Cas Van Cooten interview

Kaz Von Kooten, a red teamer at a major bank in Utrecht, Netherlands, discusses the evolving role of red teamers and the critical need to develop and maintain custom tools to stay ahead of defensive systems. His talk covers the strategic shift in red teaming from purely simulating attacks to actively building and maintaining custom tools that bypass modern defenses.

Von Kooten explains that red teamers must choose between three procurement strategies: developing custom solutions from scratch, modifying open-source tools, or purchasing them from third parties. He emphasizes that this decision has become essential to remain ahead of increasingly sophisticated defensive teams. His talk highlights two tools he developed: "An Impact" and "An Implant," with the latter serving as the primary focus.

"An Implant" is a command and control (C2) framework designed to maintain persistent remote access to compromised systems after initial compromise, such as via phishing. The framework must survive system reboots and remain functional while defenders actively search for it. Rather than aiming for complete undetectability, Von Kooten notes that tools need to appear legitimate enough to avoid triggering initial alerts, giving attackers time to achieve their objectives before defenders locate the tools. He references techniques from another speaker about detecting beacons and implants in memory, acknowledging that such approaches would catch his tools, but relying on defenders' limited time resources and his tools' legitimate appearance to maintain access.

Von Kooten strongly advocates for collaboration between red and blue teams, emphasizing purple teaming as an important field for the security industry. He frames red teaming not as an adversarial role but as a way to help defenders improve their detection capabilities. By training blue teams through realistic attacks, red teamers help prepare defenses against actual threat actors. Von Kooten emphasizes that cross-pollination of knowledge—with blue learning from red's techniques and red learning from blue's detection methods—is essential for advancing security collectively.

This is Von Kooten's first time at ZevCon, held in Poland. He expresses appreciation for the conference atmosphere and the opportunity to meet security professionals he previously only knew through social media.