Red Team Village — DEF CON 2026

Modern Windows applications are quietly shipping with a built-in Chromium-based browser, WebView2, running inside trusted, signed processes such as Microsoft Teams, Outlook, and other enterprise software.

This talk shows how that design choice creates a powerful and largely unmonitored attack surface.

I demonstrate how this model can be abused in offensive operations, turning WebView2 into a vector for persistence, code execution, and enterprise account impersonation.

I show how feature flags and environment variables can be leveraged to manipulate the WebView2 runtime, enabling techniques such as DLL sideloading within legitimate applications. This allows arbitrary code execution inside trusted processes, supporting stealthy living-off-the-land persistence.

Building on this, I present methods to intercept and proxy HTTP/HTTPS traffic generated by WebView2-based applications. This enables the extraction of session tokens, cookies, and other sensitive artifacts, leading to realistic account takeover and impersonation scenarios, including access to platforms such as Office 365.

In addition to the offensive techniques, I provide a detailed analysis of the Indicators of Compromise (IOCs) generated throughout these attack chains. I highlight detection opportunities, discuss current visibility gaps in EDR solutions, and propose practical approaches for identifying and responding to this type of activity in real-world environments.

ResearchersMurilo Caixeta BR

Modern endpoint defenses increasingly fingerprint .NET tools not only by strings and imports, but by structure: control flow, call graphs, and overall execution "workflows." Traditional IL obfuscation can hide obvious indicators, yet often produces highly regular flattened patterns that are easy to flag on their own.

This talk presents a Roslyn-based, source-to-source obfuscator for C# that rewrites an entire project before compilation. Using the official compiler APIs, it transforms the code's syntax and semantic structure, reshapes control/data flow, and then recompiles the result - while keeping the program's observable behavior intact. The output tends to look complex but "natural," diverging both from the original tool and from the telltale patterns created by many IL-level obfuscators.

I will walk through the pipeline, show how surprisingly little code is needed to build these transformations on Roslyn, and discuss what this means for EDR, sandboxing, and ML detections that rely on graph and workflow analysis of .NET binaries.

So, anyway, on moment of submitting original Seatbelt tool (obfuscated by source) have 10/73 security vendors flagged this file as malicious (can be better).

My project https://github.com/gam4er/Loaders differs from more well known https://github.com/sadreck/Codecepticon by implementing semantic structure obfuscation.

My point of view (as a SOC analyst, blue teamer) on "how to hide my tool from AV" problem is: if you have a code — OBFUSCATE YOUR CODE. Stop modifying binaries.

ResearchersEduardo Chavarro Ovalle CO·Ashley Hiram MX·Alexander Rodchenko

This presentation takes a practical, demo-driven approach to exploitation, demonstrating how a buffer overflow vulnerability can still serve as an entry point to compromise modern industrial infrastructures. The session is approximately 90% hands-on and 10% theoretical.

The talk walks through the full attack chain, starting from initial exploitation and progressing to the development and execution of multistage shellcode. This shellcode establishes communication with a remote Command and Control (C2) server, retrieves an additional payload, and executes it directly in memory, bypassing traditional detection mechanisms.

Once the environment is compromised, the session demonstrates how an attacker can gain full remote control, enabling command execution, lateral movement, and exfiltration of sensitive data, including critical assets such as licenses and proprietary industrial information.

The talk also includes interaction with real-world devices such as RTUs (Remote Terminal Units), showing how malicious actions can directly impact industrial operations. In critical scenarios, this can lead to disruptions in essential services, including failures in energy systems and potential blackouts.

The content is based on real-world pentesting experience conducted in an energy sector company in Brazil, providing a practical and applied perspective on risks in ICS/SCADA environments.

The goal is to demonstrate how modern attacks combine vulnerabilities with advanced techniques, reinforcing the need for robust security strategies to protect critical infrastructure.

ResearchersFernando Mengali BR·Thiago Cunha da Silva BR

Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

• Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).
• PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).
• Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.
• MFA Bypass and Intune: The speakers developed custom tooling to extract local PRTs, bypass Intune device management controls, and circumvent MFA. This entire attack lifecycle was consolidated into Entraith — an offensive framework built from scratch by the research team and set to be released publicly at DEF CON 34 (https://github.com/bl4cksku11/entraith) — enabling device code attacks, token renewal, email and app inspection, token exfiltration, and persistence generation from a single interface.

