Cyber the Threat-Hunter

• About
• Play
• How a turn works
• The four gauges
• Actions
• Global controls
• What counters what
• Hunters
• The 10 cases
• Strategy
• Feedback

About

Cyber the Threat-Hunter is a turn-based “catch the hacker” game and a sibling of Ping the Networker. You are Cyber, the SOC lead. An attacker is somewhere in your network, you cannot see him directly, and every move you make costs something: user patience, money or reputation. The game is meant to teach how detection, response and security controls trade off against each other, not to be a simulation of any one product.

Play

• Works in any current desktop browser. The layout adapts to phones, in portrait and landscape.
• No account and no installation. Optional 3-letter initials for the high-score table.
• Keys: Space end turn · M sound on/off · Esc menu · Del deselect.

How a turn works

1. The hunter moves first. He takes one action: recon, exploit, move laterally or exfiltrate. Each action makes some noise, and your sensors turn noise into ⚠ alerts. Some alerts are false alarms.
2. You get 3 action points (AP). Click a device or a link, then choose what to do with it. Global controls (MFA, WAF, egress filtering and so on) change the odds for the whole network.
3. Upkeep. Strict controls, offline systems and active intruders cost mood, money and reputation every turn.
4. Repeat for 16 turns. The hunter may also give up after 3 turns without a viable target.

Fog of war

The hunter’s real position is hidden. You see alerts (some of them false), kill-chain stages once you have evidence, and what you confirm with 🔍 investigate. The chip at the top shows the attacker as “unknown actor” until you confirm a compromise. Practice mode (checkbox on the menu) shows hostile hosts and logs every hunter move, which is the best way to learn, but it is not ranked.

Winning and losing

• You win by surviving all turns, or by leaving the hunter with nothing to attack.
• You lose if 100 % of the crown jewels are exfiltrated (30 % per turn, slowed by egress filtering), if user mood hits zero (mutiny), if reputation hits zero, or if the financial loss reaches $5 M.

The four gauges

Actions

On a device

Operations

• Threat-hunt sweep (2 AP): hunts across the whole network and confirms the most suspicious hosts.
• Vulnerability scan: shows which hosts still have patchable holes.
• Force credential & key reset: invalidates stolen passwords, sessions and keys.
• Public statement: repairs reputation, but only once something has been confirmed. Do not cry wolf.

Global controls

Controls apply to the whole network. Most can be raised (▲) or lowered (▼). Stronger controls help, but they cost mood and money, and some also cost an upkeep every turn.

What counters what

The hunters

Unless you choose one on the menu, the hunter is random and unknown until you confirm a compromise. The hunter’s sprite only travels on the map when you detected his move; an undetected move is a faint blip at the Internet node.

The 10 cases

Classic cases

Zero-days and new attacks, 2022 to 2025

These cases are inspired by public reporting and add new mechanics.

Random events

From turn 2 on, roughly one turn in three brings an event. Some are decisions (a CEO favour, a zero-day, a journalist, a free pentest) that block your turn until you answer. Others are surprises (an audit, a tip, a budget change, a marketing campaign, a help-desk flood).

Strategy

Learn first

• Play your first case in practice mode. You see the hunter and every move he makes, so you learn which of your actions actually change the outcome.
• Read the 📖 case file before a hard case. It names the weakness and the intended counter.

Spend your 3 AP well

• Investigate before you isolate. Isolating a clean machine costs efficiency, mood and money. A single 🔍 is cheap.
• Follow the crown jewels. The hunter is always heading for the 🎯. Alerts on or next to it matter more than alerts on the edge.
• Do not ignore the quiet turn. “No alerts” can mean an APT, not that you are safe. Use a threat-hunt sweep when it is quiet for too long.
• Match the control to the weakness. The table above tells you which one. Raising every control just ends in a mutiny.
• Cut early, cut cheap. A cut link or an isolated, non-critical host costs less than letting the hunter reach the database.

Watch the gauges

• Keep mood above 35. Below that, users work around you and all your controls get 40 % weaker.
• Strict controls cost mood every turn. Raise them when the case needs them, not on turn 1.
• A public statement helps reputation, but only after something is confirmed.
• For ransomware, backups and fast isolation matter more than egress filters.

Typical mistakes

• Reacting to every alert. Some are false, and that is the point of the fog of war.
• Reimaging without isolating first.
• Maxing out MFA, URL filter and egress on turn 1 and losing your users by turn 6.
• Patching the host while a zero-day has no vendor patch yet. Use a virtual patch instead.

Feedback and bug reports