Red Teaming

We Simulate Real Attacks to Test Your Defences

Red teaming is not a pentest – it’s a full adversary simulation. We build custom malware, establish C2 infrastructure, bypass your AV/EDR, and move laterally through your network while maintaining strict operational security. The goal: test whether your security team can detect and respond to a realistic, motivated attacker.

Our team has published original research on AV/EDR evasion (including a Sliver C2 bypass that went viral in the security community). We don’t use off-the-shelf tools – we develop custom payloads and C2 frameworks for each engagement, just like a real adversary would.

Our Attack Phases

Each red team engagement follows the MITRE ATT&CK framework, progressing through realistic attack phases:

• Initial Access: We gain entry through the most realistic vector for your threat model – targeted phishing with custom payloads, exploitation of external-facing services, supply chain compromise simulation, or physical access attempts. We craft each attack specifically for your environment.

• Execution & Evasion: Once inside, we deploy custom implants designed to evade your specific AV/EDR stack. We build bespoke loaders, use direct syscalls to bypass user-mode hooks, employ process injection techniques, and leverage living-off-the-land binaries (LOLBins) where appropriate. Every payload is tested against your defensive tooling before deployment.

• Persistence & C2: We establish resilient command-and-control channels using custom C2 frameworks with encrypted communications over legitimate protocols (HTTPS, DNS). We implement multiple persistence mechanisms – scheduled tasks, registry modifications, WMI subscriptions, or DLL side-loading – to survive reboots and maintain access.

• Lateral Movement & Privilege Escalation: We move through your network using credential harvesting (Kerberoasting, AS-REP roasting, NTLM relay attacks), Active Directory exploitation (ACL abuse, delegation attacks, certificate services abuse), and trust relationship exploitation – all while maintaining strict OPSEC to avoid detection.

• Objective Completion: We work toward agreed objectives – accessing crown jewel systems, exfiltrating sensitive data, compromising domain admin, or demonstrating business impact. Every action is documented with timestamps for your SOC to review against their detection logs.

Our Technical Capabilities

• Custom Malware Development: We write bespoke implants in C/C++, C#, and Rust – not modified off-the-shelf tools. This includes custom shellcode loaders, process hollowing implementations, and AMSI/ETW bypass techniques tailored to your environment.

• AV/EDR Evasion Research: Our team actively researches EDR bypass techniques. We understand how products like CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, and Carbon Black detect threats – and how to operate beneath their detection thresholds.

• Active Directory Attack Paths: We identify and exploit AD misconfigurations including Kerberos delegation issues, certificate template abuse (ESC1-ESC8), GPO modification paths, DCSync-capable accounts, and trust relationship weaknesses.

• Cloud-Hybrid Pivoting: For organisations with hybrid environments, we test pivoting from on-premise AD to Azure AD (and vice versa), exploiting AADConnect misconfigurations, and abusing cloud service principal permissions to access cloud resources from compromised on-premise systems.

Example Scenarios From Recent Engagements

These are representative scenarios from past engagements (anonymised):

• Phishing to Domain Admin in 48 Hours: A targeted phishing campaign delivered a custom payload that evaded CrowdStrike Falcon. From initial access on a developer workstation, we harvested cached credentials, Kerberoasted a service account with weak encryption, and used the resulting hash to access a jump server with domain admin sessions – all without triggering a single alert.

• ADCS Certificate Abuse: We identified a misconfigured Active Directory Certificate Services template (ESC1) that allowed any domain user to request a certificate for any other user – including domain admins. Combined with a compromised low-privilege account, this provided a silent path to complete domain compromise.

• Cloud Pivot via Hybrid Identity: From a compromised on-premise workstation, we extracted AADConnect credentials and used them to gain Global Administrator access in Azure AD, accessing cloud-hosted applications including the organisation’s production environment and customer data stores.

Why Choose FORTBRIDGE?

• Highly Experienced Consultants: We have very senior consultants with 10-20 years of experience in the cybersecurity field.

• Certifications and Accreditations: Our company holds CREST and DESC accreditations. Our consultants are individually certified: OSCP (Offensive Security Certified Professional), CRTO (Certified Red Team Ops), and CRTL (Certified Red Team Lead).

• Boutique Expertise, Enterprise Depth: The offensive capabilities of a large consultancy with the direct accountability of a senior-led, family-run firm. Every engagement is hands-on, from scoping to debrief.

Fortify Your Security Posture

With FORTBRIDGE, your security posture is tested against the same TTPs (tactics, techniques, and procedures) used by real-world threat actors.

Book a Discovery Call to discuss your requirements and get a scoping estimate.