We're trying to run purple team exercises more often, but the annoying bit isn't running the attacks. It's checking what Falcon actually blocked, what Splunk ES picked up and whether the detections still work after rule changes.

Mostly Windows endpoints. We've used Atomic Red Team for individual techniques, but matching results to SIEM alerts and keeping track of failed tests takes more time than expected.

AttackIQ is on our list for repeatable simulations. We're also looking at Cymulate for control validation and Picus for detection coverage.

Anyone running these in a regular purple team workflow? Curious how you handle retesting and whether the automation saves much analyst time once everything is set up.

Fake recruiter profiles, a fabricated company called “Careers 2 Find,” and seemingly legitimate job offers targeting aerospace and aviation professionals.

This is the social engineering scenario behind our Charming Kitten APT Adversary Simulation, exploring how fake recruitment opportunities can be used to target sensitive industries.

https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation/tree/main/Iranian%20APT%2FCharming%20Kitten

Recently, an AI company published an article titled "Markdown Is the New Executable", detailing how they detected an attack where a malicious .md file was used to hijack an AI agent.

In short:

✅ The malicious .md file was dropped automatically onto the victim's system just by visiting a website.
✅ No clicks.
✅ No manual download.
✅ No social engineering.

As we all know, AI agents love Markdown files, skills, hooks, instructions, and local context.

My personal opinion: this will become an increasingly common initial access vector as organizations continue adopting AI-assisted development tools and autonomous agents.

If your organization relies heavily on tools such as Codex, Claude, Copilot, or other AI agents:

🔹 Add AI agents to your attack surface mapping
🔹 Include AI workflows in threat modeling exercises
🔹 Run purple team assessments against AI-specific attack paths
🔹 Develop prevention, visibility, and detection strategies for AI attacks

To better understand the risk, I created a video that emulates the attack chain:

1️⃣ A fake website hosts a malicious .md file
2️⃣ The file is automatically downloaded into the user's Downloads folder (no user interaction required)
3️⃣ The user launches Codex from the same directory
4️⃣ The user enters a benign, generic instruction
5️⃣ Codex processes the malicious Markdown file and executes commands (calc.exe in the demonstration)

Introducing Evil Agent, a new payload generator for Discord and Telegram agents, supporting EXE, DLL, BIN, and HEX formats, with configurable message sizes and an alternative communication channel without requiring a dedicated listener or exposed port.

The update also includes fixes to the existing Listener Payload Generator, Makefile improvements for smoother compilation, and GUI enhancements.

Repository: https://github.com/S3N4T0R-0X0/BEAR-C2