← Back to blog

Introducing Krait: Evasion-First Command & Control

· Krait Team · 5 min read

Krait is a command and control framework built from the ground up for modern EDR-monitored environments. After years of working red team engagements where the tooling was either too expensive, too detectable, or too rigid, we decided to build exactly what we needed: a C2 that treats evasion as architecture, not as a feature flag you toggle on and hope for the best.

Today we’re releasing Krait 1.0 — the culmination of months of development, testing against commercial EDR products, and iteration based on real engagement feedback.

Why Another C2?

The red team tooling market has a problem. Cobalt Strike has been the industry standard for over a decade, but its signatures are burned into every EDR product on the market. Behavioral detections for Cobalt Strike’s reflective loader, named pipes, and sleep patterns are table stakes for any modern endpoint security product. Brute Ratel emerged as a credible alternative with its focus on API-only, syscall-based operations — but at $3,000 per year with limited built-in capabilities, many teams find themselves choosing between cost and capability.

Meanwhile, open-source alternatives exist but lack the cohesion and completeness required for professional engagements. You end up stitching together Sliver for transport, community BOFs for post-exploitation, and custom loaders for evasion — a fragile assembly that breaks across EDR updates and wastes operator time on integration instead of operations.

Krait exists because we believe the choice between “works against EDR” and “affordable” is a false dichotomy.

What Makes Krait Different

Evasion as Architecture, Not Afterthought

Every component of Krait’s implant was designed with evasion as a first-class requirement. This is not a framework that added indirect syscalls in version 3 or bolted on sleep encryption after customers complained. From the first line of code, every design decision was filtered through the question: “Will this survive a competent SOC analyst with a modern EDR stack?”

The result is an implant that layers multiple evasion techniques into a coherent whole:

  • Indirect syscalls via HellsGate/HalosGate — runtime resolution of syscall numbers from ntdll, with fallback for hooked stubs. No static syscall tables that break across Windows builds.
  • Ekko sleep encryption with stack encryption — during sleep periods, the implant’s memory is encrypted, and the stack is cleaned to prevent memory scanners from finding meaningful content.
  • Hardware breakpoint AMSI/ETW bypass — no suspicious inline patching that triggers integrity checks. HWBP-based bypasses survive periodic AMSI DLL re-validation.
  • Stack frame spoofing — call stacks presented to the kernel during syscalls show plausible return addresses from legitimate modules, defeating stack-based heuristics.
  • Module stomping and phantom DLL hollowing — code lives in memory regions backed by legitimate, signed DLLs, not in conspicuous private allocations.

235+ Built-in Commands

Krait ships with 235 built-in BOF commands across 18 categories — from basic reconnaissance (whoami, ipconfig, netstat) to Active Directory enumeration (ldapsearch, kerberoast, adcs-enum) to credential access (nanodump, hashdump, dpapi-masterkeys). Every command is implemented as a COFF object file that executes in-process, with full argument parsing and structured output.

This is not a framework where “built-in” means “we bundled someone else’s BOF pack.” Every command was written or adapted specifically for Krait’s execution engine, tested against its output formatting system, and mapped to MITRE ATT&CK techniques for reporting.

Polymorphic Builds and Traffic Mimicry

Every build of a Krait implant is unique. The build system randomizes hash seeds, XOR keys, AMSI bypass variants, and AES encryption keys per compilation. Combined with 13 PE cover profiles that mimic legitimate applications — OneDrive, Teams, Slack, Discord, and others — each implant presents a distinct signature on disk and in memory.

Network traffic is equally considered. Krait’s malleable profiles shape C2 communications to match real SaaS application traffic patterns. A Slack-profiled implant sends HTTPS requests with Slack’s actual API paths, headers, and JSON structures. Paired with a matching PE cover profile, the implant looks like a legitimate application on both the network and the host.

Modern Operator Experience

Krait is not just an implant — it is a complete operational platform. The client-server architecture separates the teamserver from the operator interface, supporting both an interactive CLI (with tab completion, styled output, and command history) and a full React web dashboard. Multiple operators connect simultaneously with JWT authentication, agent soft-locking to prevent command conflicts, and presence tracking to see who is active.

For teams pushing automation, Krait exposes all 28 API endpoints as AI-callable tools via the Model Context Protocol (MCP). Point your AI assistant at the MCP server and operate through natural language — with confirmation boundaries on destructive actions like process migration or lateral movement.

What’s Next

Krait 1.0 is a Windows-focused release, and we have a clear roadmap for what comes next. Version 2.0 will bring cross-platform agents for Linux and macOS, a cloud redirector toolkit for one-command deployment with domain fronting, and collaborative operations features for multi-person team engagements.

If you are a red teamer tired of paying enterprise prices for tools that get caught by the EDRs they are supposed to bypass, we built Krait for you.