Adversary Simulation Scenarios for Government
The MITRE ATT&CK threat actors most relevant to Government organizations include APT29, Kimsuky, Sandworm Team. This page ranks documented actors by how closely their known targeting and tooling match a Government org, and shows which of each actor's techniques a TurboPentest pentest can exercise today. It is a relevance match, not a probability forecast.
Instead of a generic vulnerability checklist or a once-a-year manual red team, this is a focused, repeatable way to test the specific techniques the actors relevant to your industry actually use.
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
APT29 G0016
Relevance matchGovernmentAlso known as IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM.
TurboPentest can autonomously exercise 7 of 119 of this actor's documented techniques today (6%). 27 are out of scope for automated testing (social engineering, denial of service, physical).
+75 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate APT29. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestKimsuky G0094
Relevance matchGovernmentAlso known as Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43.
TurboPentest can autonomously exercise 9 of 130 of this actor's documented techniques today (7%). 39 are out of scope for automated testing (social engineering, denial of service, physical).
+73 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Kimsuky. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestSandworm Team G0034
Relevance matchGovernmentAlso known as ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh.
TurboPentest can autonomously exercise 10 of 99 of this actor's documented techniques today (10%). 36 are out of scope for automated testing (social engineering, denial of service, physical).
+44 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Sandworm Team. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestMustang Panda G0129
Relevance matchGovernmentAlso known as TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT.
TurboPentest can autonomously exercise 2 of 91 of this actor's documented techniques today (2%). 31 are out of scope for automated testing (social engineering, denial of service, physical).
+49 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate Mustang Panda. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestOilRig G0049
Relevance matchGovernmentAlso known as COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens.
TurboPentest can autonomously exercise 4 of 82 of this actor's documented techniques today (5%). 23 are out of scope for automated testing (social engineering, denial of service, physical).
+49 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate OilRig. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestAPT32 G0050
Relevance matchGovernmentAlso known as SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH.
TurboPentest can autonomously exercise 2 of 78 of this actor's documented techniques today (3%). 19 are out of scope for automated testing (social engineering, denial of service, physical).
+47 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate APT32. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestMagic Hound G0059
Relevance matchGovernmentAlso known as TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus.
TurboPentest can autonomously exercise 8 of 78 of this actor's documented techniques today (10%). 23 are out of scope for automated testing (social engineering, denial of service, physical).
+40 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Magic Hound. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestVOID MANTICORE G1055
Relevance matchGovernmentAlso known as COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80.
TurboPentest can autonomously exercise 8 of 75 of this actor's documented techniques today (11%). 24 are out of scope for automated testing (social engineering, denial of service, physical).
+36 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate VOID MANTICORE. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestGamaredon Group G0047
Relevance matchGovernmentAlso known as IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm.
TurboPentest can autonomously exercise 0 of 70 of this actor's documented techniques today (0%). 27 are out of scope for automated testing (social engineering, denial of service, physical).
+37 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate Gamaredon Group. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestLeviathan G0065
Relevance matchGovernmentAlso known as MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper.
TurboPentest can autonomously exercise 7 of 70 of this actor's documented techniques today (10%). 21 are out of scope for automated testing (social engineering, denial of service, physical).
+36 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Leviathan. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestTurla G0010
Relevance matchGovernmentAlso known as IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake.
TurboPentest can autonomously exercise 1 of 68 of this actor's documented techniques today (1%). 18 are out of scope for automated testing (social engineering, denial of service, physical).
+43 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Turla. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestMuddyWater G0069
Relevance matchGovernmentAlso known as Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros.
TurboPentest can autonomously exercise 2 of 68 of this actor's documented techniques today (3%). 23 are out of scope for automated testing (social engineering, denial of service, physical).
+34 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
This actor's in-scope techniques are already covered by every TurboPentest run.
Emulate MuddyWater. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Which threat actors are most relevant to Government organizations?
Based on MITRE ATT&CK sector relevance, the closest matches include APT29, Kimsuky, Sandworm Team. Relevance reflects documented targeting and tooling overlap, not a forecast that any specific group will act.
Is this a prediction that these groups will attack me?
No. This is a relevance match on your industry and technology stack against the MITRE ATT&CK group graph. It is computed deterministically from that data with no language model, and it is not threat-intelligence probability.
How does TurboPentest test for these actors?
It autonomously exercises the in-scope techniques these actors use (for example public-facing application exploitation, exposed remote services, and non-destructive credential testing), and it shows honestly how many of each actor's techniques are covered today versus which need the Adversarial-Depth tier or are out of scope.
What does it cost to test for Government threats?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.