Skip to main content

Navigation

Catalogue

Security Awareness Privacy & Compliance AI & LLM Security Real-World Incidents Application Security API Security Git & Repository Security Cloud Security
Microlearning drills

Features

Interactive 3D Training Cloud LMS SCORM & LTI Human Risk Management Integrations All features

Simulations

Phishing Simulations Smishing Simulations
Vishing Simulations Soon

Company

Partners About Us Blog Data Sheet PDF

Legal

Security & Compliance Privacy Policy Terms of Service
English Українська
Book a Demo

Every exercise is indexed by name, CWE, OWASP, MITRE ATT&CK, CIS, NIST CSF, GDPR and EU AI Act reference.

Try

Real-World Cybersecurity
Incidents

Walk through actual breaches step by step. Reconstruct each attack chain and identify the warning signs at every stage.

2 interactive case studies based on documented incidents. Free to play, no sign-up required.

Investigate Real Breaches

Each case study is based on a documented security incident. You will analyze the attack chain, identify the failures, and understand what should have been done differently.

Real Incident Report

OneNote Email Attack

A trusted partner's email, a fake sign-in page, six minutes.

Attackers broke into a business partner's mailbox and read it for weeks before acting. When you are waiting on signed contracts, an email from the partner's CEO arrives with a OneNote link, sent from ...

  • ATT&CKT1566.001
  • CIS 14.2
Investigate This Case →
Real Incident Report

MGM Resorts Breach

Relive the 10-minute helpdesk call that cost $100M.

The September 2023 MGM Resorts breach began with a helpdesk call the attackers said took about ten minutes. Scattered Spider found an employee on LinkedIn, phoned the IT helpdesk posing as them, and a...

  • ATT&CKT1566.004
  • CIS 14.2
Investigate This Case →

Frequently asked questions

What is a OneNote email attack?

A phishing email that uses a OneNote or OneDrive document link as the lure. In this exercise, attackers who had been reading a partner's mailbox sent a contract link that led to a fake Microsoft sign-in page. Entering a password there handed the attacker the account within minutes.

What is a homograph domain?

A domain that swaps a letter for an identical-looking character from another alphabet, such as a Cyrillic "о" in place of a Latin "o". It reads as the real company name. Many browsers show such mixed-alphabet names as punycode starting with xn--, which is a warning sign worth checking.

How did the MGM Resorts breach happen in 2023?

The Scattered Spider threat group called MGM's IT helpdesk, impersonated an employee using publicly available LinkedIn information, and convinced staff to reset credentials. That single 10-minute phone call gave attackers initial access. They then deployed ALPHV/BlackCat ransomware, shutting down hotel systems, slot machines, and booking platforms. MGM reported over $100M in total impact.

What is Scattered Spider?

Scattered Spider is a financially motivated threat group known for social engineering attacks against large organizations. They specialize in helpdesk vishing, SIM swapping, and MFA fatigue attacks to gain initial access. The group has targeted major hospitality, technology, and telecommunications companies, often partnering with ransomware-as-a-service operators like ALPHV/BlackCat for the encryption and extortion phase.

See RansomLeak in Action

Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.

Request Demo Try Free Exercises