BallisKit

BallisKit provides tooling and services to professional Pentesters & Red Teams.
We develop MacroPack, ShellcodePack, and DarwinOps.

#redteam #infosec

[BallisKit @BallisKit]

Need to red team macOS targets but don't know where to start?

Introducing Mirage C2 🥷! Our new modular, in-memory macOS implant for DarwinOps.

Shell, SOCKS proxy, credential & secret extraction, plus private techniques for process injection, privilege escalation, TCC bypass & persistence.

From initial access to post-exploitation and EDR evasion, BallisKit now brings the full attack chain to macOS.

#RedTeam #macOS

[BallisKit @BallisKit]

We are preparing an optional MCP server for the next version of MacroPack, ShellcodePack, and DarwinOps!
This interface will come in addition to the existing CLI and GUI for our customers who want to integrate redteam tooling with agentic AI! 🤖

#redteam

[BallisKit @BallisKit]

Need to automate payload creation and EDR Evasion for your RedTeam?
The new version of MacroPack is available!
Ready to use EDR evasion, private .NET obfuscator, and initial access !
We also started to integrate exploits for vulnerabilities abused in the wild to improve adversary emulation capacity!

#redteam

[BallisKit @BallisKit]

Need to red team macOS targets but don't know where to start?

Introducing Mirage C2 🥷! Our new modular, in-memory macOS implant for DarwinOps.

Shell, SOCKS proxy, credential & secret extraction, plus private techniques for process injection, privilege escalation, TCC bypass & persistence.

From initial access to post-exploitation and EDR evasion, BallisKit now brings the full attack chain to macOS.

#RedTeam #macOS

[BallisKit @BallisKit]

Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse!
EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s!

https://t.co/c26B8RjtDm

#redteam

[BallisKit @BallisKit]

Need to pivot through a macOS target during a Red Team operation? 🍎
Mirage C2 includes built-in SOCKS proxying, letting operators route traffic through a compromised Mac and reach resources beyond the initial foothold.
Start it. Pivot. Keep moving.
Part of DarwinOps by BallisKit.
#RedTeam #macOS

[BallisKit @BallisKit]

Learn how to Weaponize Adaptix C2 with MacroPack and ShellcodePack!
-> EXE and DLL Sideloading examples
-> LNK spoofing PDF, HTA, Clickonce, etc.
-> EDR Evasion options

#redteam

https://t.co/qzGm5KHp4E

[BallisKit @BallisKit]

Need to automate payload creation and EDR Evasion for your RedTeam?
The new version of MacroPack is available!
Ready to use EDR evasion, private .NET obfuscator, and initial access !
We also started to integrate exploits for vulnerabilities abused in the wild to improve adversary emulation capacity!

#redteam

[BallisKit @BallisKit]

The new BallisKit tool soon to be released, an advanced macOS Mythic implant!
All modular, in memory execution, includes private methods for process injection, TCC bypass, secret grabbing, persistance, malware behavior emulation, EDR Evasion, socks proxy, and more!

#redteam #miragen

[Emeric Nasi @EmericNasi]

I was thinking maybe releasing a zero day smartscreen bypass with the next version of MacroPack Pro!
Only to a limited nb of customers amongst those who bought multiple licenses.
What do you think about that?

[Atsika @_atsika]

I've noticed that @bunjavascript has been gaining a lot of traction lately, so I thought it might be interesting to take a look at its offensive potential 🕵️

The game is evolving and we have now entered a new post-exploitation era made of Virtual Machines and Interpreters. Let's revive some old techniques using modern tools ♻️

https://t.co/4DUeJhMcVq

[BallisKit @BallisKit]

Learn how to Weaponize Adaptix C2 with MacroPack and ShellcodePack!
-> EXE and DLL Sideloading examples
-> LNK spoofing PDF, HTA, Clickonce, etc.
-> EDR Evasion options

#redteam

https://t.co/qzGm5KHp4E

[BallisKit @BallisKit]

Did you know macOS Office macro are still a thing?
Use the latest DarwinOps to generate a Word/Excel payload to load Sliver and Poseidon C2 and act as a Socks Proxy!

#redteam

https://t.co/AH5913G75g

[BallisKit @BallisKit]

ShellcodePack just got even better with V2.8.3!

Turn shellcode, PE files (.NET, Go, Rust, C/C++), and third-party tooling into deployment-ready payloads with advanced weaponization, multiple output formats, built-in EDR evasion capabilities, and seamless integration with your favorite C2 frameworks.

Less time preparing. More time executing.

Learn more: https://t.co/n44SphosYT

[BallisKit @BallisKit]

Running Sliver from a Word Macro on macOS? Yes it's very easy with the future DarwinOps release!
C & Obj-C support , Native ARM64 , JIT-only, Obj-C compatibility, implies full Mythic Poseidon loadability. Word/Excel-embedded JXA execution, no osascript binary involved.

#redteam #macos

[Emeric Nasi @EmericNasi]

I will be at the "LeHack" conference in Paris with the @BallisKit team end of the week!
Ping me if you want to have a chat!

[BallisKit @BallisKit]

Running Sliver from a Word Macro on macOS? Yes it's very easy with the future DarwinOps release!
C & Obj-C support , Native ARM64 , JIT-only, Obj-C compatibility, implies full Mythic Poseidon loadability. Word/Excel-embedded JXA execution, no osascript binary involved.

#redteam #macos