The Bounty Hunter is a novel Caldera plugin that enhances cyber adversary emulation by introducing weighted-random attack behavior, supporting initial access and privilege escalation, and enabling more sophisticated and realistic attack chains. Unlike traditional tools that rely on predefined playbooks, the Bounty Hunter autonomously selects attack methods, demonstrating the ability to emulate complex scenarios like APT29 campaigns by dynamically gathering necessary information and executing multi-step attacks. Its key innovations include introducing uncertainty into attack planning, extending Caldera’s capabilities beyond post-compromise methods, and providing configurable options to customize emulated attack behaviors. Fraunhofer FKIE publishes the plugin on GitHub for Caldera v5.0.0 or v4.2.0, including a demo scenario that brute-forces SSH credentials with Hydra before escalating privileges on a Windows or Linux target.
