Metasploit 6.5 is out just in time for Hack Summer Camp. This release comes with Malleable C2 support for Meterpreter, more relaying improvements and an integrated MCP server. Check out all the details here: https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/

Rapid7

Metasploit Framework 6.5 launches with Malleable C2 profile support, new MCP server integration support for AI-tooling, NTLM relaying upgrades, and MITRE ATT&CK tagging to streamline threat emulation

rapid7.com

Carrying NCCDC Forward alexlevinson.wordpress.com/2026/07/28/c... A new home for NCCDC ncr.foundation/news/nccdc-n... The National Collegiate Cyber Defense Competition is moving to NCRF, a non-profit helmed by long-time event volunteers Alex Levinson & Dave Cowen. I trust both w/ this stewardship

Carrying NCCDC Forward

After 21 years of stewardship, UTSA and the Center for Infrastructure Assurance and Security are transitioning the National Collegiate Cyber Defense Competition to a new home. Dave Cowen and I are …

alexlevinson.wordpress.com

I wrote a little bit about COFF Mixing rastamouse.me/coff-mixing/

Presenting Sparkle A fake LLM that leaks secrets Like an SSH or RDP, or SMB Honeypot Sparkle allows attackers to interact with it, make API calls, but its all fake. It’s actually not even connected to an LLM. 😎😀 More refinement, but this is our v1 Enojoy github.com/AlloySecureG...

Join Cobalt Strike’s Will Burgess at the Fortra Black Hat USA booth #2939 for his presentation “The Game Has Changed: Rapid PIC Development with Crystal Palace and Cobalt Strike.” See you there Weds, August 5th at 12:30 p.m. Full schedule here https://www.cobaltstrike.com/the-black-hat-experience

Hi, bluesky. I just created my account. And I wanted to share two of my most recent posts here about Crystal Palace and Mythic. fallenangel666-blog.pages.dev/posts/crysta... fallenangel666-blog.pages.dev/posts/mythic...

My first blog post is up: "Pop a Calc: The Crystal Palace Way" Reinventing msfvenom's Pop a Calc shellcode using Crystal Palace and exploring offensive tradecraft vs capability separation. kerekesha.com/blog/pop-a-c...

Got a little bof2pico tool working (based on @raphaelmudge.bsky.social's "Simple BOF Runner") to convert BOFs into PICOs that celebi knows how to execute :) parsing arbitrary argument datatypes into the BOF argument format is a little more challenging, though.

"Some Magic Linker" - a tour of Crystal Palace and TCG. This video demos CPL's features and how they support time-of-use-composition. This enables modular tradecraft & capability recombination. This encourages use/color-agnostic tradecraft, separable from specific capability vimeo.com/1209887681

Some Magic Linker

A feature tour of Crystal Palace.

vimeo.com

I know some folks had reached out in the past. Meant to cross post here earlier Our team has built some prototypes and we have some cyber deception training. Feedback welcome, enjoy. github.com/AlloySecureG...

GitHub - AlloySecureGroup/PhantomFS: PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant ...

PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the mom...

github.com

Had a little play with user-defined intrinsics in Crystal Palace to POC a new intrinsic that I'd like to see get official adoption 🙏🏻 rastamouse.me/crystal-pala...

LSH delish aff-wg.org/2026/07/16/l... Another CPL and TCG update: Specify language-specific exception handlers in +unwind, user-defined intrinsics, and callnear to make before/after more useful.

LSH delish

Another Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn’…

aff-wg.org

New post about a CET compatible stack spoofing technique and a loader integrating it :) bigbingus.com/posts/bingus... github.com/Sizeable-Bin...

BingusLdr: CET Compatible Stack Spoofing | bigbingus.com

BingusLdr: CET Compatible Stack Spoofing

bigbingus.com

[BLOG] A quick look at Crystal Palace's hook chains and why you should consider them over single hooks for layering evasive tradecraft. rastamouse.me/cpl-hook-cha...

Here’s a technical overview of ADWS, why it matters, and how it can be leveraged for stealthier Active Directory enumeration. josupalacios99.github.io/blog/en/post...

Cruising Forward with the Tradecraft Garden New update: * New cpl [verb] CLI interface * We have an install script! * More API hashing options aff-wg.org/2026/06/29/c...

