Cyber Magen

You are the night-shift Watch Commander. Somewhere in your network, an intruder is already working. Find them, evict them, and keep the mission-critical servers alive.

Cyber Magen is a real-time strategy game about cyber defense. You command the Blue Team — analysts, hunters, responders, and engineers — across an enterprise network while an adaptive Red adversary phishes, pivots, exfiltrates, and detonates ransomware.

What makes it different

- **The Adversary Kill Chain** — you don't see the attacker's plan; you *infer* it. Every kill and every alert feeds an evidence-driven timeline that estimates where the intruder is in their campaign — and how confident you should be.

- **Scenarios drawn from real incidents** — each mission maps a real-world campaign (with MITRE ATT&CK technique references) onto the game board, from hospital ransomware crews to kill-switch sabotage.

- **Real tradecraft, playable** — virtual patching, quarantine, honeypots, threat intel, SIEM coverage, and residual persistence: evicting the intruder isn't the same as being safe.

How to play

- 20-step interactive **TRAINING** mode teaches everything in ~10 minutes

- Classic RTS controls: left-click/drag to select, right-click to move, Shift+RMB to attack-move, control groups on 1–9

- Three difficulties — Easy is genuinely easy, Hard will hurt

Early build

This is v0.3 — the first public release. The adversary gets smarter in updates. **Feedback shapes the next build — leave a comment below.

The scenario library is just getting started

Cyber Magen's missions are built from publicly documented, real-world cyber incidents, translated into playable strategy — the current build ships with two, and the roadmap is a growing library of them: hospital ransomware crews, kill-switch sabotage, supply-chain intrusions, data-extortion campaigns, and the defining incidents the security community still studies. Each scenario maps the real campaign's tactics (with MITRE ATT&CK references) onto the board, so playing the library becomes a tour of how modern intrusions actually unfold — and how defenders beat them.

Also planned for upcoming builds:

- A smarter, objective-driven adversary that picks its own targets

- An alert and triage layer — decide what's real before you commit responders

- More replay variance, so no two nights on shift play the same

Follow the project to get notified when new scenarios drop.