Red Team Tools and C2 Frameworks (2026 Edition)

Red team tools are the software and hardware that authorized operators use to emulate a real adversary from first contact to final objective: command-and-control (C2) frameworks such as Cobalt Strike, Sliver, Mythic and Havoc, phishing kits, payload and evasion tooling, identity attack-path tools, and physical intrusion gear. Nearly every framework on this list has also been used by criminal or state groups, so it doubles as a map of what your defenders should be able to catch. The tools matter less than the question a red team answers with them: would anyone notice?

This 2026 edition lists the tools by phase, maps each category to the logs that expose it, and shows how we use them in a red team assessment, which starts at $12,500, fixed in writing. There are no download links; where a tool in the at-a-glance table has a MITRE ATT&CK entry, we give its ID instead.

What counts as a red team tool

A penetration test needs breadth: scanners, proxies and exploit modules that find as many weaknesses as possible in a defined scope (see our penetration testing tools guide). A red team needs stealth over weeks: traffic that blends in and implants that survive endpoint detection. BloodHound and Impacket appear in both kits; the C2 framework, phishing infrastructure and evasion work make it an operation. Still choosing? Read red teaming vs penetration testing, and check your red team readiness before you buy one.

“Red teaming tools” also describes AI red teaming, where Microsoft’s PyRIT and NVIDIA’s garak send adversarial prompts at language models, a separate discipline covered by our AI and LLM penetration testing.

Red team tools at a glance (2026)

Tool	Phase	Maintainer	License	ATT&CK ID	Documented use by threat actors
Cobalt Strike	C2	Fortra	Commercial	S0154	30 groups listed, including APT29 and Wizard Spider
Brute Ratel C4	C2	Dark Vortex	Commercial	S1063	No groups listed; a cracked copy leaked in September 2022
Sliver	C2	Bishop Fox	Open source	S0633	APT29, TA551, Cinnamon Tempest
Mythic	C2 platform	Cody Thomas	Open source	S0699	Servers seen in potentially malicious infrastructure
Havoc	C2	C5pider and contributors	Open source	S1229	WIRTE
Empire	C2	BC Security	Open source	S0363	17 groups listed, including Turla and APT41
Covenant	C2 (.NET)	Open-source project	Open source	S1155	HAFNIUM
AdaptixC2	C2	Open-source project	Open source	Not listed	Deployed alongside Fog ransomware in 2025
Evilginx	Phishing (AiTM)	Kuba Gretzky	Open source, paid Pro edition	S9003	No groups listed yet (entry evilginx2, added January 2026)
BloodHound	AD attack paths	SpecterOps	Open-source CE, commercial Enterprise	S0521	Wizard Spider, Play, APT29
Impacket	Windows protocols	Fortra	Open source	S0357	20 groups listed, including Volt Typhoon and Scattered Spider
Rubeus	Kerberos abuse	GhostPack project	Open source	S1071	Wizard Spider, MirrorFace
ROADtools, AADInternals	Entra ID	Independent researchers	Open source	S0684, S0677	APT29, Storm-0501

Group listings and the Brute Ratel leak come from each tool’s entry in the MITRE ATT&CK software catalog, checked in November 2026; the AdaptixC2 row is from Unit 42, cited below. We refresh this list yearly.

C2 frameworks: the core of the red teaming toolkit

A C2 framework packages the team server, implant builder, listeners and a shared operator console; how C2 traffic works and how to hunt it is in our C2 server guide.

Commercial C2 frameworks

Cobalt Strike is the reference point the others are measured against. Fortra sells it, its implant is called Beacon, and ATT&CK lists 30 threat groups that have used it. Our Cobalt Strike explainer covers it in depth.

Brute Ratel C4, from Dark Vortex, is described by ATT&CK as designed specifically to avoid EDR and antivirus detection. The vendor publishes its price, $3,250 for a one-year single-user license, and says it verifies a buyer’s business registration before selling (Brute Ratel pricing, checked November 2026). ATT&CK records that a cracked copy leaked in September 2022 anyway, after which threat actors began using it.

Nighthawk, from MDSec, is a third commercial option. Commercial tools bring vendor support but well-studied default signatures, so operators customize them heavily.

