Red Teaming Operations
Red teaming operations are authorized attacks reflecting real capabilities of adversaries. Red teaming covers various aspects such as network, social engineering and physical security.
Get a quote
Adversary simulation
Thanks to our vast knowledge in the cybersecurity field we are able to deliver high quality simulated APT (Advanced Persistent Threat) attacks meaning CPH (Cyber-Physical-Human) red teaming. Red teaming operations are meant to reflect real cyber attack scenarios, which might be aimed at a specific organisation. Red team exercises are used to assess the current state of security in a targeted company, employees awareness, as well as the reaction time of internal security teams such as SOC (Security Operations Center).
Social engineering
We perform authorized social engineering attacks, which usually refers to preparing and delivering phishing campaigns targeting customer employees. The goal is decided individually with each customer, for example it can be credential harvesting, using them for further escalation and simulating a real attack by trying to exfiltrate data outside the organisation. In a more basic version it can simply be gathering statistics of the campaign success ratio (number of clicks, gathered credentials).
Other scenario may be aimed at WiFi users, where our consultants set up a rogue AP (Access Point) posing as the legitimate one. When the user connects we may try to perform MiTM (Man-in-The-Middle attacks) meaning capturing sensitive data, planting specially crafted executables by hijacking downloaded files in order to gain further access.
Red teaming vs penetration testing
Red teaming differs from penetration testing on multiple levels:
- it is not limited by a very strict scope (e.g. pentesters limited to gain access to only a specific web application),
- it is not about finding as many security vulnerabilities as possible, but finding the most effective way to break into to organisation or achieve a specific goal (e.g. steal sensitive data),
- it is not limited only to technology, it includes human factors (social engineering), as well as physical security (e.g. on premises access controls),
- it cannot be too noisy, as it often aims to demonstrate bypassing of additional security controls and test the effectiveness of the internal security teams.
Network attacks
As a part of red teaming operations we conduct network attacks both external and internal, where the main goal is gaining access to important company resources,data or as a way to get inside the internal network. However for the most part it is used for escalation after gaining initial access to the network using social engineering or physical access.
Physical security
Main goal of physical security testing in case of red teaming is gaining access to the organisation building, restricted access zones, documents, company devices and the internal network.
