Raphael Mudge

0xPrimo published a loader for Havoc's Demon. One detail I'm excited about, he used the JSON-over-HTTP server for the integration: github.com/0xPrimo/Demo... :) Straight-forward example of setting up whatever hooks you want via a PICO run by the loader too.

compost: a WIP experiment in implementing modular, composable tradecraft for a reflective DLL loader github.com/ofasgard/com...

Was linked to this project: Piclang, a statically typed programming language that compiles to Linux and Windows shellcode. I'm a big fan of language-tooling to give flexibility or expose abstractions that are too hard doing things the normal way. Neat to see this work github.com/zarkones/Pic...

Entropia - a compiled language that outputs PIC and Beacon Object Files. Includes AOP-style mix-in modules to hook functions, execute code at begin/end of program. Implements several runtime tradecrafts as examples. Author xaff.dev docs.entropykit.com github.com/entropykit/e...

If you are in London, @rastamouse.me is THE headliner speaker at the beac0n red teaming conference tomorrow talking CS and CPL tradecraft. Tickets here: www.eventbrite.co.uk/e/beacon-26-... Org/conf details here: beac0n.org

It's a Mod, Mod, Mod, Mod World aff-wg.org/2026/09/21/i... TCG update: - .spec files are now modules w/ query-able meta-info - Added hexdump and dump to see intermediate outputs - Added encode&mask for content transforms And, a modular demo for encode/mask: tradecraftgarden.org/simpletransf...

Your weekend reading is here! A first taste of the upcoming, still-under-wraps Phrack 73: “THE PROXY THAT MADE NO SENSE” by Mikko archives.phrack.org/dl/73/the-pr...

Introducing Mirage C2 🥷 — our new modular, in-memory macOS implant for DarwinOps. Shell, SOCKS proxy, secret extraction + private techniques for process injection, privilege escalation, TCC bypass & persistence. The full macOS attack chain, from initial access to post-exploitation. #redteam

New Release Havoc Professional 0.8: Leviathan 🩸 - Introducing Kaine User-Defined C2 - Expanded Linux post-ex capabilities - Refactored port forwarding and sleep masking - Enhanced .NET/PowerSafe execution - In-Memory PE Execution and BOF-PE support Release: www.infinitycurve.org/blog/leviathan

We're looking forward to Beacon 2026, where RastaMouse will present "Yet Another Crystal Palace Talk: Evasion Tradecraft in the Cobalt Strike Ecosystem". Join us for a day of technical content focused on real-world tradecraft. https://ow.ly/MHUr50ZMG4o 📍 St Ethelburga's, London, UK 📅 September 23

Playing a Different Game: Rethinking Modern Defense Evasion c0rnbread.com/playing-a-di... """Sometimes the most effective tradecraft isn't the most technically sophisticated. You don't always win by playing the game better and better, but by playing beyond the rules of the game.""" Mmmm hmmm...

Armitage and Metasploit Collaboration (NoVa Hackers - May 2011) I thought this one was lost. One of my earliest talks on the red team collaboration vision for Armitage and some reflection from using it in some 2011 exercises. www.youtube.com/watch?v=Mjr9...

I always look forward to when we, CISA’s red team, gets to publish our reports, and today is one of those days! “A Tale of Two SOCs” - a story where we targeted two different orgs, with the same tradecraft, and very different responses. Read it! - www.cisa.gov/news-events/...

The Game Has Changed: Rapid PIC Development with Crystal Palace and Cobalt Strike by Will Burgess [Beware, marketing wall will ask for email few mins in] www.cobaltstrike.com/the-black-ha... Demos a Universal Loader which modularizes loader problem set & allows mix/match of tradecraft in it. 🙌

Hi everyone, our latest post explores the practical considerations of AI-assisted source code analysis, evaluating the pros and cons of frontier and locally-hosted models while using a variety of harness orchestration designs. blog.includesecurity.com/2026/08/web-...

Metasploit 6.5 is out just in time for Hack Summer Camp. This release comes with Malleable C2 support for Meterpreter, more relaying improvements and an integrated MCP server. Check out all the details here: https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/

Carrying NCCDC Forward alexlevinson.wordpress.com/2026/07/28/c... A new home for NCCDC ncr.foundation/news/nccdc-n... The National Collegiate Cyber Defense Competition is moving to NCRF, a non-profit helmed by long-time event volunteers Alex Levinson & Dave Cowen. I trust both w/ this stewardship

Join Cobalt Strike’s Will Burgess at the Fortra Black Hat USA booth #2939 for his presentation “The Game Has Changed: Rapid PIC Development with Crystal Palace and Cobalt Strike.” See you there Weds, August 5th at 12:30 p.m. Full schedule here https://www.cobaltstrike.com/the-black-hat-experience

Hi, bluesky. I just created my account. And I wanted to share two of my most recent posts here about Crystal Palace and Mythic. fallenangel666-blog.pages.dev/posts/crysta... fallenangel666-blog.pages.dev/posts/mythic...

