Realm @Realm_C2

Cross platform red team tool with a focus on automation and reliability. docs.realm.pub Joined March 2023

Tweets

43
Followers

171
Following

28
Likes

20

Realm @Realm_C2

3 months ago

STONK 📈

0 0 3 102 0

View Details

Realm @Realm_C2

3 months ago

Coming soon to a red team operation near you! Beacon notifications! 🔔 Stay up to date on hosts lost and gained.

0 0 5 229 0

View Details

Realm @Realm_C2

3 months ago

Time to upgrade the Ludus lab! 🙌 @badsectorlabs very excited ❤️

1 0 10 983 2

View Details

Leaving your c2 to use SSH, MSF, nmap - HUGE pain. Why not just use them from the browser! Since realm's network proxy is all server side we were able to build other things like SSH into the backend and in go connect the sockets.

0 3 33 2K 20

View Details

Realm @Realm_C2

4 months ago

Structured data at the click of a button! 🤩

0 1 6 264 0

View Details

Realm @Realm_C2

5 months ago

New file hosting feature! 📁 Host files and share them for a duration or with a specific number of downloads. Or use them directly in the imix agent.

0 1 6 290 0

View Details

Realm @Realm_C2

5 months ago

New bandwidth benchmark - wheels on the bus cocomelon.

0 0 4 319 0

View Details

Realm @Realm_C2

5 months ago

RDP over new socks proxy! 😤 Next step playing counter strike 🎮

1 3 39 10K 9

View Details

Realm @Realm_C2

5 months ago

😤

Justin Elze @HackingLZ

5 months ago

3 13 58 4K 29

0 0 1 434 0

View Details

Justin Elze @HackingLZ

5 months ago

### Top-Line Findings 1. **The C2 ecosystem is far less diverse than it appears.** While there are 30+ "different" frameworks, the underlying technique implementations converge on a small number of canonical code patterns, many traceable to specific open-source authors or blog posts. 2. **Three source projects account for the majority of reused code:** - **TrustedSec's COFFLoader** — the ancestor of nearly every open-source BOF loader - **PowerSploit** (by @harmj0y, @mattifestation, @obscuresec) — Get-Keystrokes, Invoke-Mimikatz, PowerView, and persistence modules are shipped verbatim by Empire, PoshC2, PowerHub, Amnesiac, and Shad0w - **Kevin Robertson's Invoke-WMIExec/Invoke-SMBExec** — the dominant PowerShell implementations for WMI and SMB lateral movement, bundled by Empire, PoshC2, PowerHub, and SilentTrinity 3. **A single detection rule can catch multiple frameworks.** Because many C2s share identical implementation code: - One detection for the PowerSploit `Get-Keystrokes` GetAsyncKeyState polling loop catches Empire, PoshC2, and any framework that bundles PowerSploit - One detection for the TrustedSec COFFLoader relocation pattern catches Apollo, Loki, Sliver (extension), and derivatives - One detection for the .NET `ManagementScope` WMI pattern catches Apollo, Covenant, NimboC2, SilentTrinity, and DeimoC2 4. **Genuinely novel frameworks are rare.** Of the 30 analyzed: - **4 frameworks** (Sliver, Havoc, Realm, TripleCross) demonstrate significant code originality - **6 frameworks** show moderate originality (Wyrm, AdaptixC2, Emp3r0r, Merlin, NimPlant, GC2) - **20 frameworks** rely heavily on shared code from the three source projects above, or implement techniques using the same well-known recipes 5. **HTTP C2 communications show the most behavioral convergence.** Three jitter formula families, shared User-Agent strings (the IE11 UA appears in Empire, Nuages, and Covenant), and common URL path patterns create fingerprinting opportunities.

3 13 58 4K 29

View Details

Realm @Realm_C2

7 months ago

@C2Workbench Hey! That’s us 🙂👋 The install instructions look a little complicated - we usually recommend the steps in the README to get started locally or terraform apply for production.

1 0 1 51 0

View Details

Realm @Realm_C2

7 months ago

Excited to share a sneak peek of Eldritch v2! We’ve been rebuilding our automation language from scratch to make it stealthier and more modular. Try it out now! blog.realm.pub/2025-11-29-eld…

0 1 1 265 1

View Details

Realm @Realm_C2

8 months ago

Realm now has global filters! Filters can be applied to most views and stick with you throughout the experience making it easier to work with the same set of beacons or tasks.

0 1 2 231 1

View Details

Realm @Realm_C2

8 months ago

And TLS will be available eventually... 😓

0 0 1 100 0

View Details

Realm @Realm_C2

8 months ago

blog.realm.pub/2025-11-16-red… We've started a blog to document some of the design decisions we make throughout the development process! 🙌 Our first posts highlights the new redirectors features and the challenges that app layer crypto posed.

1 1 2 181 1

View Details

Realm @Realm_C2

10 months ago

Realm app layer crypto is here! 🔒 Agents can be built with a server public key. Transports leverage an ephemeral diffie-hellman key-exchange and xchacha for message encryption. It's been a long time coming but it's finally here! github.com/spellshift/rea…

0 2 4 1K 1

View Details

Hulto @Hultoko

a year ago

Vibe coding @Realm_C2 from inside the metaverse - too much hype 🤯 RIP my movie in the background.

0 1 6 274 0

View Details

Realm @Realm_C2

a year ago

@badsectorlabs For you? Of course! 🙂 discord.gg/uJF4EKFpjh

1 0 1 27 0

View Details

Realm @Realm_C2

a year ago

We’re now on Discord! Join the cult 🙌 discord.gg/UgwB3YHm

1 2 5 336 0

View Details

Hulto @Hultoko

a year ago

I had the privilege to red team @NationalCCDC this weekend. I had a great time and got to let AI control @Realm_C2 for the first ever AI powered service take down. 🙌