Threat intelligence, adversary emulation, DFIR, ICS/OT, and training notes from the Cyberange team.https://cyberange.io/en-INhttps://cyberange.io/insights/cyber-physical-smart-grid-security-testbed/https://cyberange.io/insights/cyber-physical-smart-grid-security-testbed/A case study on designing and building a realistic, closed-loop smart-grid cybersecurity testbed for a research institute — the requirement, the design approach, what was delivered, and why it matters for the people who keep the grid running. Implementation specifics are deliberately withheld.Mon, 15 Jun 2026 00:00:00 GMTICS / OTICSOTsmart griddigital substationtestbedresearchenergygrid securityCyberange Phygital Labshttps://cyberange.io/insights/90-day-red-team-tier-1-indian-airport/https://cyberange.io/insights/90-day-red-team-tier-1-indian-airport/A redacted case study mapping a 13-week journey from an external foothold to full Active Directory compromise. Discover how the operator adapted tactics on the fly and what forensic artifacts survived a rigorous CERT-In post-incident review.Wed, 27 May 2026 00:00:00 GMTAdversary emulationred teamaviationairportadversary emulationIndiaCERT-Infield noteCyberange Adaptive Red Teamhttps://cyberange.io/insights/cert-in-six-hour-window/https://cyberange.io/insights/cert-in-six-hour-window/CERT-In Direction 70B (April 2022) requires reporting of certain cyber incidents within six hours of detection. A practical breakdown of what the clock actually measures, what your runbook needs to include, and where most organisations get the timeline wrong.Tue, 26 May 2026 00:00:00 GMTDFIRCERT-Inincident responseregulatoryBFSIIndiaCyberange DFIR Consultinghttps://cyberange.io/insights/welcome-to-insights/https://cyberange.io/insights/welcome-to-insights/The publishing home for our practice notes, engagement debriefs, and threat-landscape reads — now open for contributions from student alumni, cohorts, and the wider community.Tue, 26 May 2026 00:00:00 GMTCommunityannouncementeditorialCyberange Editorialhttps://cyberange.io/insights/why-real-plcs-matter/https://cyberange.io/insights/why-real-plcs-matter/A short practice note on the difference between a simulator and a range, and why the difference compounds in operator training, regulator-grade demonstrations, and live red-team engagements.Tue, 26 May 2026 00:00:00 GMTICS / OTphygitalpracticePLCtrainingCyberange Phygital Labshttps://cyberange.io/insights/browser-based-initial-access-2026/https://cyberange.io/insights/browser-based-initial-access-2026/The fastest-growing initial-access surface in the engagement data is the browser session, not the credential. Reverse-proxy phishing kits, OAuth consent abuse, extension supply-chain hijacks, and infostealer-fed cookie marketplaces — what changed, why MFA and password rotation no longer cover the dominant case, and which controls actually move the curve.Fri, 17 Apr 2026 00:00:00 GMTThreat intelligencebrowserinitial accessSSOthreat intelphishingCyberange Threat Intelhttps://cyberange.io/insights/one-letter-off-business-email-compromise-invoice-fraud/https://cyberange.io/insights/one-letter-off-business-email-compromise-invoice-fraud/A new analyst, a trusted client, and an email that arrived at 5:45 on a Monday morning. The story of a business email compromise that turned on a single swapped character — and the forensic trail that survived a year of silence and a lawyer's denial.Sat, 14 Sep 2024 00:00:00 GMTDFIRDFIRBECbusiness email compromiseinvoice fraudlook-alike domainphishingfinancial servicesinvestigationCyberange DFIR Teamhttps://cyberange.io/insights/ransomware-dfir-exposed-rdp-to-domain-wide-encryption/https://cyberange.io/insights/ransomware-dfir-exposed-rdp-to-domain-wide-encryption/A sanitized DFIR debrief of a ransomware intrusion at a large Indian manufacturer. We reconstruct the timeline from a misconfigured firewall rule and a brute-forced RDP login through Mimikatz, AV removal, PsExec lateral movement, and full-estate encryption — and the anti-forensics that nearly erased the trail.Tue, 14 May 2024 00:00:00 GMTDFIRDFIRransomwareincident responseforensicsMimikatzRDPlateral movementIndiamanufacturingCyberange DFIR Teamhttps://cyberange.io/insights/marketing-website-to-domain-admin-wordpress-breach/https://cyberange.io/insights/marketing-website-to-domain-admin-wordpress-breach/It came in as a spam complaint. It ended at a forgotten brochure website wired into the company's domain controller, with the Domain Admin password sitting in a script on someone's desktop. A story about the assets nobody thinks are worth attacking.Thu, 14 Apr 2022 00:00:00 GMTDFIRDFIRweb shellWordPressinitial accessActive DirectorySEO spamincident responseattack surfaceCyberange DFIR Team