Adversary Simulation Scenarios for Critical Infrastructure
The MITRE ATT&CK threat actors most relevant to Critical Infrastructure organizations include Volt Typhoon, VOID MANTICORE, Dragonfly. This page ranks documented actors by how closely their known targeting and tooling match a Critical Infrastructure org, and shows which of each actor's techniques a TurboPentest pentest can exercise today. It is a relevance match, not a probability forecast.
Instead of a generic vulnerability checklist or a once-a-year manual red team, this is a focused, repeatable way to test the specific techniques the actors relevant to your industry actually use.
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
Volt Typhoon G1017
Relevance matchCritical InfrastructureAlso known as BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite.
TurboPentest can autonomously exercise 14 of 98 of this actor's documented techniques today (14%). 19 are out of scope for automated testing (social engineering, denial of service, physical).
+59 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Volt Typhoon. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestVOID MANTICORE G1055
Relevance matchCritical InfrastructureAlso known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80.
TurboPentest can autonomously exercise 8 of 75 of this actor's documented techniques today (11%). 24 are out of scope for automated testing (social engineering, denial of service, physical).
+36 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate VOID MANTICORE. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestDragonfly G0035
Relevance matchCritical InfrastructureAlso known as TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti.
TurboPentest can autonomously exercise 5 of 56 of this actor's documented techniques today (9%). 13 are out of scope for automated testing (social engineering, denial of service, physical).
+33 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Dragonfly. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestBlackByte G1043
Relevance matchCritical InfrastructureAlso known as Hecamede.
TurboPentest can autonomously exercise 4 of 48 of this actor's documented techniques today (8%). 10 are out of scope for automated testing (social engineering, denial of service, physical).
+30 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate BlackByte. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestEmber Bear G1003
Relevance matchCritical InfrastructureAlso known as UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista.
TurboPentest can autonomously exercise 6 of 47 of this actor's documented techniques today (13%). 14 are out of scope for automated testing (social engineering, denial of service, physical).
+24 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Ember Bear. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestPlay G1040
Relevance matchCritical InfrastructureTurboPentest can autonomously exercise 5 of 26 of this actor's documented techniques today (19%). 6 are out of scope for automated testing (social engineering, denial of service, physical).
+13 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Play. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestTEMP.Veles G0088
Relevance matchCritical InfrastructureAlso known as XENOTIME.
TurboPentest can autonomously exercise 3 of 22 of this actor's documented techniques today (14%). 6 are out of scope for automated testing (social engineering, denial of service, physical).
+12 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate TEMP.Veles. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestWindshift G0112
Relevance matchCritical InfrastructureAlso known as Bahamut.
TurboPentest can autonomously exercise 0 of 19 of this actor's documented techniques today (0%). 8 are out of scope for automated testing (social engineering, denial of service, physical).
+9 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate Windshift. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestMofang G0103
Relevance matchCritical InfrastructureTurboPentest can autonomously exercise 0 of 6 of this actor's documented techniques today (0%). 4 are out of scope for automated testing (social engineering, denial of service, physical).
+2 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate Mofang. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestRedEcho G1042
Relevance matchCritical InfrastructureTurboPentest can autonomously exercise 0 of 5 of this actor's documented techniques today (0%). 5 are out of scope for automated testing (social engineering, denial of service, physical).
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate RedEcho. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Which threat actors are most relevant to Critical Infrastructure organizations?
Based on MITRE ATT&CK sector relevance, the closest matches include Volt Typhoon, VOID MANTICORE, Dragonfly. Relevance reflects documented targeting and tooling overlap, not a forecast that any specific group will act.
Is this a prediction that these groups will attack me?
No. This is a relevance match on your industry and technology stack against the MITRE ATT&CK group graph. It is computed deterministically from that data with no language model, and it is not threat-intelligence probability.
How does TurboPentest test for these actors?
It autonomously exercises the in-scope techniques these actors use (for example public-facing application exploitation, exposed remote services, and non-destructive credential testing), and it shows honestly how many of each actor's techniques are covered today versus which need the Adversarial-Depth tier or are out of scope.
What does it cost to test for Critical Infrastructure threats?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.