COFFSec C2
A custom Command & Control framework built for adversary simulation and red team operations.
COFFSec C2 is COFFSec’s proprietary command and control platform, engineered to emulate modern adversary tradecraft with stealth, flexibility, and resilience. It empowers our red team to operate undetected across complex enterprise environments and is available to trusted partners for their own offensive operations.
# initialize listener
> listeners start https --port 8443 --profile edge
[+] listener 'edge' running on 0.0.0.0:8443
# stage beacon
> beacons stage --os windows --jitter 35 --sleep 60s
[+] beacon generated, sha256: 9f2c…ac41
# check sessions
> sessions
[1] WORKSTATION-7 10.0.14.22 edge healthy admin
[2] DC-01 10.0.14.5 edge healthy system
>_
Built for real operations
Every capability in COFFSec C2 was forged on live engagements designed to hold up under pressure against modern defenses.
Flexible Beacons
Lightweight, cross-platform implants with configurable sleep, jitter, and transport profiles to blend into legitimate traffic.
Encrypted Channels
Mutual TLS, domain fronting, and custom protocol mappers keep traffic opaque to network defenders and inspection tools.
Distributed Infrastructure
Tiered redirector architecture with auto-rotation lets operations survive takedowns and maintain continuous reach.
Evasion by Design
Built-in techniques for AV/EDR avoidance, in-memory execution, and OPSEC-safe telemetry minimize detection surface.
Extensible Plugins
A modular plugin system lets operators load custom capabilities on demand from lateral movement to collection.
Real-time Telemetry
Live operator console with session health, task tracking, and engagement-wide audit trails for clean reporting.
The operation, end to end
A clean workflow from initial foothold to defensible reporting.
Deploy
Stage beacons through tailored delivery vectors matched to the target environment.
Command
Issue tasks, chain modules, and orchestrate sessions from a unified operator console.
Evade
Stay resilient with rotating infrastructure and OPSEC-safe execution at every step.
Report
Export full audit trails and session timelines for clean, defensible reporting.