Rolling out the C2: A Take on Modern Red Team Infrastructure

Two red team members at a large retailer explain why they built their own command-and-control platform. Their previous infrastructure was static, hard to change between engagements, and poorly documented after staff turnover. They set goals for a cloud-hosted stack that could be spun up and torn down per engagement, stayed modular so components could be swapped, and could be deployed by any team member with a single Terraform run.

The architecture sits in one Azure network with a handful of small virtual machines. One host runs a self-hosted Headscale coordination server in place of the hosted Tailscale control plane, along with a reverse proxy and Keycloak for single sign-on. Other hosts provide a Git repository, a dashboard, a private paste service, and a report-writing tool, while C2 listeners such as Sliver and a Metasploit handler run on separate machines to keep them isolated. A live demo showed a deployment finishing in roughly two minutes and a teardown taking about as long.

The presenters estimated the stack costs around fifty dollars a month and relies mostly on open-source components. Planned improvements include making the design cloud-agnostic, wrapping Terraform in a guided Python front end, supporting parallel deployments, pre-baking virtual machine images, and exploring a local model for exploit development. They were candid that most of the design was learned by trial and error over about two months, and that the code was still being cleaned up before release.