My first blog post is up: "Pop a Calc: The Crystal Palace Way" Reinventing msfvenom's Pop a Calc shellcode using Crystal Palace and exploring offensive tradecraft vs capability separation. kerekesha.com/blog/pop-a-c...

Got a little bof2pico tool working (based on @raphaelmudge.bsky.social's "Simple BOF Runner") to convert BOFs into PICOs that celebi knows how to execute :) parsing arbitrary argument datatypes into the BOF argument format is a little more challenging, though.

"Some Magic Linker" - a tour of Crystal Palace and TCG. This video demos CPL's features and how they support time-of-use-composition. This enables modular tradecraft & capability recombination. This encourages use/color-agnostic tradecraft, separable from specific capability vimeo.com/1209887681

LSH delish aff-wg.org/2026/07/16/l... Another CPL and TCG update: Specify language-specific exception handlers in +unwind, user-defined intrinsics, and callnear to make before/after more useful.

New post about a CET compatible stack spoofing technique and a loader integrating it :) bigbingus.com/posts/bingus... github.com/Sizeable-Bin...

Here’s a technical overview of ADWS, why it matters, and how it can be leveraged for stealthier Active Directory enumeration. josupalacios99.github.io/blog/en/post...

Cruising Forward with the Tradecraft Garden New update: * New cpl [verb] CLI interface * We have an install script! * More API hashing options aff-wg.org/2026/06/29/c...

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy! dirkjanm.io/bypassing-co...

A Long-running BOF Component Contract aff-wg.org/2026/06/10/a... An architecture and Crystal Palace best practice focused riff on Async PICOs and Custom Beacon Wakeups in Cobalt Strike by Marcos Gonzalez Hermida www.nccgroup.com/research/asy... Short LR-BOFs demo: vimeo.com/1200217753

Cobalt Strike 4.13 is live! Say "Hello World" to our Beacon Interpreter for native C scripting - plus an LLVM Beacon, smoother docking UX, sharper payload management and more. Read about all the new features in the release blog! https://ow.ly/bynP50Zaae4

I always loved software release days. Whenever I worked an update, I was imagining the things folks could do after. But, I also made changes inspired by a question or need from individuals too. I never promised anything. I liked to let the action of shipped code, addressing X, etc. be the message.

New Release: Havoc Professional 0.7 K-Noir 🐺 New Linux implant for x86_64 and AArch64, Stack Spoofing related improvments such as CET compliance and a function rule system, new registry manipulation extension and injection based capabilities. Link: www.infinitycurve.org/blog/k-noir

There are other offensive services CISA does and there are other openings. But this one specifically is for red team, and we are every sense of that, an actual red team. We don’t do pen tests, mobile app reviews, etc. It’s one of the coolest missions you could join.

Crystal Kit - Sliver - A sliver port of @rastamouse.me 's Crystal Kit by Simone Licitra: github.com/licitrasimon... Via: www.linkedin.com/posts/simone... (Cool to see Crystal Kit for CS, Xenon for Mythic, and now Sliver. Really really cool)

Relax and unwind in the Tradecraft Garden aff-wg.org/2026/06/01/r... Celebrating one year of Tradecraft Garden. 40 blog posts. ~30 POCs/projects. A lot of thank you's inside. The release itself: stack unwinding data generation, reference relaxation in the linker, and COFF mixing (+disco baby!)

I'm a little late on this. Primo (x.com/cr4ckeddd) is continuing work on TinyC2. Added built-in Lua scripting to it: x.com/cr4ckeddd/st... Project is at: github.com/0xPrimo/Tiny... Seems a bunch of other post-ex added too.

Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual Also manages to sprinkle in a few references to not using CVD as being not "responsible". (Microsoft was a big proponent of the term "responsible disclosure", which has gone by the […]

Analysis of a Ransomware Breach was inspired partially by outcry over disclosure of the Bad Successor vuln. aff-wg.org/2025/09/26/a... "Uncoordinated disclosures that put [POC] code for unpatched vulnerabilities into the hands of bad actors are never justifiable" www.microsoft.com/en-us/msrc/b...