Modern Red Team Infrastructure

Provides an automated installer and configuration guide for Throwback, a beaconing backdoor with a PHP/MySQL C2 server, covering ThrowbackLP setup and agent deployment for red team use.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.

Ceri Coburn proposes a new BOF PE reference design that runs the same linked EXE standalone or in-agent with full C++ and exception support, easing maintenance pain of traditional Beacon Object Files.

A Q&A with NetSPI's Nabil Hannan on red teaming culture: objective-based assessments, the clever outside-the-box thinkers who thrive, and how operators handle pressure while evading detection.

When Exchange blocks external forwarding rules, attackers can abuse Power Automate: an Outlook-connected flow silently forwards mail out of the tenant, evading anti-exfiltration controls.