Investigate the attack based on the activities of a real APT group
Study the most up-to-date techniques and tactics of threat actors to be prepared for real-life cyberattacks

This is an online training platform with a virtual IT infrastructure simulating a typical corporate environment, where cybersecurity professionals can practice and improve their skills 24/7 with mentor support.
Here, you can investigate a real-world attack scenario carried out by the APT group Charming Kitten
# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/7170815371/portal) on how to set up a connection to Standoff Defend.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/en-US/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.


🔍 To investigate the attack and complete the report, please review the [guidelines](https://help.standoff365.com/ru-RU/8820264715/portal).
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/f/d974809c9b1545dfa4a0/)

Please note:
• To connect to MaxPatrol SIEM, select the LDAP tab in the authorization window.
• Don't forget to turn on VPN to complete tasks and work with security tools.

To display investigation data displays correctly, use the time filter — the required period is specified in each task.
Important: Event timestamps in MaxPatrol SIEM depend on your time zone. For example:
An event recorded in SIEM at 10:00 UTC+0 will appear as:
- 05:00 UTC-5 (New York)
- 11:00 UTC+1 (Berlin)
- 15:30 UTC+5:30 (New Delhi)
- 19:00 UTC+9 (Tokyo)
Adjust the filter according to your local time to avoid discrepancies

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberrange, write to our [Telegram bot](https://t.me/stf_def_support_bot).

defend

Attack by the APT group Charming Kitten

Lion30 APT, an allegedly state-backed Middle Eastern hacking group, managed to reach the target device and conduct thorough reconnaissance. We detected suspicious activity during the C2 server communication phase. Find out what the attackers were able to steal.

Lion30 APT

Компания является ведущим поставщиком интегрированных IT-решений, которые позволяют клиентам эффективно реализовывать сложные проекты в сфере информационных технологий, учитывая особенности их отрасли.