We walk in.
We log in.
We own the kill chain.
A full-spectrum adversary simulation — physical breach, remote compromise, and dark-web intelligence. Starting with nothing but your company domain, we replicate a motivated APT: tailgating doors with a cloned badge, phishing the CFO, pivoting to domain admin, and pulling your data. Then we show you every step.
Two operating theatres. One unified objective.
Run them together for maximum realism, or pick the lane that matches your threat model. Both are driven by a dedicated operations team with segregated OPSEC.
Physical & Proximity Attack
Real-world adversary walks the perimeter, clones the badge, drops the implant. Covert, rules-bound, and fully documented.
- Reconnaissance: site walk, dumpster, OSINT on guards & shifts
- Social engineering: pretext, tailgating, impersonation, delivery ruses
- Badge cloning & RFID attacks (Proxmark3, Flipper Zero, ChameleonMini)
- Lock bypass: picking, bumping, bypass tools, under-door attacks
- Drop devices: LAN Turtle, Shark Jack, Raspberry Pi implants, rogue AP
- HID injection: Bash Bunny, Rubber Ducky, O.MG cable
- Sensor & alarm evasion: PIR, mantrap, camera blind-spots
- Live evidence: video, photos, timestamps, OPSEC log
External & Dark-Web Operation
Purely remote APT simulation. You give us your domain; we build the entire kill chain from public and underground sources.
- Full attack-surface mapping from a single domain
- Subdomain discovery, DNS/ASN sweep, cert-transparency mining
- Exposed services, forgotten assets, shadow-IT identification
- OSINT on employees: LinkedIn, breach data, personal leaks
- Dark-web & leak-site monitoring · initial-access broker chatter
- Credential stuffing against exposed portals (MFA-aware)
- Phishing, vishing, smishing, MFA-fatigue, adversary-in-the-middle
- Post-compromise: C2, persistence, privilege escalation, exfil simulation
Mapped to MITRE ATT&CK. Executed like it's real.
Each phase corresponds to specific ATT&CK tactics. Every finding ships with tactic/technique IDs — so your blue team can write detections the same week.
Reconnaissance
Domain → subdomain explosion, ASN, DNS, cert transparency, shadow assets, employee OSINT.
Resource Development
Infra build: typo-squat domains, C2, redirectors, weaponized documents, payloads, cloned badges.
Initial Access
Phishing (T1566), valid accounts (T1078), drive-by (T1189), supply chain (T1195), physical (T1200).
Execution
Command & scripting interpreters, HID injection via Bash Bunny / O.MG, scheduled tasks, LOLBAS.
Persistence
Services, scheduled tasks, WMI subs, registry run-keys, drop-device callbacks, rogue AP.
Privilege Escalation
Token impersonation, UAC bypass, Kerberoasting, AD misconfig, print nightmare-class bugs.
Defense Evasion · Credentials · Discovery · Lateral
LOTL, AMSI/ETW bypass, LSASS, DPAPI, NTDS.dit, BloodHound pathing, PsExec/WMI/WinRM pivots.
Collection · C2
Target data staging, encrypted exfil channels, domain fronting, DNS beacons, covert out-of-band.
Exfil & Objectives
Simulated exfil, crown-jewel validation, ransomware readiness, business-impact demonstration.
Hardware attackers actually use.
Our on-site kit mirrors what threat actors bring to an office building. Every tool has a purpose, every tool has a rule of engagement. Deployed under signed authorization, retrieved at engagement end, and fully logged.
We maintain a continuously updated lab so we're never behind the curve. If it's on a ThreatExpress talk or a DEF CON village floor, we probably have one — and a use case.
Flipper Zero
Sub-GHz, NFC, RFID (125kHz), iButton, IR, U2F — the Swiss army knife.
Proxmark3 RDV4
Deep HID/iCLASS/MIFARE/DESFire cloning & downgrade attacks.
ChameleonMini / Ultra
Stealth card emulation · walk past readers without physical card.
HackRF One · Portapack
Sub-GHz/2.4 GHz capture, replay, jam, GPS spoofing.
Ubertooth One
BLE sniffing · key exchange capture · pairing analysis.
Lock Bypass Kit
Picks, bumps, under-door, by-pass, restricted keyways, tubular, wafer.
LF/HF Long-Range Readers
125 kHz long-range capture, 13.56 MHz covert pickup, sleeve-implant rigs.
Raspberry Pi / Pwnagotchi
Drop implants, rogue APs, WPA2 handshake capture, out-of-band C2.
O.MG Cable / Keylogger
Weaponized USB/Lightning cables with embedded implants & keyloggers.
Screen Crab
In-line HDMI mirror · pulls every frame from workstation displays.
Covert Camera Kit
Body-worn & pinhole · PIN-pad recording · evidence for PCI-PTS review.
Signal & EM Capture
RF leakage, USB power analysis, optional side-channel on scoped targets.
Full arsenal. Zero improvisation.
We run every device Hak5 ships — not just the popular ones. Each has a place in a realistic attack chain.
Field-Proven Offensive Toolkit
Give us one line. We'll show you the iceberg.
