X-C3LL wrote a refreshingly honest rant arguing that nobody actually knows what the “state of the art” in red teaming is, because every team operates in its own bubble and keeps its TTPs private until they are burned, profitable or good PR. What does get shared publicly is usually at least a year old, and the hard part these days isn’t getting a phish delivered or executed but honey objects, network detection, isolation and good Active Directory hygiene. The Twitter thread that triggered the rant claimed every red team runs a custom Loki, the C2 that Bobby Cooke and Dylan Tran built to script-jack signed Electron apps; X-C3LL counters that red teams have been quietly backdooring Electron’s app.asar for years. Hot take: the best tradecraft is the tradecraft you’ve never heard of.
