How can one simulate and analyze attacks on the Bitcoin network?
The regtest operational mode of bitcoind is not as similar to testnet as you might think. The regtest mode offers you a totally local Bitcoin blockchain which is easily controlled by your local bitcoind with low difficulty. According to this post, it is furthermore possible to build a network out of multiple local bitcoind instances, such that you have a local Bitcoin network of your own.

You can control this network freely, but you can only simulate behavior that bitcoind allows you to assume. I am not aware of whether or not this is sufficient for your cases. If not, you could maybe try to fork bitcoind and somehow add the behavior you want to achieve...