Everything below is derived from a single input: your company domain. No creds. No agent. No access. Just the public internet and the underground — seen through an attacker's eyes.
Infrastructure
- Subdomain enumeration
- Cert transparency mining
- DNS history & NS recon
- ASN & BGP sweep
- Exposed dev / staging
- Forgotten / EOL assets
- S3 / GCS / Azure blobs
Services
- Port & tech fingerprint
- Exposed admin panels
- VPN / RDP / SSH endpoints
- Corp email gateway
- Public APIs & docs
- CI/CD & registry leaks
- Shadow SaaS footprint
People
- Executive OSINT map
- Employee LinkedIn graph
- Org-chart reconstruction
- Personal email / phone
- Public doc metadata
- Social-media posture
- Travel / schedule leaks
Credentials
- Breach-corpus cross-check
- Combolist appearances
- Infostealer logs (Lumma/Redline)
- Valid-reuse verification
- Corporate cookie theft
- Session token leaks
- Git & paste-site secrets
Code & Docs
- GitHub / GitLab org scan
- Public repo & gist secrets
- Mobile-app extracted keys
- Pastebin / Pastes leaks
- Archive.org snapshots
- Technical docs indexed
- Internal URL enumeration
Threat Landscape
- Targeted adversary chatter
- Ransomware leak-site hits
- Initial-access broker listings
- Impersonation / typo-squat
- Phishing-kit observations
- Third-party supplier risk
- Sectoral TTP matching
What's for sale about you — right now.
Ongoing monitoring across Tor, I2P, Telegram, Discord, clear-web leak sites, and infostealer marketplaces. Because an adversary doesn't check once.
Coverage
Multi-source, operator-driven monitoring — not just automated feeds. Our analysts speak the language, lurk in the channels, and verify before we alert.
- Ransomware group leak sites (LockBit, ALPHV, Play, RansomHub, Qilin, etc.)
- Initial-access broker forums (XSS, Exploit, RAMP) — listings & asks
- Infostealer log marketplaces (Russian Market, Genesis-successors)
- Telegram / Discord threat-actor channels & cash-out groups
- Combolist / breach-corpus cross-referencing with your employees
- Stolen session token & cookie trade tracking
- Carding / accounts-for-sale (where your customers leak)
- Typo-squat, phishing-kit, and impersonation-domain tracking
Credibility your auditors accept.
We don't invent process. We follow the ones regulators and blue teams already trust — mapped end-to-end in the final report.
Enterprise TTP mapping for every finding — detection-ready for your SOC.
Threat-intelligence-based ethical red-teaming for financial services.
UK/HK central-bank intelligence-led assessment alignment.
Pentest Execution Standard · end-to-end operational rigor.
US federal testing methodology baseline.
Findings mapped to Identify/Protect/Detect/Respond.
Open Source Security Testing Methodology Manual.
Recognized red-team operator certification alignment.
Operators, not auditors.
Threat-Actor Fidelity
We study live adversaries (Scattered Spider, LockBit affiliates, nation-state TTPs) and mirror their playbooks — not textbook scenarios.
One Engagement, Two Teams
Dedicated on-site operator team + remote cyber cell, segregated comms, unified objective. Realistic adversary pressure.
Purple-Team Debrief
Every operation ends with a joint debrief — our attackers, your defenders. Detections get written before we leave.
OPSEC You Can Verify
Rules of engagement. White-card mechanics. Legal safe-harbor letters. Deconfliction channels. Your lawyers will approve.
Zero Business Disruption
No destructive payloads. No production ransomware. Simulated exfil only. Production-safe C2. No one's laptop bricks.
Narrative Reports, Not Log Dumps
Executive-grade attack narrative, full technical kill chain, ATT&CK matrix, detection gap analysis, prioritized fix plan.
Adversary-realistic. 4-8 weeks end-to-end.
Scoping, Legal & ROE
Objectives, crown jewels, white cards, legal safe-harbor, deconfliction contacts, no-go list.
Recon & Dark-Web Intel
Attack surface built from domain. Dark-web monitoring. Target dossier for execs & priority assets.
Weaponization & Infra
Phishing infrastructure, payloads, redirectors, cloned badges, rehearsal. OPSEC drills.
Active Operation
Initial access (remote + on-site). Post-ex, lateral movement, privilege escalation, objective hunt.
Reporting & Debrief
Narrative & technical reports. Video walkthrough of the attack. Live purple-team workshop.
Detection Uplift & Retest
Detection-engineering support. Remediation office hours. Free focused retest on critical paths.
What execs, legal & security ask first.
How is red team different from a pentest?
Do I really only need to give you my domain?
Is the on-site physical portion legal?
Will you try to trigger ransomware or data destruction?
How few people in our org should know?
What hardware will operators bring on-site?
What's the typical cost?
Can you run purple-team or TIBER-style engagements?
Find out how far we'd get — before someone real does.
Book a confidential 30-minute scoping call. We'll discuss objectives, crown jewels, ROE, and which theatres (on-site / remote / dark-web) you need. Fixed quote inside 48 hours.