ATK — Attacker mission
Disrupt a critical service: gain a foothold, bypass DCS/PLC controls, issue unauthorized commands, and cover your tracks before the operator reacts.
SCADA / ICS Cyber Range Training
Nation-state-class scenarios for the operators who defend critical infrastructure: power grids, water utilities, manufacturing, and the control systems that run them.
DEF — Defender mission
Detect the intrusion, isolate the affected segment, fall back to safe operating state, and keep the physical process running.
AI — What the Coach reviews
Your detection speed, your isolation decisions, and the tactic chain you did and didn’t see — mapped to ATT&CK for ICS.
MITRE ATT&CK for ICS techniques covered
- T0817 Drive-by Compromise
- T0866 Exploitation of Remote Services
- T0855 Unauthorized Command Message
- T0831 Manipulation of Control
- T0814 Denial of Service
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- Colonial Pipeline (2021) — a ransomware hit on IT forced a precautionary shutdown of fuel supply.
- Oldsmar water treatment (2021) — an attacker remotely altered chemical dosing setpoints.
- Industroyer / CrashOverride (2016) — purpose-built malware tripped a Kyiv substation offline.
Attack. Defend. Repeat.