Infection Monkey is an open-source, GPL-3.0 adversary emulation platform written in Python that lets security teams simulate malware propagation across their own networks and find out empirically whether their defences detect, prevent or mitigate the infection.

What it is

Infection Monkey is built from two components that work together. The Agent is a configurable network worm that self-propagates across a network, can infect machines, steal data and deliver payloads, and reports its activity back to Monkey Island, a command and control server used to control and visualise the progress of the simulation throughout the run. The project lives in the security automation and penetration-testing corner of the Python ecosystem, and its topics list names it plainly: adversary-emulation, penetration-testing and security-tools.

The concrete problem it addresses is the gap between knowing what an attacker does and knowing whether your own controls actually stop it. The README frames the tool as a "malware vaccine": a sample of malware is collected and its behaviours analysed, Infection Monkey's configuration is then modified to closely mimic those behaviours without causing damage to the target systems, and the Agent is injected into the network so the team can validate empirically that its security controls respond. What it replaces, in that workflow, is the live malware sample itself — a real, damaging infection test is substituted with a safe, configurable agent whose behaviour is tuned to match the threat being studied.

Key capabilities

• Runs as two cooperating pieces: a self-propagating Agent and the Monkey Island command and control server used for control and visualisation.
• Propagates using predefined passwords, common logical exploits, and password stealing using Mimikatz.
• Supports multiple exploit methods, including Log4Shell, RDP, SSH, SMB and WMI, with further exploiters documented in the project's documentation hub.
• Configures the Agent to infect machines, steal data and deliver payloads, so behaviour can be shaped to resemble an analysed malware sample.
• Produces an Infection Map and a security report to show how far the simulation spread and what it found.
• Ships deployment scripts in the deployment_scripts folder for standing up the development version of Monkey.
• Supports a range of operating systems, catalogued on the operating systems page of the documentation hub.

Who uses it and how

• Security teams that have analysed a malware sample and want to confirm their controls can detect, prevent or otherwise mitigate an infection with matching behaviours.
• Penetration testers and red teams who need an automated way to move through a network rather than testing hosts one at a time.
• Defenders running repeatable validation exercises, using the Infection Map and security report as the evidence of where a simulation succeeded.
• Teams working across mixed environments, provided the platforms in use appear in the documented list of supported operating systems.
• Automation-minded security groups, given the project's security-automation topic and its scripted deployment path.

Getting started

Setup and first-run instructions live in the Setup page and the Getting Started guide in the project's documentation hub. To deploy the development version from source, follow the readme in the deployment_scripts folder.

How it compares

No comparable or paid products are named in the facts provided, so Infection Monkey stands alone in this registry as its only adversary emulation platform. The contrast that can be drawn is internal to the project: it is GPL-3.0 licensed, self-hosted through your own Monkey Island instance, and leaves the resulting data on infrastructure you operate.

When to use it — and when not to

A self-hoster must operate the Monkey Island command and control server in addition to deploying Agents, so there is real infrastructure to run and keep available for the duration of a simulation. Teams unwilling to run a command and control server, or to open the propagation paths the Agent needs, should not pick it. The README also defers nearly all operational detail to an external documentation hub and offers no single install command, and the repository carries 240 open issues, so expect to read the docs closely before the first run.