Domain Admin in less than 60 minutes
Active Directory Certificate Services: Still Not Dead in 2026
CYPFER Offensive Practice
All published posts
You can find all of our published articles and search them.
Showing all posts
What Vibe-Coding Is Doing to Your Attack Surface
Vulnerabilities in AI-Generated Apps. What can you do about it ?
Cobalt Strike redirectors using AWS and Azure
One of the challenges for red team operators is to maintain their command & control (c2) infrastructure. An aspect that can be time consuming is obtaining reputable domain names to be used by c2 server.
Is Microsoft Entra ID really phishing-resistant?
The announcement everyone's applauding. It fixes one thing and it isn't the thing that gets tenants owned.
EDR Can't Be Everywhere: Why Defense in Depth Matters
Why EDR alone fails: Organizations need defense-in-depth strategies not just EDR.
Ransomware Threat Modeling Through an Offensive Security Lens
Learn how ransomware threat modeling connects real attack paths, business impact, and offensive security testing.
Adapting penetration testing methodology for AI driven solutions
How much of the traditional pentesting playbook still applies when the target is a language model
Assumed Breach Engagements: When the Threat Is Custom, the Tools Should Be Too
How we engineered our own deployment infrastructure, so our team spend every hour of an engagement doing what matters: testing your security, not fighting setup logistics.
Hunting Honey Pots as Red Teamers
Subtle inconsistencies in identity data routinely expose defensive controls such as honeypots and honeytoken accounts.
AzureRedOps a tool to audit your Azure tenant
AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team workflows.
From GitHub Keys to Azure Secrets
A quiet shift in how access is leaked and what attackers might use to access your azure tenant.
When AI Reconnaissance Loses Context during real attacks
Analyzing nonsensical AI-driven reconnaissance patterns and why context-less automation fails in real-world attacks.
Before Mythos Ships, Walk Your Own Attack Paths.
Mythos will make 0days cheaper and faster. But the real risk isn't the front door; it is the misconfigured domain sitting wide open behind it and the poor detection.
Old red team tradecraft, modern attackers.
How legacy red team tradecraft is being reused by modern attackers and what it means for detection and defensive readiness.
Free Cloud Security Assessment
CYPFER is offering a complimentary cloud assessment focused on identifying a selection of attack paths within your cloud environment.
Strengthen Your Security Posture with a Detection Capability Assessment
Empower Your Blue Team with Real-Time Training and Comprehensive Threat Detection
Why Red Teams Keep Winning
Discover the latest red team tactics and real-world techniques threat actors are using and how CYPFER is staying ahead of them