MeridianMeridian

MITRE ATT&CK in Detective Settings: Avito Launches Cyberdetective Game for Security Awareness Training

Avito security awareness specialist Ilya Nikiforov has developed Cyberdetective, a browser-based detective game that trains employees against real-world attack techniques mapped to MITRE ATT&CK. The game places players in the fictional company Lumi where they control mascot Spock the honey badger, investigate six cases involving voice cloning, MFA fatigue, lookalike domains, and physical tailgating. Each scenario trains specific defensive habits such as callback verification and evidence preservation rather than simple rule recall. Development took 74 days with AI agents handling code, tests, art generation, voice synthesis, and video while the creator focused on scenario design and methodology. The project includes 21 additional training tasks on a firing range covering phishing, AI misuse, and supply-chain risks, supported by 2,200 automated tests and an editor system for future content updates. The initiative demonstrates how non-developers can build production-grade security tools using modern AI tooling while maintaining strict data-protection controls.

HabrTranslated from Russian

Read at source

Avito has released Cyberdetective, a browser-based detective game that trains employees to recognize and respond to realistic attack chains drawn directly from the MITRE ATT&CK framework. The project was conceived and executed by Security Awareness specialist Ilya Nikiforov over 74 days as a personal initiative within the GRC team.

From CTF to narrative training

Following a successful Security Week CTF, feedback indicated demand for a more immersive format. Nikiforov wanted a continuous story where small clues accumulate into a full incident, forcing players to make decisions under pressure rather than simply answering quiz questions. The first commit on 31 July contained 1,544 lines describing an isometric grid and two characters. The finished game launched on 12 October at the start of the company’s Security Awareness month.

Game structure and learning objectives

Players control Spock, the honey-badger mascot of Avito’s security team, inside the fictional company Lumi. Six cases in the first season titled “Quiet Hire” each map to documented MITRE ATT&CK techniques:

  • Case 001 – Tailgating and unlocked workstation (social engineering)
  • Case 002 – Unauthorized removal of media under the guise of recycling
  • Case 003 – Lookalike domain invoice fraud
  • Case 004 – Voice cloning of an executive
  • Case 005 – MFA fatigue and session theft (27 requests in 11 minutes)
  • Case 006 – Evidence preservation versus remediation trade-offs

Each case lasts approximately 15 minutes and ends with a debrief that highlights the exact moment the attack could have been stopped. A separate “Firing Range” offers 21 short exercises across phishing, generative-AI misuse, and technical topics, scored at three difficulty levels.

AI-assisted production pipeline

Code, unit tests, and reviews were performed by Claude Code and Codex agents. Nikiforov retained the roles of scenario designer, product owner, and methodologist. Background art was generated in ChatGPT, 3D characters via Hyper3D Robin, animations in Blender, prologue videos with Grok and Dreamina, music in Suno, and character voices in ElevenLabs. More than 2,200 Jest tests and agent-driven playtests were executed before release. The architecture uses plain JavaScript modules served from an S3 bucket, with content described entirely in JSON so that new cases can be added without code changes.

Security and governance

All characters and the company are fictional. No real employee data or internal documents were processed by any model. AI tooling itself was vetted according to Avito’s existing generative-AI security policy. The final product contains 80 JavaScript modules, roughly 22,000 lines of code, 18 distinct interaction mechanics, and 15 printable reference sheets.

ChatGPTClaude CodeMITRE ATT&CKAvitoElevenLabs
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria
Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian