Cyber Red Teaming

Cyber Red Teaming

Red teaming is authorized adversary simulation: a controlled, scoped engagement where defenders learn how their controls actually perform against an attacker’s full toolkit. Unlike a vulnerability scan or a penetration test (which usually target specific systems), red team engagements model real adversary behavior end-to-end — initial access, persistence, lateral movement, exfiltration, and impact — to test the defender’s detection and response as much as the technical controls themselves.

This page covers methodology and operational concerns for the community’s authorized work. For the defender’s view of these same techniques, see the Adversary Threats Catalog. For the certification path, see OSCP and GPEN.

Authorization is non-negotiable

Every technique on this page can be a federal crime when performed without explicit, written, scoped authorization from the system owner. “I was just testing” is not a legal defense in any U.S. jurisdiction. Don’t run authorized tactics against systems you don’t have authorization to test. See Ethical and Legal Considerations below.

Red team vs. pentest vs. vulnerability assessment

These terms get mixed up; the distinction matters for scoping engagements.

Activity	Goal	Scope	Output
Vulnerability assessment	Find weaknesses	Broad, often automated	Prioritized vuln list
Penetration test	Exploit known weaknesses	Defined systems, time-boxed	Proof of exploitability + remediation guidance
Red team	Achieve a defined objective like an adversary would	Anything the actor would touch in pursuit of the objective	TTPs used, detection gaps, defender response timeline
Purple team	Red + Blue working together	Joint exercise	Detections added, controls validated

Red teams answer “can a determined adversary do X in our environment, and would we know?” Pentests answer “is this thing exploitable?”

Engagement lifecycle

1. Scoping — define the objective (“exfiltrate cardholder data from the prod database”), the rules of engagement (in-scope networks, out-of-scope systems, blackout windows), the authorization chain (who can stop the engagement), and success criteria.
2. Reconnaissance — OSINT on the org, employees, infrastructure, third-party dependencies. Builds the target picture.
3. Initial access — phishing, exposed services, supply chain, physical entry, sockpuppet-aided social engineering. Often the longest phase.
4. Establish foothold — persistence on the initial host; usually a C2 channel.
5. Internal recon — credential collection, lateral pathfinding, identifying systems that satisfy the objective.
6. Lateral movement — pivoting, privilege escalation, traversing trust boundaries.
7. Action on objective — execute the success criteria. Capture evidence.
8. Cleanup and reporting — remove artifacts (per scope), document the kill chain, deliver findings.
9. Debrief / readout — work with blue team to translate findings into detections and control changes.

The methodology framework most engagements track to is MITRE ATT&CK. Read the Enterprise matrix and map your TTPs to it — both for client communication and to make blue-team translation easier.

Ethical and Legal Considerations

This is the single most important section and the easiest to get wrong.

• Get authorization in writing. A signed statement of work or rules of engagement letter. Verbal authorization is worthless if something goes wrong.
• Verify the signer has authority. A network admin can’t authorize a test against systems that legal/compliance owns. For multi-tenant infrastructure, the cloud provider may need to be notified separately.
• Scope the authorization narrowly. “All your systems” is rarely what the signer means. Document IP ranges, domains, applications, physical locations, and personnel categories explicitly.
• Document out-of-scope. Production payment systems, life-safety systems (hospitals, ICS), and third-party SaaS providers are common carve-outs.
• Respect blackout windows. Don’t test during financial close, public events, or emergencies.
• Pre-arrange a kill switch. A direct contact, a code phrase, a way to pause the engagement instantly if real damage is happening.
• Comply with data protection laws. Even authorized access to PII triggers GDPR, HIPAA, PCI, etc. — handle, store, and dispose of captured data per legal requirements.
• Watch jurisdictional issues. Multi-country orgs may require authorization from each affected jurisdiction; some countries’ laws are stricter than U.S. CFAA.
• Disclosure ethics. If you find a vuln in third-party software during an engagement, follow coordinated disclosure with the vendor — don’t leave it for the next attacker.

For community-led training and CTF work: only target systems explicitly provided for that purpose (HTB, TryHackMe, OffSec labs, official CTF infra). Never test on a service whose ToS prohibits it without prior written exception.

Initial-access tradecraft

The community has dedicated pages for the main vectors:

• Phishing Simulation — running authorized email/SMS campaigns with Canary tokens, Twilio, and simulator platforms.
• Sockpuppet Accounts — long-lived personas for social engineering and OSINT.
• Physical Security — physical entry testing, RFID, tailgating, badge cloning.
• Location Tracking — AirTag / BLE / UWB techniques.

The defender’s counterpart for each lives in the Adversary Threats Catalog — read both before an engagement so you understand what defenders are watching for.