Cruising Forward with the Tradecraft Garden

A new Tradecraft Garden and Crystal Palace release is available. This release introduces a proper install script and consolidates its commands behind a cpl [verb] CLI interface. I’ve also added an …

aff-wg.org

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy! dirkjanm.io/bypassing-co...

A Long-running BOF Component Contract aff-wg.org/2026/06/10/a... An architecture and Crystal Palace best practice focused riff on Async PICOs and Custom Beacon Wakeups in Cobalt Strike by Marcos Gonzalez Hermida www.nccgroup.com/research/asy... Short LR-BOFs demo: vimeo.com/1200217753

Long-running BOFs Demo

An architectural POC for long-running BOFs.

vimeo.com

Cobalt Strike 4.13 is live! Say "Hello World" to our Beacon Interpreter for native C scripting - plus an LLVM Beacon, smoother docking UX, sharper payload management and more. Read about all the new features in the release blog! https://ow.ly/bynP50Zaae4

I always loved software release days. Whenever I worked an update, I was imagining the things folks could do after. But, I also made changes inspired by a question or need from individuals too. I never promised anything. I liked to let the action of shipped code, addressing X, etc. be the message.

New Release: Havoc Professional 0.7 K-Noir 🐺 New Linux implant for x86_64 and AArch64, Stack Spoofing related improvments such as CET compliance and a function rule system, new registry manipulation extension and injection based capabilities. Link: www.infinitycurve.org/blog/k-noir

Havoc Professional 0.7: K-Noir

An introduction to Havoc Professional 0.7 K-Noir, featuring a new Linux implant for x86_64 and AArch64, CET compliant stack spoofing and rules systems, new Direct and P2P communication channels, new m...

infinitycurve.org

Cobalt Strike 4.13 has a new Aggressor hook to support BOF cocktails. Here's a quick walkthrough: rastamouse.me/bof-cocktail...

Interesting post by Marcos Gonzalez Hermida: Async PICOs and Custom Beacon Wakeups in Cobalt Strike. www.nccgroup.com/research/asy...

I had the occasion to play with EAF the other day, so I added a bypass to the TCG's PIC services module. It provides a way to resolve Win32 APIs through gadget in NTDLL's .text section.

There are other offensive services CISA does and there are other openings. But this one specifically is for red team, and we are every sense of that, an actual red team. We don’t do pen tests, mobile app reviews, etc. It’s one of the coolest missions you could join.

Chris Truncer@christruncer.bsky.social · 2mo ago

You interested in hacking and want to red team the government? CISA’s red team has an opening! Our assessments are typically 90 days and we’re performing actual red team work here. Check out the opening, and let me know if you have any questions! usajobs.gov/job/871378500

Crystal Kit - Sliver - A sliver port of @rastamouse.me 's Crystal Kit by Simone Licitra: github.com/licitrasimon... Via: www.linkedin.com/posts/simone... (Cool to see Crystal Kit for CS, Xenon for Mythic, and now Sliver. Really really cool)

GitHub - licitrasimone/CrystalSliver: Crystal Palace Evasion kit for Sliver

Crystal Palace Evasion kit for Sliver. Contribute to licitrasimone/CrystalSliver development by creating an account on GitHub.

github.com

Relax and unwind in the Tradecraft Garden aff-wg.org/2026/06/01/r... Celebrating one year of Tradecraft Garden. 40 blog posts. ~30 POCs/projects. A lot of thank you's inside. The release itself: stack unwinding data generation, reference relaxation in the linker, and COFF mixing (+disco baby!)

Relax and unwind in the Tradecraft Garden

We’re at the 12th release of Crystal Palace and marking one year in the Tradecraft Garden. This release adds reference relaxation to make global references PIC-friendly. I’ve also added stack unwin…

aff-wg.org

I'm a little late on this. Primo (x.com/cr4ckeddd) is continuing work on TinyC2. Added built-in Lua scripting to it: x.com/cr4ckeddd/st... Project is at: github.com/0xPrimo/Tiny... Seems a bunch of other post-ex added too.

Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual Also manages to sprinkle in a few references to not using CVD as being not "responsible". (Microsoft was a big proponent of the term "responsible disclosure", which has gone by the […]

Analysis of a Ransomware Breach was inspired partially by outcry over disclosure of the Bad Successor vuln. aff-wg.org/2025/09/26/a... "Uncoordinated disclosures that put [POC] code for unpatched vulnerabilities into the hands of bad actors are never justifiable" www.microsoft.com/en-us/msrc/b...