Adaptive Adversary Emulation Framework for Cyberwarfare Operations

The geopolitical landscape is becoming increasingly complex and tense, with a largely silent cyber conflict unfolding on a daily basis. Consequently, traditional defenses based on detection and postevent analysis are therefore becoming insufficient. This situation has compelled both public and private entities to adopt a more proactive approach to addressing digital threats in order to anticipate them. This is particularly important in the Critical Infrastructure (CI) sector, given its strategic geopolitical role and the severe consequences that attacks on such infrastructures may entail. In this context, this article proposes the Operational Platform for Offensive Replication (OPFOR), a modular framework for executing Adversary Emulation (AE) based on attacker behaviors attributable to real malicious actors with specific objectives. Likewise, we introduce the concept of Adaptive Adversary Emulation (AAE), defined as the execution of an actor's behavior adapted to a different context while preserving the similarity of the actions and the Tactics, Techniques, and Procedures (TTP) employed by adversaries.