Sliver

Sliver is the best-known open-source alternative to Cobalt Strike: Bishop Fox develops it in Go, its implants run on Windows, macOS and Linux, and it talks over mutual TLS, WireGuard, HTTP(S) and DNS. ATT&CK lists APT29, TA551 and Cinnamon Tempest among its users. Our C2 server guide covers how to detect Sliver C2, from its default listeners to the process injection its commands rely on.

Other open-source C2 frameworks

• Mythic is a platform rather than one implant: one server hosts interchangeable agents and transport profiles for different operating systems.
• Havoc was released in October 2022 by its developer, C5pider; ATT&CK records the WIRTE group using it.
• AdaptixC2 is the newest to cross over. Unit 42 reported in September 2025 that attackers were using it by early May 2025, once after posing as IT help desk staff to start a remote assistance session, and that it was deployed alongside Fog ransomware against a financial institution.
• Empire, maintained by BC Security, runs PowerShell, Python and C# agents; ATT&CK lists 17 groups that have used it.
• Covenant, written in .NET for testing and research, has been used by HAFNIUM, though its public development has largely stalled since 2021.
• Metasploit Framework, from Rapid7, is mainly an exploitation tool; see msfvenom explained.

How red teams choose a C2 framework

1. Threat model fit. Emulating your likely adversaries’ tooling tests the detections that matter.
2. Transports. HTTPS and DNS for egress; SMB named pipes or TCP to chain internal hosts.
3. Customization. Defaults get signatured, so traffic and implant behavior must be adjustable.
4. Operator logging. Every command, timestamped, becomes the timeline your SOC replays.
5. Stability. A framework that crashes a production host is a liability.

Infrastructure needs the same care as the framework: aged domains, redirectors that hide the team server, and cloud hosting cleared with the provider. AWS, for example, requires prior approval for any testing that includes C2, through a Simulated Events request submitted at least two weeks before the start date (AWS penetration testing policy, checked November 2026; see also our AWS penetration testing guide).

Initial access and phishing tools

Red team reconnaissance and OSINT tools

Reconnaissance comes first. OSINT harvesters, subdomain enumerators and internet scan search engines such as Shodan and Censys map your staff, domains and exposed services, mostly without touching anything you log. The defense is having less to find: public staff lists that feed phishing pretexts, forgotten subdomains, and exposed services. An external network penetration test inventories that exposure.

Reconnaissance tool	What it does	The exposure it reveals
theHarvester	Gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs and other public datasets	Staff names and email addresses that seed phishing pretexts, plus hostnames you may have forgotten
OWASP Amass	Maps the external attack surface and discovers assets using open-source information and active reconnaissance	Subdomains nobody inventoried: staging sites, old portals, test systems
Shodan and Censys	Search engines built on internet-wide scan data	Services, banners and certificates already visible to anyone, tied back to your organization

None of these needs access to your network, so there is nothing to alert on for the passive lookups. What you control is the result: run the same tools against your own domains, then remove or lock down what they find.

Phishing and adversary-in-the-middle tools

Most initial access then targets people. Evilginx is the adversary-in-the-middle framework that steals session tokens rather than passwords, which is how a phish gets past push and code-based MFA; our Evilginx explainer covers why phishing-resistant MFA stops it. GoPhish is the open-source campaign manager behind many awareness programs. And some initial access uses no kit at all: a vishing call from a fake help desk, then a legitimate remote support tool.

The fixes are mostly architectural. FIDO2 security keys or passkeys defeat token-relay phishing, and Conditional Access that requires a compliant device stops a stolen session being replayed elsewhere. Restricting Teams external access to trusted domains, blocking remote support tools other than the one you approve, and requiring help desk callback verification narrow the help desk route. For detection, Microsoft Entra ID Protection raises an Attacker in the Middle risk detection when a session is linked to a malicious reverse proxy, though it is calculated offline and requires Microsoft 365 E5 with Enterprise Mobility + Security E5. Our phishing and social engineering testing measures this layer on its own.

Payload, loader and evasion tooling

Between the phish and the first C2 check-in sits tooling most buyers never see, built to get an implant past antivirus and EDR:

• Payload generators that produce shellcode or executables for a framework.
• Loaders and packers that decrypt the implant in memory and inject it into another process.
• Telemetry tampering aimed at the Antimalware Scan Interface (AMSI) or Event Tracing for Windows.
• EDR killers that load a signed but vulnerable driver (bring your own vulnerable driver, or BYOVD) to stop security tools.

