Why cloud post-exploitation belongs in the C2, not in a separate toolkit — and how Krait's cloud BOFs turn a compromised workstation into a cloud pivot point.
The design decisions behind Krait's macOS agent — why we chose SecureTransport over OpenSSL, how DYLD spawning works with SIP, and the IOKit trick that keeps WiFi alive.
How Krait uses CloudFront and Azure Front Door to route C2 traffic through cloud provider infrastructure — valid TLS certificates, cloud IP ranges, and zero C2 server exposure.
How Krait's build system randomizes every binary across multiple independent axes, making a signature from one captured sample match exactly one sample.
How Krait shapes C2 traffic to mimic legitimate SaaS API patterns — matching URIs, headers, body formats, and even the binary's identity to a specific application.
Why Krait uses raw Winsock and Schannel instead of WinHTTP or WinINet, and how buffer ownership makes sleep encryption actually work.
How Krait uses hardware breakpoints and a decoy Nt function to make every syscall execute from ntdll's own code — no allocated stubs, no suspicious return addresses.
How Krait coordinates three encryption layers — code, data, and heap — to leave nothing recoverable during sleep intervals.
Why encrypting only during sleep isn't enough, and how Krait uses VEH-based demand paging to keep code encrypted even between polls.
Why we built Krait, what makes it different from Cobalt Strike and Brute Ratel, and where we're headed.