During the first phase of a red teaming exercise we collect as much intel about our target as possible. The target’s IT infrastructure is scraped for technical details allowing us to understand technologies used within the company. We analyze related social media accounts and collect content which could be used as a basis for the pretexts used in later stages. While most of the reconnaissance is done online, when possible we physically (non intrusively) inspect target company’s offices for useful information which is not available online.

Once we collect enough information about the target we try to gain initial foothold by either conducting a social engineering attack, exploiting identified issues in the infrastructure or infiltrating the company’s buildings physically and deploying rouge devices onto the network. We try many vectors to identify as many entry strategies as possible to understand the weaknesses of the target’s infrastructure or organizational processes. 

After we compromised one or more devices on the target’s network we make sure we do not lose access to such devices as that would prevent us from completing our final assignment and would require us to start over. Depending on the situation we try to deploy customized malware which allows to reconnect to the infected device whenever we need to continue with our activities. When installation of persistence mechanisms is impossible we attempt to extract certain secrets, such as cached passwords, sensitive documentation, etc. which could help us to continue with the assignment.

It is rare that we hit the end goal (i.e. CEO’s laptop) with our initial compromise. Therefore, after we gained and secured our initial foothold, we navigate through the target network to find the most important systems, storing the most sensitive data related or responsible for the most critical processes. Depending on the complexity of the network and implemented safeguards the lateral movement phase might take a while.  During this phase we try to “borrow” network credentials and exploit internal systems which are outdated or configured improperly.

The final step of our red teaming exercises is an attempt to exfiltrate sensitive data out of the target’s network. To do so we select certain samples of documents or the items that were agreed upon with the client in advance. This way we illustrate the real impact of a cyber-attack which could be preformed by a malicious actor. After this phase we also start the cleanup process to remove as many traces and artifacts as possible from the target infrastructure.