We do not name individual loaders, packers or EDR killers here on purpose. The names change quickly, a list would serve an attacker more than a defender, and the controls below work against the category whatever this year’s tool is called.

Microsoft’s vulnerable driver blocklist has been on by default for all devices since the Windows 11 2022 update and is updated quarterly; Microsoft also recommends memory integrity (HVCI) and the attack surface reduction rule that blocks abuse of vulnerable signed drivers. Enforced application control, EDR tamper protection and PowerShell Constrained Language Mode remove most of the room loaders need. When an implant runs anyway, the finding is often “EDR alerted and nobody looked.”

Identity and Active Directory tools

Inside the network, red teams and real attackers converge on the identity tooling penetration testers also use: BloodHound for attack paths, Impacket and NetExec for remote execution, Rubeus for Kerberos abuse, Certipy for certificate services and Mimikatz for credentials in memory. Because the kit is shared, our penetration testing tools guide covers it tool by tool, with the events that detect each.

Cloud identity is where red team tooling adds something. ROADtools and AADInternals enumerate and manipulate Microsoft Entra ID; ATT&CK records Storm-0501 using AADInternals to build a backdoor that let it impersonate users and sign in past MFA. GraphRunner is a post-exploitation toolset for the Microsoft Graph API, with reconnaissance, persistence and data collection functions for an Entra ID account an operator already controls. Our Azure penetration testing guide covers how this layer is tested.

On AWS the equivalent is Pacu, an open-source AWS exploitation framework created and maintained by Rhino Security Labs. Cloud tools like these work through the provider’s own APIs with whatever credentials the operator holds, so the evidence sits in control-plane logs rather than on an endpoint: AWS CloudTrail for Pacu, Entra ID sign-in and audit logs for the Microsoft tools. A burst of list and describe calls from one identity that never made them before is the pattern to alert on. For Google Cloud, see our GCP penetration testing guide.

An Active Directory security assessment maps the on-premises weaknesses from one standard user account, and our Active Directory security checklist lists the fixes.

Physical red team tools

Physical operations use their own kit. The table pairs each category with what success proves and the fix:

Tool category	What its success proves	The fix
Badge readers and cloners (RFID research tools, long-range readers, Flipper Zero)	Cards transmit a static ID with no cryptography, typically legacy 125 kHz proximity	Cards with mutual authentication and encryption, and retired legacy readers
Lock bypass tools (picks, under-door tools, latch slips)	Doors open without a key or badge	Latch guards, auto-closing doors, exit sensors that cannot be triggered from outside
Network drop boxes	A live wall port admits unknown devices	802.1X port authentication and new-device alerts
Keystroke-injection USB devices	Unattended machines accept new keyboards	USB device control and screen locks

Each fix in the table is a line item in our physical security assessment checklist. Our physical penetration testing covers one NYC-metro office with two operators on site, under signed authorization.

Adversary emulation tools for defenders

Two free projects let you exercise detections without hiring anyone. Apache Caldera, created by MITRE and now incubating at the Apache Software Foundation, automates adversary emulation. Atomic Red Team, from Red Canary, is a library of small tests mapped to ATT&CK, each checking whether one behavior produces a detection.

They answer “does this rule fire?” but not “would a patient human get caught here?” A purple team assessment fills that gap: our operators run real techniques while your defenders watch detections fire or fail, tune them, and re-run.

