Hidden by Design: Battle-Tested Hybrid C2 Infrastructure
Red team infra that survives modern EDR and threat intel.
Christian Ramirez · Korenza Patterson
21 / 70 confirmed
Speakers
Founder and Head of Offensive Security at RBT Security. Almost two decades of pen testing, adversary simulation, malware dev, and red/purple team ops. Specializes in Objective-Based Penetration Testin…
VP of Security Advisory and Business Development at RBT Security. Works across web, API, cloud, and mobile engagements. Translates technical red team findings into action for executives in finance, le…
About
Hidden by Design: Battle-Tested Hybrid C2 Infrastructure
When modern EDR and threat intel burn static red team infrastructure in minutes, what actually holds up on a real engagement?
Christian Ramirez (Founder and Head of Offensive Security at RBT Security) and Korenza Patterson (VP of Security Advisory) walk through the battle-tested hybrid Command and Control architecture RBT runs on production engagements. Not theory. The actual setup.
The talk deconstructs four pillars, technical and demo-driven the whole way:
- Traffic obfuscation. Cloudflare DNS proxy networks masking backend infrastructure origins, plus domain reputation management.
- Smart redirection and decoys. Nginx-based redirectors that dynamically route valid C2 traffic (strict User-Agent filtering, Malleable profiles) while presenting legitimate decoy sites to defensive scanners and SOC analysts.
- Secure bridging. Resilient remote port forwarding via systemd and Auto-SSH to bridge disposable cloud VPS assets with persistent on-prem infrastructure without ever opening inbound firewall ports.
- Multi-C2 operations. Multiplexing Sliver (over mTLS) and Havoc/Adaptix (over HTTP) simultaneously behind one unified cloaked network.
The through-line: protect the operator's identity and keep the operation surviving after edge nodes get burned. When your infrastructure has to outlast blue team automation, static and disposable both have to work at the same time.
If you build red team infra or defend against it, this is the meetup.
Details
- Thursday, August 20, 2026 · 6:30 PM
- Venue: TrendAI Toronto, 1 Snooker St, Toronto, ON M6K 0C3 (Liberty Village). Thanks to Trend for hosting
- Food and drinks on the house
Do not RSVP on Meetup. RSVP right here.