André Tschapeller of SSE wrote a post that serves as a base to create your own red team infrastructure and gives an overview of the different branches. The C2 side is a Sliver team server behind an Nginx HTTPS redirector that only forwards requests with the right user agent, plus a socat or iptables DNS redirector as the quieter backup channel. The phishing side chains Gophish, a Postfix redirector that strips the tell-tale Gophish headers, and an Office 365 instance as the mail relay. Because the core assets only talk through redirectors, a burned beacon costs you one redirector instead of the whole setup, and Terraform, Vagrant and Ansible rebuild the rest. For the long-standing reference on the same ideas, the Red Team Infrastructure Wiki by Jeff Dimmock and Steve Borosh, written to accompany their BSides NoVa 2017 talk, collects redirector, phishing and hardening recipes. Also, tell your cloud provider you are a red team, or it will shut your boxes down without asking.
