At DEF CON 34, CMD+CTRL launched Dark Money, our newest vulnerable digital banking cyber range. By the end of the event, one of the players who had been competing in CMD+CTRL ranges for eight years walked across the DEF CON main stage to receive the coveted Black Badge.
Out of the 81 contests running at DEF CON, only 10 are selected to award a Black Badge. CMD+CTRL was one of them.
The badge went to Artem Kamshilin, a full-stack Security Architect and an eight-year veteran of CMD+CTRL cyber ranges, who hacked his way through Dark Money, challenge by challenge, and ultimately came out on top among 160 scoring players.
Dark Money is a vulnerable, fully functional digital banking platform designed to give cybersecurity practitioners hands-on experience finding and exploiting application security vulnerabilities.
The range combines realistic financial workflows with a gamified storyline involving a criminal network, laundered funds, and a live prediction market called the Oracle.
Players act as ethical hackers tracing how money moves through the bank and Oracle while uncovering how both systems are being manipulated.
Dark Money spans eight areas of a modern banking application:
Across those areas are 33 cybersecurity challenges rated at intermediate difficulty, ranging from more approachable entry points to problems that require deeper investigation.
Dark Money includes vulnerabilities and attack techniques commonly found in modern web applications and APIs, including:
The difference is context. These vulnerabilities live inside realistic banking workflows rather than isolated exercises.
Players must understand how the application works, identify where its logic can be abused, and determine how different weaknesses interact.
That becomes especially important with business logic and authorization issues that automated tools may not fully understand.
Dark Money was intentionally leaner than some previous CMD+CTRL contest ranges. That was deliberate. Every challenge had to earn its place.
Rather than maximizing the number of vulnerabilities, the goal was to build an application that continued to reveal new attack paths as players investigated it more deeply.
Artem described that experience after working through the range:
"This is tasty! A SPA mandated a thorough dive into the frontend code (I've always thought of myself as leaning towards backend design, if I can help it), the API provided a solid, enumerable surface to analyze... the list goes on, what I can say is that I love it when the app opens up as you keep digging."
That progressive discovery mirrors real-world security testing. Testers rarely receive a checklist telling them where vulnerabilities exist. They have to explore, understand the application, form hypotheses, and let each discovery inform the next.
Artem Kamshilin won the CMD+CTRL Dark Money contest at DEF CON 34 and received a DEF CON Black Badge.
He had been competing in CMD+CTRL contests at DEF CON for eight years. His background in web application development originally drew him to the CMD+CTRL booth. Trying the range, he said, "just felt natural to try it out."
He kept coming back, and over the years, the attraction became more than the challenges themselves. It was also the community surrounding the competition and the opportunity to continually test how much his skills had improved.
This year, however, something about his approach changed.
Historically, Artem competed largely on his own using familiar offensive security tools such as Burp Suite, hashcat, and John the Ripper (JtR).
His process relied heavily on manual enumeration and analysis.
The problem was scale.
Against teams of three or more people, a single person manually investigating every possible attack path could only work so quickly.
For DEF CON, Artem experimented with a different approach: an AI-backed security testing harness.
He explained:
"This approach just could not scale against teams of 3+, and it was reflected well on the scoreboard in the past years. Now that we have access to frontier LLM models, I decided to come up with an AI-backed harness that would basically do most of the things I would do as far as planning and initial surface enumeration, but it would allow me to scale my approach and try more than one thing at a time more reliably. It took significant time to first teach the harness to look for specific issues, properly document the findings for further reuse, and make it capable of leveraging its prior findings."
Building the system wasn't as simple as pointing an LLM at the application.
Artem had to teach the harness to look for specific security issues, properly document findings, and reuse information it had previously discovered. In other words, the AI system needed a methodology.
The harness was particularly useful for broad, parallelized attack surface enumeration.
Instead of Artem manually following one possible path at a time, the system could investigate multiple areas simultaneously and surface potential attack vectors for further analysis.
One of his favorite discoveries involved race conditions identified during attack-vector enumeration.