This talk is not about a single CVE or a niche edge case. It is a comprehensive offensive research presentation covering the full spectrum of attack techniques against Microsoft Entra ID — from the very first foothold to deeply rooted, multi-vector persistence that survives incident response.

We will demonstrate, live, how an attacker moves through every phase of an Entra ID compromise:

Initial access and token theft: We begin with Device Code Flow phishing — abusing Microsoft's own authentication protocol to harvest valid tokens without ever touching a password. We then escalate with PowerShell process hijacking (GrabTokenAzureAD) to intercept live session tokens, and culminate with Sliver BOF-based extraction of the Primary Refresh Token (PRT) directly from memory — stealthy, silent, and anti-malware evasive. These three techniques alone demonstrate that MFA and Conditional Access are not the guarantees organizations believe them to be.

Bypassing Intune and MFA: Purpose-built tools developed during this research extract local PRTs, bypass Intune device compliance controls, and circumvent MFA enforcement at the token layer — not through social engineering, but through direct abuse of Microsoft's identity platform mechanics. Attackers operating from non-enrolled or non-compliant devices can achieve full Tenant access that Conditional Access policies are designed to prevent.

Persistence across 10 vectors: Once inside, we deploy a "Survival Kit" of 10 chained persistence mechanisms — camouflaged App Registrations, long-lived secrets and certificates, backdoor accounts, strategic role assignments, privileged group inheritance, admin mailbox delegation, inbox-rule-based exfiltration of credentials and MFA codes, OAuth consent grants to external applications, and Temporary Access Pass generation for on-demand MFA bypass. No single blue team action — password reset, MFA enforcement, device wipe — removes all of them simultaneously.

Entraith — built by us, released at DEF CON: The centerpiece of this talk is Entraith (https://github.com/bl4cksku11/entraith), an offensive framework designed and built from the ground up by the speakers specifically for this research. Entraith is not a wrapper around existing tools — it is original work, developed over months of hands-on red team engagements against real Microsoft 365 environments. It unifies every technique demonstrated in this talk into a single operator interface: device code phishing, PRT extraction from memory, Intune compliance bypass, token renewal and exfiltration, email and application enumeration, and the full 10-step persistence deployment chain. DEF CON 34 will be the moment Entraith is released to the public. Attendees will be among the first to access the tool, its documentation, and the full methodology behind it — making this talk a genuine first-look at original research with immediate real-world impact.

Why this matters for Cloud Village: The Microsoft 365 and Entra ID ecosystem is the identity backbone of the majority of enterprise organizations worldwide. The techniques presented here are not theoretical — they are being used by real threat actors today. Defenders in the room will leave with concrete detection opportunities and an understanding of exactly which log sources and control gaps allow this attack chain to succeed undetected. Red teamers will leave with a working tool and a fully documented methodology. This talk delivers both offensive depth and defensive utility in a single session, and the live demos ensure no attendee has to take our word for it.

ResearchersElzer Pineda PA·Jose Manuel Rivas PA

Kubernetes is the de facto operating system of the cloud, and more and more organizations are running their workloads on Kubernetes. While Kubernetes offers many benefits, it also introduces new security risks, such as cluster misconfiguration, leaked credentials, cryptojacking, container escapes, and vulnerable clusters.

In this workshop, attendees will learn how to attack Kubernetes clusters by simulating a real-world adversary exploiting one of the most recent vulnerabilities in the ecosystem: IngressNightmare (CVE-2025-1974). Participants will practice exfiltrating service account tokens and credentials, performing lateral movement, escalating privileges by targeting common applications deployed in Kubernetes environments, and ultimately compromising the entire cluster.

ResearchersLenin Alevski MX

AImaru C2 is the evolution of a concept sparked by an unsettling question: What happens when an attacker can execute advanced Living off the Land (LotL) attacks without being an expert? While traditional LotL requires a specialist to navigate complex environments, AImaru C2 changes the game. Evolving from a PoC into a sophisticated Red Team framework, it automates expert-level tradecraft by subverting Anthropic's Model Context Protocol (MCP). By weaponizing MCP clients, it transforms a standard context protocol into a functional, autonomous multi-level RAT that natively "speaks" PowerShell.

