Russian intelligence service (SVR) - Sophisticated tradecraft with emphasis on stealth - Two-day evaluation simulating a targeted intrusion - Day 1: Initial compromise, discovery, privilege escalation, credential access - Day 2: Lateral movement, collection, exfiltration - 21 vendors participated