REDTEAM.PL company

Cybersecurity experts

We hold real, demonstrable expert competence in both attack – penetration testing, red teaming – and defence – DFIR, threat hunting and threat intelligence – and we combine them in a single team. Our professional experience in each of these specialisations exceeds five years, and we have worked in areas such as red teaming, DFIR and threat hunting since their early days in Poland. This follows from over 25 years in the industry and a passion for cybersecurity that turned into a way of life.

Over the last decade, under bug bounty programmes, we have received dozens of public acknowledgements from well-known international companies (among others Adobe, Apple, BlackBerry, Google, Microsoft, Netflix, Nokia, VMware and Yahoo) for responsibly disclosed software vulnerabilities. In 2019 and 2020 alone Google awarded us a total of USD 68,000 along with publicly available acknowledgements for reporting a series of critical vulnerabilities in the Chrome browser. In 2020 a vulnerability we found in an Apple mechanism was highlighted by the US-based SANS Institute and by Forbes magazine.

In 2020, at the invitation of the Singapore Ministry of Defence, we took part as an offensive team (red team) in the international exercise Critical Infrastructure Security Showdown 2020 (CISS2020-OL) organised by the Singapore University of Technology and Design (iTrust SUTD). The objective was to attack critical infrastructure in the form of a water treatment plant (SWaT). During the exercise we successfully broke through the IT defences and took direct control of the SCADA HMI system.

On the defensive side, in 2019 we received numerous acknowledgements from European CERT incident response teams, among them CERT Polska, the Estonian CERT and the Latvian CERT, for detecting and shutting down badWPAD – a global MiTM (Man-in-the-Middle) attack whose victims numbered millions of computers worldwide. Our research was described on the company techblog and was also highlighted by the SANS Institute in the United States. REDTEAM.PL CERT is a recognised incident response team and a member of Trusted Introducer, the largest international organisation bringing CERT teams together. We have also built RedEye, our own tool for threat hunting through the detection of anomalies in network traffic, which we offer in a SaaS (Software as a Service) model as part of our SOC.

Our record also includes academic publications: authorship of the book “Praktyczna analiza powłamaniowa” (Practical post-breach analysis, ISBN 9788301193478) published by Wydawnictwo Naukowe PWN, and co-authorship of close to ten publications of the European Union Agency for Cybersecurity (ENISA), issued to support European CSIRT (Computer Security Incident Response Team) units in protecting cyberspace.

Thanks to competence on both the offensive and the defensive side we offer services that demand broad expert experience – threat hunting, for instance, that is proactive threat discovery. We do not wait for an incident to escalate; we detect it at the outset, while the attack on the organisation’s infrastructure is still under way. We are among the few who draw on real experience that lets us both simulate hacking attacks more effectively and detect them, because we know the tools and methods attackers use. Knowledge of the software and techniques (TTPs – Tactics, Techniques, Procedures) used by attackers is the hardest part of detection, as recognised sources for threat hunters confirm – the Pyramid of Pain, for example, which describes the difficulties present in this relatively new area of cybersecurity.