AImaru C2 was born out of a critical necessity to ground cybersecurity in reality. While the industry often distracts itself with over-engineered narratives and hype-driven threats that ignore actual ecosystem data, a far more pragmatic danger has been hiding in plain sight. This framework addresses the unsettling evolution of the "Expert Bottleneck": What happens when the sophisticated LotL tactics, once reserved for elite nation-state actors, are democratized through automation? Named after the mythical serpent that glides unseen between the underworld and the land of the living, AImaru C2 represents the shift from manual expertise to autonomous execution. It is no longer just a proof of concept; it is a full-scale Red Team framework designed to expose how easily an unskilled attacker can now weaponize authorized system protocols to orchestrate advanced, data-driven breaches that traditional defenses simply aren't looking for.

To understand its impact, context is key. For years, LotL attacks have been the dominant tactic in ransomware campaigns. Instead of deploying traditional malware, threat actors abuse legitimate OS tools—such as PowerShell, WMI, or Certutil—to operate under the radar. In 2025, 82% of successful breaches were fileless or malwareless, with PowerShell ranking as the second most utilized TTP by groups like Black Basta, Royal, and LockBit.

This robust framework moves beyond experimental concepts, consolidating itself as a production-ready offensive platform. AImaru C2 is engineered with a modular architecture that prioritizes cryptographic integrity, operational security, and intelligent automation.

Core Framework Capabilities:

• Model Context Protocol (MCP) RAT Engine: A paradigm shift in command and control that subverts Anthropic's MCP from a standard context-sharing tool into a functional, undetectable Remote Access Trojan (RAT), tunneling all C2 traffic through legitimate LLM API communication.
• PowerShell Client Builder: An automated obfuscation engine featuring deep variable randomization and structural mutation to break static signatures.
• AMSI Bypass Generator: Dynamic generation of multi-stage bypass scripts, utilizing diverse techniques to neutralize the Antimalware Scan Interface in real-time.
• Real-time Monitoring: Advanced telemetry for live command execution tracking and granular session management.
• Cryptographic Isolation: Implementation of per-client encryption keys derived via HKDF-SHA256, ensuring that the compromise of one beacon does not jeopardize the entire fleet.
• RBAC: Native Role-Based Access Control, strictly segregating permissions between Admins, Users, and Viewers.
• Complete Audit Logging: Forensic-grade command history with millisecond-accurate timestamps for post-operation deconfliction.

By utilizing a multi-tier decision logic, the system dynamically selects and rewrites payloads based on the specific operational objective. This allows the C2 to scale its complexity in real-time—transitioning from basic PowerShell structures and stealthy WMI manipulation to the strategic abuse of LOLBins for high-complexity tasks. This adaptive approach ensures that every command utilizes the most effective legitimate system tool, successfully evading environment-specific defenses by blending into the target's unique operational noise.

Tactic Description: In this interactive session, attendees will sit down with the developer to operate the AImaru C2 framework in a controlled lab environment. Participants will experience the "Natural Language Intent" paradigm shift firsthand, moving away from manual syntax to intent-based exploitation.

Deployment: Deploy a lightweight MCP-Client on a target Windows machine and establish a beacon back to the AI-C2 controller.

Intent-Based Recon: Issue high-level natural language prompts (e.g., "Find sensitive PDF files and identify lateral movement paths") and observe the LLM selecting and generating the appropriate PowerShell/WMI code in real-time.

Automated Evasion: Trigger the Adaptive AMSI Bypass module, witnessing how the framework re-writes its own memory-resident payloads to evade active defenses.

ResearchersMario Lobo CO

ATMs in the end are a computer with windows.

I will talk about EDRs and how parent-child process inheritance works.

The Windows boot process, known as the boot process, is divided into several phases as we have already seen: PreBoot (initialization of BIOS/UEFI firmware and POST), Boot Manager (loading of bootmgr or bootmgfw.efi), OS Loader (execution of winload.exe to load the kernel), and Kernel Initialization (loading of ntoskrnl.exe and hal.dll, initialization of drivers and services). Finally, winlogon.exe is started to present the user interface. This process enables the transition from a powered-off state to a functional operating system through a hierarchical and verified sequence.

Regarding kernel-based EDRs (Endpoint Detection and Response), they operate in kernel mode, the most privileged level of the system (some also operate at the UEFI level), which allows them to monitor low-level activities such as system calls, memory manipulation, driver loading, and file access. By running in this mode, EDRs can detect and block advanced threats such as rootkits or persistent malware that attempt to evade user-mode protections. Their deep integration with the kernel enables real-time monitoring, behavioral analysis, and immediate response to suspicious activities during and after the boot process.

