🔎Forensics & OSINTInsane 10000 XP 28 solves 180 min Exclusive badge on solve

Nation-State Attack Simulation

by Codelivly

A fictional nation-state actor breached CORP. Reconstruct all FIVE phases of the intrusion from the collected evidence — one token per phase, each hidden behind a different encoding: the malicious macro (Initial Access), a Run-key (Persistence), a credential dump (Credential Access), a Windows 4624 event (Lateral / AD), and the exfil channel (Exfiltration). Your own isolated instance; tokens are unique to you. Submit each CLV{...}; capture all five to complete this capstone.

#insane#boss#multi-flag#blue-team#apt#dfir#incident-response#threat-hunting

DifficultyInsane

Live Environment

Ready

Spin up your own private, isolated instance of this challenge.

Auto shutdown after 60 minutes
Isolated sandbox
Captured flags are saved independently of the environment
One-click restart

Flags · 0/5 captured

1Initial Access1500 XP
2Persistence2000 XP
3Credential Access2000 XP
4Lateral / AD2500 XP
5Exfiltration2000 XP

Submit each flag below — the box accepts any of them.

Submit Flags

Hints

Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.

Hint 1

Hint 2

Hint 3

Hint 4

Hint 5

Hint 6

Challenge List

Frequently Asked Questions

What is an APT?

An advanced persistent threat is a well-resourced attacker, often state-backed, that stays in a network for a long time using stealthy techniques to reach strategic goals.

How does threat hunting differ from alert triage?

Hunting is proactive: analysts form hypotheses and search data for hidden activity, while triage reacts to alerts already raised by tools.

Is the Nation-State Simulation free?

Yes. It is an insane boss challenge on Codelivly, free to attempt, designed for learners ready to apply DFIR and hunting skills end to end.

NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a labCodelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us