How Is Red Team Infra Formed

Infrastructure used by a red team suffers from a weird balance of requirements: innocuous access to endpoints for targets, secure access to management interfaces for operators and the ability to very quickly make it all go away, and come back in a new and legally-different place. Alongside all those pesky normal “robustness” and “uptime” requirements.

This talk will discuss the logistics and architecture of the infrastructure that CyberCX red team operators rely on. We’ll go over the challenges of scaling to support a large number of simultaneous adversary simulation engagements while avoiding the looming threat of a blue team blog post giving us a threat actor name and detailing all our shortcomings.