EDRs are typically located in the kernel, but as mentioned, some also operate at the UEFI level. If we recall how Windows works, beneath UEFI lies SMM (System Management Mode), making this an even more complex layer to analyze and operate within.

This talk is intended for individuals interested not only in ATMs and simple cash dispensing, but in going beyond that—focusing on deeper analysis and the full experience gained when confronting these systems.

ResearchersArnold Morales MX

Complete infostealer kill chain hands-on, executed against Windows 11 21H2 on default UAC using only open-source tooling. No zero-days, no commercial C2. Participants run every command live: HTA delivery, Meterpreter in-memory session, Chrome and Edge credential extraction via DPAPI-locked SQLite, keylogging in explorer.exe memory, UAC bypass via fodhelper, SYSTEM via Named Pipe Impersonation, and LSASS dump via Kiwi. The DPAPI_SYSTEM key recovered from LSA secrets decrypts the browser credentials captured earlier, closing the loop.

OUTLINE

• Stage 1: generate HTA payload, deliver via Python HTTP server, open Meterpreter session
• Stage 2: extract Chrome and Edge credentials via post module, inspect DPAPI-encrypted loot
• Stage 3: migrate to explorer.exe, start keyscan, capture live keystrokes
• Stage 4: UAC bypass via fodhelper registry hijack, elevate to SYSTEM via Named Pipe Impersonation
• Stage 5: load Kiwi, dump NTLM hashes, SAM, LSA secrets, extract DPAPI_SYSTEM key, decrypt browser loot
• Detection debrief: Sysmon Event ID 1 process tree and PowerShell Script Block log review per stage

TAKEAWAYS

1. A complete credential theft playbook from HTA delivery to LSASS dump, validated against Windows 11 21H2 with Chrome 147 and Edge 147 on default UAC, ready to adapt for engagements.
2. The DPAPI close-loop: how DPAPI_SYSTEM from LSA secrets decrypts browser credentials collected earlier, giving operators a concrete credential pivot from a single user-context session.
3. A detection gap map calibrated against real Sysmon telemetry showing which events fire on default Windows 11 and which require EDR behavioral rules most organizations do not have deployed.

ResearchersFilipi Pires BR

In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO

ML-based DPI and DLP solutions have made signature evasion insufficient. Modern enterprise detection analyzes packet size distributions, inter-packet timing, and burst patterns to fingerprint C2 traffic regardless of how well headers and TLS certificates are spoofed.

This talk demonstrates how three techniques from the VPN privacy research space - originally developed to defeat traffic analysis against Tor and Mullvad, can be adapted for offensive C2 operations:

1. Constant-size packet morphing: forcing all frames to a fixed MTU-aligned size removes the packet-size fingerprint that ML classifiers depend on;

2. Cover traffic injection: dummy packets sent at Poisson-distributed or adaptive intervals make real beacon timing statistically invisible;

3. Probabilistic pattern distortion: Maybenot-inspired state machines inject cover bursts alongside real packets, destroying recognizable C2 sequences;

We then will see how layering these techniques with application-layer malleable profiles (traffic impersonating Microsoft Graph, Slack, or Okta) and bonus: indirect transports like cloud storage dead-drops (S3, OneDrive) creates C2 channels that defeat detection at every layer simultaneously - behavioral, flow, and application.

Attendees leave with a concrete mental model for building evasion stacks that go beyond header manipulation.

ResearchersRafael Felix BR

This hands-on tactic focuses on making CVE discovery and publication practical, accessible, and repeatable. Instead of treating vulnerability research as an individual or highly specialized skill, this session introduces a structured workflow that attendees can immediately apply.

Attendees will follow a step-by-step approach to:

• Explore a scoped attack surface
• Apply a curated vulnerability pattern checklist
• Identify and validate a potential vulnerability
• Structure the finding in a simplified CVE-style format

All materials are prepared in advance to ensure the activity can be completed within 30–60 minutes and repeated across multiple waves of participants.

This tactic emphasizes doing over theory, helping attendees leave not just with knowledge, but with a clear, reusable method for identifying and documenting vulnerabilities and a better understanding of how CVE publishing can be integrated into team workflows.

ResearchersNatan Morette BR