Realm

Cross platform red team tool with a focus on automation and reliability.

[Realm @Realm_C2]

STONK 📈

[Realm @Realm_C2]

Coming soon to a red team operation near you!
Beacon notifications! 🔔 Stay up to date on hosts lost and gained.

[Realm @Realm_C2]

Time to upgrade the Ludus lab! 🙌
@badsectorlabs very excited ❤️

[Realm @Realm_C2]

Leaving your c2 to use SSH, MSF, nmap - HUGE pain.

Why not just use them from the browser!

Since realm's network proxy is all server side we were able to build other things like SSH into the backend and in go connect the sockets.

[Realm @Realm_C2]

Structured data at the click of a button! 🤩

[Realm @Realm_C2]

New file hosting feature! 📁
Host files and share them for a duration or with a specific number of downloads.
Or use them directly in the imix agent.

[Realm @Realm_C2]

New bandwidth benchmark - wheels on the bus cocomelon.

[Realm @Realm_C2]

RDP over new socks proxy! 😤
Next step playing counter strike 🎮

[Realm @Realm_C2]

😤

[Justin Elze @HackingLZ]

### Top-Line Findings

1. **The C2 ecosystem is far less diverse than it appears.** While there are 30+ "different" frameworks, the underlying technique implementations converge on a small number of canonical code patterns, many traceable to specific open-source authors or blog posts.

2. **Three source projects account for the majority of reused code:**
- **TrustedSec's COFFLoader** — the ancestor of nearly every open-source BOF loader
- **PowerSploit** (by @harmj0y, @mattifestation, @obscuresec) — Get-Keystrokes, Invoke-Mimikatz, PowerView, and persistence modules are shipped verbatim by Empire, PoshC2, PowerHub, Amnesiac, and Shad0w
- **Kevin Robertson's Invoke-WMIExec/Invoke-SMBExec** — the dominant PowerShell implementations for WMI and SMB lateral movement, bundled by Empire, PoshC2, PowerHub, and SilentTrinity

3. **A single detection rule can catch multiple frameworks.** Because many C2s share identical implementation code:
- One detection for the PowerSploit `Get-Keystrokes` GetAsyncKeyState polling loop catches Empire, PoshC2, and any framework that bundles PowerSploit
- One detection for the TrustedSec COFFLoader relocation pattern catches Apollo, Loki, Sliver (extension), and derivatives
- One detection for the .NET `ManagementScope` WMI pattern catches Apollo, Covenant, NimboC2, SilentTrinity, and DeimoC2

4. **Genuinely novel frameworks are rare.** Of the 30 analyzed:
- **4 frameworks** (Sliver, Havoc, Realm, TripleCross) demonstrate significant code originality
- **6 frameworks** show moderate originality (Wyrm, AdaptixC2, Emp3r0r, Merlin, NimPlant, GC2)
- **20 frameworks** rely heavily on shared code from the three source projects above, or implement techniques using the same well-known recipes

5. **HTTP C2 communications show the most behavioral convergence.** Three jitter formula families, shared User-Agent strings (the IE11 UA appears in Empire, Nuages, and Covenant), and common URL path patterns create fingerprinting opportunities.

[Justin Elze @HackingLZ]

### Top-Line Findings

1. **The C2 ecosystem is far less diverse than it appears.** While there are 30+ "different" frameworks, the underlying technique implementations converge on a small number of canonical code patterns, many traceable to specific open-source authors or blog posts.

2. **Three source projects account for the majority of reused code:**
- **TrustedSec's COFFLoader** — the ancestor of nearly every open-source BOF loader
- **PowerSploit** (by @harmj0y, @mattifestation, @obscuresec) — Get-Keystrokes, Invoke-Mimikatz, PowerView, and persistence modules are shipped verbatim by Empire, PoshC2, PowerHub, Amnesiac, and Shad0w
- **Kevin Robertson's Invoke-WMIExec/Invoke-SMBExec** — the dominant PowerShell implementations for WMI and SMB lateral movement, bundled by Empire, PoshC2, PowerHub, and SilentTrinity

3. **A single detection rule can catch multiple frameworks.** Because many C2s share identical implementation code:
- One detection for the PowerSploit `Get-Keystrokes` GetAsyncKeyState polling loop catches Empire, PoshC2, and any framework that bundles PowerSploit
- One detection for the TrustedSec COFFLoader relocation pattern catches Apollo, Loki, Sliver (extension), and derivatives
- One detection for the .NET `ManagementScope` WMI pattern catches Apollo, Covenant, NimboC2, SilentTrinity, and DeimoC2

4. **Genuinely novel frameworks are rare.** Of the 30 analyzed:
- **4 frameworks** (Sliver, Havoc, Realm, TripleCross) demonstrate significant code originality
- **6 frameworks** show moderate originality (Wyrm, AdaptixC2, Emp3r0r, Merlin, NimPlant, GC2)
- **20 frameworks** rely heavily on shared code from the three source projects above, or implement techniques using the same well-known recipes

5. **HTTP C2 communications show the most behavioral convergence.** Three jitter formula families, shared User-Agent strings (the IE11 UA appears in Empire, Nuages, and Covenant), and common URL path patterns create fingerprinting opportunities.

[Realm @Realm_C2]

@C2Workbench Hey! That’s us 🙂👋
The install instructions look a little complicated - we usually recommend the steps in the README to get started locally or terraform apply for production.

[Realm @Realm_C2]

Excited to share a sneak peek of Eldritch v2!
We’ve been rebuilding our automation language from scratch to make it stealthier and more modular. Try it out now!

https://t.co/X1cmPtPhkk

[Realm @Realm_C2]

Realm now has global filters!

Filters can be applied to most views and stick with you throughout the experience making it easier to work with the same set of beacons or tasks.

[Realm @Realm_C2]

And TLS will be available eventually... 😓

[Realm @Realm_C2]

https://t.co/vbtW3j1tzw

We've started a blog to document some of the design decisions we make throughout the development process! 🙌

Our first posts highlights the new redirectors features and the challenges that app layer crypto posed.

[Realm @Realm_C2]

Realm app layer crypto is here! 🔒
Agents can be built with a server public key.
Transports leverage an ephemeral diffie-hellman key-exchange and xchacha for message encryption.

It's been a long time coming but it's finally here!
https://t.co/lt94x32ZJR

[Hulto @Hultoko]

Vibe coding @Realm_C2 from inside the metaverse - too much hype 🤯

RIP my movie in the background.

[Realm @Realm_C2]

@badsectorlabs For you? Of course! 🙂

https://t.co/SLbHiTfX22

[Realm @Realm_C2]

We’re now on Discord!
Join the cult 🙌

https://t.co/NC4XPEfANW

[Hulto @Hultoko]

I had the privilege to red team @NationalCCDC this weekend. I had a great time and got to let AI control @Realm_C2 for the first ever AI powered service take down. 🙌

[Realm @Realm_C2]

Realm MCP connector!