center"><strong>Country<br>of Origin</br></strong></th>
|
|
<th align="center">Russia 🇷🇺</th>
|
|
<th align="center">China 🇨🇳</th>
|
|
<th align="center">North Korea 🇰🇵</th>
|
|
<th align="center">Iran 🇮🇷</th>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><strong>APT Groups</strong></td>
|
|
<td align="center">
|
|
|
|
[**Cozy Bear ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Russian%20APT/APT29-Adversary-Simulation)<br>
|
|
[**Voodoo Bear ✅**](https://github.com/S3N4T0R-0X0/Voodoo-Bear-APT.git)<br>
|
|
[**Fancy Bear ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Russian%20APT/APT28-Adversary-Simulation)<br>
|
|
[**Energetic Bear ✅**](https://github.com/S3N4T0R-0X0/Energetic-Bear-APT.git)<br>
|
|
[**Berserk Bear ✅**](https://github.com/S3N4T0R-0X0/Berserk-Bear-APT.git)<br>
|
|
[**Gossamer Bear ✅**](https://github.com/S3N4T0R-0X0/Gossamer-Bear-APT.git)<br>
|
|
[**Primitive Bear ✅**](https://github.com/S3N4T0R-0X0/Primitive-Bear-APT.git)<br>
|
|
[**Ember Bear ✅**](https://github.com/S3N4T0R-0X0/Ember-Bear-APT.git)<br>
|
|
[**Venomous Bear ✅**](https://github.com/S3N4T0R-0X0/Venomous-Bear-APT.git)
|
|
|
|
</td>
|
|
<td align="center">
|
|
|
|
[**Mustang Panda ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Mustang%20Panda)<br>
|
|
[Glacial Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Glacial-Panda)<br>
|
|
[**Wicked Panda ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Wicked%20Panda)<br>
|
|
[Goblin Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Goblin-Panda)<br>
|
|
[Anchor Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Anchor-Panda)<br>
|
|
[Deep Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Deep-Panda)<br>
|
|
[Samurai Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Samurai-Panda)<br>
|
|
[Phantom Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Phantom-Panda)<br>
|
|
[Sunrise Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Sunrise-Panda)<br>
|
|
[Ethereal Panda](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Chinese%20APT/Ethereal-Panda)
|
|
|
|
</td>
|
|
<td align="center">
|
|
|
|
[**Labyrinth Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Labyrinth%20Chollima)<br>
|
|
[**Velvet Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Velvet%20Chollima)<br>
|
|
[**Famous Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Famous%20Chollima)<br>
|
|
[**Stardust Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Stardust%20Chollima)<br>
|
|
[**Ricochet Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Ricochet%20Chollima)<br>
|
|
[**Silent Chollima ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/North%20Koreans%20APT/Silent%20Chollima)
|
|
|
|
</td>
|
|
<td align="center">
|
|
|
|
[Helix Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Helix-Kitten)<br>
|
|
[Pioneer Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Pioneer-Kitten)<br>
|
|
[Clever Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Clever-Kitten)<br>
|
|
[**Static Kitten ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iranian%20APT/Static%20Kitten)<br>
|
|
[Tracer Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Tracer-Kitten)<br>
|
|
[Nemesis Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Nemesis-Kitten)<br>
|
|
[**Charming Kitten ✅**](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/blob/main/Iranian%20APT/Charming%20Kitten)<br>
|
|
[Pulsar Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Pulsar-Kitten)<br>
|
|
[Remix Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Remix-Kitten)<br>
|
|
[Haywire Kitten](https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iran%20APT/Haywire-Kitten)
|
|
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
</div>
|
|
|
|
## 🛠️ Adversary Framework
|
|
|
|
All adversary simulations are powered by [**BEAR-C2**](https://github.com/S3N4T0R-0X0/BEAR) a custom command and control framework designed for realistic threat simulation.
|
|
|
|
<img width="1735" height="906" alt="606624432-9e6be27f-d213-4d1d-bab4-d205a95a8808" src="https://github.com/user-attachments/assets/46d855cf-7357-439b-8843-414958c55045" />
|
|
|
|
|
|
## 📫 Contact
|
|
|
|
<table align="center">
|
|
<tr>
|
|
<td align="center"><a href="https://t.me/BearC2"><img src="https://img.icons8.com/color/48/000000/telegram-app.png" width="40"/></a></td>
|
|
<td align="center"><a href="https://x.com/S3N4T0R_0X0"><img src="https://img.icons8.com/color/48/000000/twitterx--v1.png" width="40"/></a></td>
|
|
<td align="center"><a href="https://eg.linkedin.com/in/s3n4t0r"><img src="https://img.icons8.com/color/48/000000/linkedin.png" width="40"/></a></td>
|
|
<td align="center"><a href="https://www.reddit.com/u/S3N4T0R-0X0/s/pF0LHjjCOs"><img src="https://img.icons8.com/color/48/FF4500/reddit.png" width="40"/></a></td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><a href="https://t.me/BearC2">Telegram</a></td>
|
|
<td align="center"><a href="https://x.com/S3N4T0R_0X0">Twitter/X</a></td>
|
|
<td align="center"><a href="https://eg.linkedin.com/in/s3n4t0r">LinkedIn</a></td>
|
|
<td align="center"><a href="https://www.reddit.com/u/S3N4T0R-0X0/s/pF0LHjjCOs">Reddit</a></td>
|
|
</tr>
|
|
</table>
|