Detection map: what each tool category leaves behind

Tool-specific signatures age fast. CISA’s red team advisory AA24-193A describes defenders whose tailored YARA rules for the red team’s loader “failed to catch any of the other six C2 frameworks” in use. The same defenders missed Kerberoasting, and their EDR quarantined red team tools without the alerts always being reviewed. Detection that lasts targets behavior:

Tool category	Log source	Event or alert	What it means
C2 implants and loaders	Sysmon, proxy, DNS	Sysmon 3 (network connection), 22 (DNS query), 8 (CreateRemoteThread), 10 (ProcessAccess)	A process calling out on a rhythm, or code moving into another process (beaconing analysis in our C2 server guide)
Process hiding	Sysmon	25 (ProcessTampering)	A process image hollowed or altered to hide what is really running
PowerShell-based agents	PowerShell Operational	4104 (script block logging)	The decoded content of scripts that ran
EDR killers (BYOVD)	Sysmon; CodeIntegrity Operational	Sysmon 6 (driver loaded); 3077 (App Control block)	A signed driver loading where none should, or a blocked attempt
BloodHound collection	Defender for Identity	Security principal reconnaissance (LDAP); User and Group membership reconnaissance (SAMR)	Someone mapping the directory from a workstation
Help desk pretext, then remote support tool	Microsoft 365 audit log (Teams); EDR process events	An external-tenant chat or call, then Quick Assist or another remote tool starting on that machine	A social-engineered remote session
AiTM phishing (Evilginx)	Entra ID Protection	Attacker in the Middle; Anomalous token	A session token relayed or replayed from attacker infrastructure

Sysmon event names are from Microsoft’s Sysmon documentation (event 3 is off by default) and identity alert names from the Defender for Identity alert list. Event-by-event detection for the identity tools (Kerberoasting, DCSync, certificate abuse, remote execution) is in our penetration testing tools guide.

How Invadel uses red team tools, and what it costs

In a red team assessment we choose the framework, phishing approach and infrastructure to resemble the adversaries in your threat model, as described in crafting realistic red team scenarios. Implants run only on systems the rules of engagement name, and every operator action is logged with a timestamp and ATT&CK technique, so the report gives time to detect and time to respond for each phase.

Engagement	Tools in play	Starting price
Red team, Small	A C2 framework chosen for your threat model, one objective, one or two access vectors; assumed-breach starts usually land here	$12,500
Red team, Medium	Adds phishing infrastructure and external initial access across several objectives; full-scope starts usually land here	$17,000
Red team, Large	A multi-scenario operation with deep evasion work across a large or multi-site estate, and a purple-team debrief	$29,000+
Purple team assessment	The same tools run openly while your defenders tune detections until they fire	Quoted
Phishing and social engineering	Campaign tooling on its own; adversary-in-the-middle scenarios that test MFA cost more and are scoped on request	$3,600
Physical penetration test	Badge cloners, lock bypass tools and network drop boxes at one NYC-metro office	$6,800

Prices are fixed in writing once objectives and scope details are agreed. Each includes an attestation letter, the findings platform and a free retest of remediated technical findings, such as an egress rule or EDR policy you changed after an implant got through; phishing campaigns, which produce no findings to retest, are the exception. Onboarding begins within 24 hours of a signed proposal. See the red team pricing, a sample report, or our guide to red team companies.

Frequently asked questions

What is the best C2 framework for red teaming? There is no single best one. Cobalt Strike is the most mature commercial option, Sliver the best-known open-source one, and Mythic suits teams that want interchangeable agents. A good red team picks the one that matches your threat model and customizes it.

What is a C2 framework? A command-and-control framework is the software that lets operators manage compromised machines: a team server, an implant builder, listeners that receive implant check-ins, and a shared console. Cobalt Strike, Sliver, Mythic and Havoc are examples.

Is Sliver better than Cobalt Strike? Neither is better in general. Cobalt Strike is commercial and heavily studied by defenders; Sliver is free, open source and cross-platform, which is why red teams and APT29 both use it. Detection should target the behaviors they share.

Are red team tools legal? Owning them and using them for authorized testing is legal. Using them against a system without its owner’s authorization can be a crime under the federal Computer Fraud and Abuse Act (18 U.S.C. 1030) and state computer-crime laws, which is why every engagement runs under signed authorization and written rules of engagement.

How much does a red team engagement cost? At Invadel a red team assessment starts at $12,500, with medium operations from $17,000 and large ones from $29,000, fixed in writing with a free retest of remediated technical findings.

The short version

Nearly every red team tool, from C2 frameworks to phishing and evasion kits, is also in criminal and state hands. Detect the behaviors they share rather than any one tool’s signature, then prove the detections fire. A red team assessment starts at $12,500, fixed in writing. Send your scope details for a fixed quote with a free retest of remediated technical findings.