Operational security (OPSEC)

Red team OPSEC failures are the most common cause of engagement burn — caught early, attribution leaked, evidence to bypass authorization scope. Baseline practices:

• Compartmentalize infrastructure. Per-engagement domains, VPSes, and C2 — never reuse across clients.
• Avoid attribution leaks. No real names in source code, no operator handles in user-agents, no test PCAPs uploaded to public sandboxes.
• Time-bound your C2 infrastructure. Burn after engagement. Don’t keep “the same Cobalt Strike server” around.
• Use redirectors and front domains. Direct C2-to-victim connections are the easiest IOC to block.
• Stage exfiltration data carefully. Encrypt at the foothold, exfil to dead-drop storage, decrypt offline. Don’t pipe customer PII through a public file-share.
• Mirror the operator workflow. If the simulated adversary uses Russian-language tooling, run Russian-language tooling. Don’t ship a Cobalt Strike beacon when you’re emulating a script-kiddie crew.

For deeper anonymity tradecraft, see the Sockpuppet Accounts page (especially the OPSEC sections) and the broader VPN and Tracking Prevention guidance.

Toolkits

This is a rapidly evolving space — names below are starting points, not endorsements. Vet the source, version, and supply chain before running anything in your offensive environment.

Command and control

• Mythic (open-source, multi-agent, actively maintained)
• Sliver (BishopFox, open-source, Go-based)
• Cobalt Strike (commercial; the most common red-team C2)
• Brute Ratel (commercial; gaining adoption)

Initial access / phishing

• Evilginx — AitM phishing (passwords + session tokens). Defender counterpart: phishing defender’s guide.
• Gophish — phishing campaign management (authorized use)
• King Phisher — multi-channel campaigns
• See Phishing Simulation for the community’s adopted setup.

Active Directory / Windows internals

• BloodHound + SharpHound — AD attack-path mapping
• Impacket — protocol-level Windows operations
• CrackMapExec / NetExec — multi-host AD operations
• Rubeus — Kerberos abuse

OSINT and recon

• Maltego — entity graphing
• Recon-ng — modular recon framework
• See Research Tools for the broader OSINT toolkit.

Physical

• Proxmark3 — RFID/NFC cloning
• Flipper Zero — handheld multi-protocol RF + NFC + iButton
• See Flipper Zero and Physical Security.

Case studies and scenarios

The richest case studies are the public adversary writeups — they show real TTPs against real defenders. Recommended:

• Adversary Threats Catalog — community-maintained, includes the Signal/RIS campaign with full TTPs mapped to ATT&CK
• MITRE Groups — TTPs by tracked threat actor
• Mandiant APT reports — annual writeups
• Citizen Lab research — mercenary-spyware case work
• Krebs on Security — long-form criminal-ecosystem investigations

For self-directed practice scenarios: HTB Pro Labs, OffSec OSCP/OSEP labs, RangeForce, TryHackMe red-team paths.

Communication security

Engagement comms get attacked too — both by accident (over-permissive client portals) and by actual adversaries who notice a red team in motion. Baseline:

• Operator-to-operator: Signal with safety-number verification, or Matrix with cross-signed devices.
• Operator-to-client: encrypted email (PGP or S/MIME) for findings; never plain email for credentials or PII.
• File sharing: use end-to-end encrypted storage (CryptPad, encrypted ZIP via separate channel for the password) — not public file-shares.
• Reporting: deliverables encrypted; client-side decryption only.

See Email Hardening and Secure Messaging for the broader patterns.

Training and certifications

• OSCP — community entry point; hands-on Linux + Windows exploitation
• GPEN — SANS pentesting cert
• OSEP / OSED — OffSec advanced courses (evasion, exploit dev)
• CRTO / CRTL — Zero-Point Security red-team operator paths
• HTB Pro Labs + HTB Certified Bug Bounty Hunter (CBBH) — practical depth

For community learning:

• Run informal CTFs and tabletops with willing participants — they’re the best way to surface gaps
• Pair red and blue team members on shared incidents (purple-team approach)
• Document techniques the team uses successfully — keep an internal ATT&CK-mapped playbook

Feedback and incident reporting

If you discover something during community-led testing that needs disclosure:

• Coordinate disclosure with the affected vendor first (90 days is industry baseline, shorter for critical/exploited issues)
• Document what was tested, when, and by whom
• For ethical concerns about a community engagement, raise to the engagement lead and a separate ethics contact — don’t sit on issues you’ve spotted

Related

• Adversary Threats Catalog — defender’s view of the same TTPs
• Phishing Simulation
• Sockpuppet Accounts
• Physical Security
• Location Tracking
• Cyber Incident Response Guide — the receiving end of a real attack
• OSCP / GPEN — certification paths
• MITRE ATT&CK — TTP framework