Attack it. Defend against it.
Two independent research simulations built over the same Novich0k model. Defend asks what a defender can still observe and contain. Attack asks what an operator can still change while being watched. Both are mock data, no backend, and no deployable code.
Understand both sides of the detection problem
The sessions are independent: your Defend game does not affect another player's Attack game. Leaderboards measure performance against a standardised simulation, not player-versus-player outcomes.
Defend: Contain Novich0k
Investigate simulated telemetry, distinguish malicious from legitimate activity, identify compromised endpoints, and contain the incident while the simulated adversary adapts. Includes a full log-interpretation and decision guide.
Start defendingAttack: Keep it Alive
Configure simulated research-model infrastructure and traffic. An automated defensive system watches. Adapt paths, timing, and redundancy to keep command availability as long as possible. Includes a detection-surface and adaptation guide.
Start attackingCore principle
Removing content does not remove behaviour. Payload content may be unavailable and infrastructure may change, while timing, connection frequency, endpoint behaviour, TLS characteristics, infrastructure relationships, and behavioural correlation can remain observable.
Two lenses on the same model
On the Defend side
- How to read DNS, network, TLS, proxy, endpoint, and behavioural telemetry.
- Why single-destination blocking often fails when infrastructure rotates.
- How to build a detection rule that survives destination changes.
- The cost of isolation, blocking, termination, and telemetry increases.
On the Attack side
- How path diversity, timing variance, and redundancy change detection risk.
- Which adaptations are cheap, which are expensive, and which create new signals.
- Why maximum randomness is not always the best strategy.
- How infrastructure rotation events can themselves be observed.