Avito Develops Cyberdetective Browser Game to Train Employees on Real-World Attacks Using MITRE ATT&CK Techniques

Avito has released Cyberdetective, a browser-based training game that places employees inside realistic attack scenarios drawn directly from the MITRE ATT&CK framework. Developed as a personal initiative by Security Awareness lead Ilya Nikiforov, the project moved from first commit on 31 July to company-wide release on 12 October, spanning 74 days and more than 100 hours of after-hours work.

From CTF to narrative experience

Following Avito’s Security Week, feedback indicated a desire for deeper engagement than standalone CTF challenges. Nikiforov designed Cyberdetective so participants experience how small, seemingly harmless actions combine into full attack chains. The game is set in the fictional company Lumi; players control Spok, the honey-badger mascot of Avito’s security team, navigating an office tower, examining objects, listening to calls, comparing emails, and reviewing access logs.

Six cases built on real techniques

The first season, titled “Quiet Hire,” contains six cases, each mapped to specific MITRE ATT&CK techniques:

• Case 001 “Guest Without a Pass” – T1091, T1052 – physical access after an employee leaves a laptop unlocked.
• Case 002 “Archive” – data exfiltration disguised as waste disposal.
• Case 003 “Payment Order” – T1566.001, T1656 – invoice from a look-alike domain.
• Case 004 “Mark’s Voice” – T1566.004 – voice cloning of a manager requesting sensitive codes.
• Case 005 “Key to All Doors” – T1621, T1539 – MFA fatigue with 27 requests in 11 minutes.
• Case 006 “Faithful” – incident response that balances containment with evidence preservation.

Each case lasts approximately 15 minutes and includes a prologue, interactive investigation, and post-incident debrief.

Additional training layers

Beyond the main story, a Polygon mode offers 21 short exercises across phishing, generative-AI risks, and technical topics. Eighteen distinct game mechanics ensure every task centers on a concrete verb rather than passive reading. Psychological levers such as authority, urgency, and habit are deliberately incorporated so players feel the pressure real victims experience.

AI-assisted production

Nikiforov acted as scenario writer, product owner, and methodologist while Claude Code and Codex handled code generation, review, and more than 2,200 automated tests. Visual assets were produced with ChatGPT, Hyper3D Robin, Blender, Grok, Dreamina, Suno, and ElevenLabs. The final build comprises 80 ES modules totaling roughly 22,000 lines of pure JavaScript served as a static site from an S3 bucket.

The game is now live for all Avito employees and continues to collect ranking data based on process quality rather than final score, reinforcing six core habits including callback verification and minimal data sharing with AI services.