ATK — Attacker mission
Compromise an exposed device, extract and tamper with firmware, then pivot from the edge into the network behind it — or plant a foothold in the build pipeline that ships to thousands.
IoT & Semiconductor Cyber Range Training
Embedded devices and the fabs that build them are the soft underbelly of modern infrastructure: long-lived, rarely patched, and trusted by everything downstream.
DEF — Defender mission
Detect anomalous device behaviour, contain the compromised node, verify firmware integrity, and keep the production line running without trusting the breached segment.
AI — What the Coach reviews
Your enumeration of the device fleet, the moment you noticed the firmware mismatch, and whether you isolated the edge before it became a pivot — mapped to ATT&CK.
MITRE ATT&CK techniques covered
- T1190 Exploit Public-Facing Application
- T1542.001 Pre-OS Boot: System Firmware
- T1601.001 Modify System Image: Patch System Image
- T1078 Valid Accounts
- T1133 External Remote Services
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- Mirai botnet (2016) — hundreds of thousands of default-credential IoT devices weaponised into a record DDoS.
- TSMC WannaCry infection (2018) — an unpatched worm halted semiconductor fabrication lines for days.
- Supply-chain firmware implants — trusted update channels turned into a delivery mechanism.
Attack. Defend. Repeat.