But finding an interesting path and successfully exploiting it were not always the same thing. As the Dark Money challenges became more difficult, the automated system increasingly reached its limits. That is where human judgment became critical.
The hardest Dark Money challenges required more than broad enumeration. They required someone who understood the application well enough to recognize unusual behaviors, interpret previous findings, develop new hypotheses, and decide what the system should attempt next.
AI could accelerate the investigation. It could not replace the person directing it.
Artem still needed to get back behind the wheel when the harness stalled. That experience challenged the idea that engineers automatically become obsolete once everyone gains access to the same AI tools.
Someone still has to design the harness, set the rules of engagement, and know when to push it further. Our jobs are changing, he says, but we're still required at the helm.
For Artem, learning that the CMD+CTRL Dark Money contest had been selected for a Black Badge did not fully register until the award ceremony. After eight years of competing in CMD+CTRL cyber ranges, walking onto the main DEF CON stage represented more than simply winning one competition.
He described seeing CMD+CTRL's ranges receive formal recognition from DEF CON as "incredibly rewarding."
But when asked what skill ultimately helped him get there, his answer wasn't AI, Burp Suite, hashcat, or a particular exploitation technique. It was staying organized in the chaos. Preparation and discipline are what give a player the edge.
His advice to anyone considering a Black Badge-level competition is straightforward:
Don't assume you can't do it.
Artem finished ninth during his first year competing with CMD+CTRL. At the time, he didn't know exactly what it would take to improve. The answer was to continue playing, continue learning, and continue getting faster.
His most important habit? Never give up.
"Feel stuck? Take a break, walk around, sleep on it, then come back and hit it again. Regardless of your skill level, toolchain, familiarity with the concepts, or overall expertise, keep kicking the ball until time runs out. Don't let anything discourage you, and you will be rewarded fondly by the best feeling in the world: 'I didn't think I could do it, yet here it is.'"
The objective isn't to know everything before the contest starts. It is to keep learning until time runs out.
Artem's Black Badge makes for a great DEF CON story, but the lessons extend well beyond the competition.
Artem's harness could investigate broadly and surface possible weaknesses quickly. But when a challenge required contextual understanding, creative reasoning, or deeper knowledge of the application's business logic, human intervention became necessary.
That raises an important question for organizations adopting AI-assisted security tools:
Are your developers and security practitioners learning how to direct these tools effectively, or are they only learning how to run them?
As AI-assisted security tooling becomes more capable, teams will increasingly need to validate machine-generated findings, recognize where automation falls short, and determine the next logical step.
Dark Money is not a collection of disconnected vulnerability examples. It behaves like a digital banking platform with accounts, transactions, loans, payments, cards, linked financial accounts, APIs, authentication, authorization, and business rules.
That interconnected environment changes how vulnerabilities are approached.
A business logic flaw is easier to understand when you can see how exploiting it affects an actual transaction, account, or financial workflow.
Knowing what a vulnerability is and successfully exploiting one inside a complex application are different skills.
Artem built his AI harness partly because a solo manual testing process could not keep pace with coordinated teams of three or more people.
For organizations, there is another way to address that challenge: train people together.
Teams working against the same realistic application can divide responsibilities, share findings, build on each other's discoveries, and practice the coordination required during application security assessments, penetration tests, incident response, secure code reviews, threat modeling, and other security work.
Dark Money is especially relevant for teams building financial applications, payment systems, account platforms, API-driven applications, or other software with sensitive business logic and authorization rules.
Traditional scanning can identify many technical weaknesses, but some application security problems only become apparent when someone understands how the system is supposed to behave and deliberately looks for ways to make it behave differently.
That is the kind of reasoning realistic cyber ranges are designed to develop.
Dark Money's recognition at DEF CON reinforces CMD+CTRL's approach to cyber range design: build realistic applications that force players to investigate, reason, experiment, and adapt.
You don't need to wait for next year's DEF CON to experience the cyber range that earned CMD+CTRL a Black Badge.
Spin up a trial of the CMD+CTRL cyber range platform and take on the same digital banking platform and Oracle prediction market that Artem and hundreds of other players tackled at DEF CON 34.