Blog

When AWS IoT Secure Tunneling Opens the Door From the Inside

Red Team

Amazon's IoT Secure Tunneling reaches devices behind a firewall through AWS-managed infrastructure. Open the tunnel in your own account and no IoT control-plane record of it ever reaches the target's.

AWS IoT Core MQTT: A C2 Credential Measured in Years

Red Team

A certificate-authenticated C2 channel bounded by years instead of a session clock, carried on port 443 to an Amazon endpoint, plus what a C2 stack really does at the 128 KB message cap.

Traffic Filtering on Your C2 Redirector: What to Inspect and in What Order

Red Team

A layered filtering stack for C2 redirectors: network controls, User-Agent validation, HTTP methods, URI paths, headers, IP blocking, and cookie checks, applied in the right order.

Serverless C2 Redirectors: Lambda Functions and Infrastructure as Code

Red Team

Build a serverless C2 redirector using AWS Lambda and API Gateway, deployed with Terraform. No persistent server, no attack surface, teardown in one command.

Three Ways to Hide C2 in Trusted Traffic

Red Team Blue Team

Three techniques that exploit implicit trust in cloud providers: domain fronting, cloud service tunneling, and dead drops. Each strips away one more thing defenders can grab onto.

Layered Red Team C2 Infrastructure: Architecture and Trust Boundaries

Red Team

A deep dive into layered red team C2 infrastructure design, covering how CDNs, redirectors, and trust boundaries work together to protect your C2 server from defender discovery.

When Azure Relay Becomes a Red Teamer's Highway

Red Team

Microsoft's Azure Relay Bridge (azbridge) creates encrypted tunnels between on-premises resources and Azure. Learn how red teamers can leverage this legitimate service for covert communications.

Splunk BOTS V1: Ransomware

Blue Team Write-ups

Splunk's Boss of the SOC is essentially a CTF-style challenge for blue teamers. Walk through the ransomware scenario and learn how to hunt threats using Splunk.