Compare
Krait vs The Competition
Feature-by-feature comparison against Cobalt Strike and Brute Ratel C4.
| Feature | Krait | Cobalt Strike | Brute Ratel C4 |
|---|---|---|---|
| Pricing | $1,200/yr | ~$5,900/yr | ~$3,000/yr |
| COFF/BOF Support | ✓ 431+ built-in | ✓ community BOFs | ✓ limited built-in |
| Transport Protocols | HTTPS, SMB, TCP, DNS, DOH | HTTPS, SMB, TCP, DNS | HTTPS, SMB, TCP, DNS, DOH |
| Delivery Formats | 7 (EXE, DLL, SC, Svc, XLL, CPL, Stager) | 4 (EXE, DLL, SC, Svc) | 3 (EXE, DLL, SC) |
| Tampered Syscalls | ✓ ntdll return address | ✗ | ✓ indirect only |
| Sleep Encryption | ✓ Ekko + Foliage + heap + stack encrypt | ○ basic | ✓ multiple techniques |
| PE Fluctuation | ✓ encrypt-at-rest with VEH | ✗ | ✗ |
| HWBP AMSI/ETW Bypass | ✓ | ✗ | ✓ |
| Stack Frame Spoofing | ✓ | ✗ | ✓ |
| Module Stomping/Overloading | ✓ both techniques | ✗ | ✓ stomping only |
| Process Ghosting | ✓ | ✗ | ✗ |
| Phantom DLL Hollowing | ✓ | ✗ | ✗ |
| Threadless Injection | ✓ export hook + memory hole | ✗ | ✗ |
| LoadLibrary Proxy | ✓ selective manual mapping | ✗ | ✗ |
| Polymorphic Engine | ✓ per-build randomization | ✗ | ✗ |
| Traffic Mimicry | ✓ 9 SaaS profiles | ✓ Malleable C2 | ✗ |
| Chrome Extension C2 | ✓ browser persistence + NMH proxy | ✗ | ✗ |
| Cloud BOFs (AWS) | ✓ 15 BOFs (creds, recon, lateral) | ✗ | ✗ |
| Cloud BOFs (Azure) | ✓ 8 BOFs (ARM resources, Key Vault, storage, VM run commands) | ✗ | ✗ |
| Cloud BOFs (Entra ID) | ✓ 14 BOFs (identity enum, app secrets, role assignments, PIM) | ✗ | ✗ |
| Cloud BOFs (GCP) | ✓ 8 BOFs (metadata tokens, resource enum, secrets, IAM) | ✗ | ✗ |
| CDN Redirectors | ✓ CloudFront + Azure Front Door + GCP Cloud CDN, Terraform deploy | ✗ | ✗ |
| Web UI | ✓ pivot graph, file/process browser, cred store | ✓ | ✓ |
| Template Mode | ✓ compiler-free deployment | ○ Artifact Kit | ✗ |
| Multi-Operator | ✓ | ✓ | ✓ |
| AI Operator (MCP) | ✓ | ✗ | ✗ |
| MITRE ATT&CK Mapping | ✓ 74 techniques | ○ | ✗ |
| SOCKS Proxy | ✓ | ✓ | ✓ |
| Anti-Analysis | ✓ CPUID VM detect + parent allowlist + runtime toggles | ○ basic sandbox checks | ✓ sleep-based + API |
| Cross-Platform | ✓ Windows + Linux + macOS | Windows, Linux, macOS | Windows |
| DYLD Spawn (macOS) | ✓ DYLD_INSERT_LIBRARIES, works with SIP | ✗ | ✗ |
| Process Injection (Linux/macOS) | ✓ ptrace + memfd (Linux), task_for_pid (macOS) | ✗ | ✗ |
Comparison based on publicly available information as of September 2026. Features may vary by version.