Skip to content

v2.3.6 - RedOps Complete Completion & Advanced Tradecraft

Choose a tag to compare

View all tags
@doublegate doublegate released this 01 Feb 16:41
· 18 commits to main since this release
v2.3.6
e4a54b0

v2.3.6 - RedOps Complete Completion & Advanced Tradecraft

Release Date: 2026-02-01

This release closes all remaining gaps from the WRAITH-RedOps gap analysis v8.0.0, delivering Signal-style Double Ratchet cryptography, advanced MITRE ATT&CK tradecraft modules, infrastructure safety hardening, and full operator client UX polish. All 13 findings from the audit are now resolved (0 P0, 0 P1, 0 P2, 0 P3 remaining).

Features

Signal-style Double Ratchet Protocol (P1-1)

  • Implemented full Signal Double Ratchet in wraith-crypto with DH ratchet + symmetric chain ratchet
  • Fixed half-ratchet KDF logic in force_dh_step to maintain synchronization during unilateral rekeying
  • Integrated Double Ratchet into Spectre implant C2 packet encryption (spectre-implant/src/c2/packet.rs)
  • Comprehensive test suite in crates/wraith-crypto/tests/double_ratchet_tests.rs

Advanced MITRE ATT&CK Techniques

  • T1134 (Access Token Manipulation): steal_token via DuplicateTokenEx/ImpersonateLoggedOnUser, revert_to_self
  • T1140 (Deobfuscate/Decode): decode_xor and decode_base64 for in-memory payload processing
  • T1574.002 (DLL Side-Loading): sideload_scan to identify writable system directories
  • T1105 (Ingress Tool Transfer): download via WinInet HTTP/S for tool retrieval

PowerShell Runner Source-Build (P1-2)

  • Transitioned Runner.dll from checked-in binary to source-build model
  • New cargo xtask build-runner command automates .NET assembly compilation from runner_src/
  • Runner.dll compiled from C# source via dotnet build

Operator Client UX Polish

  • 10 new console commands: compress, exfildns, wipe, hijack, stealtoken, reverttoken, decodexor, decodeb64, sideload, download
  • Resource management: Delete functionality for Listeners and Attack Chains with confirmation dialogs
  • Dark/Light theme toggle infrastructure (Zustand state + Header toggle)
  • Bulk operations: Multi-implant selection and bulk kill in Beacons view

Resource Management (Full-Stack)

  • New RPCs and database operations for DeleteListener and DeleteAttackChain
  • Integrated into ListenerManager and PlaybookBrowser with confirmation dialogs

Fixes

Implant Remediation (P2/P3)

  • P3-2 (Linux Base Address): Dynamic .text base address via /proc/self/maps for PIE binary compatibility
  • P3-6 (BOF Safety): Replaced unsafe .unwrap() calls in BOF loader with structured error handling
  • Compression: Upgraded from RLE to DEFLATE (miniz_oxide) for efficient data exfiltration
  • Mesh Obfuscation: Randomized nonce-based XOR for mesh discovery packets (eliminates static signatures)
  • SMB Named Pipe: Improved error handling in SMB channel operations

Team Server Safety

  • Replaced .expect() calls in Kill Switch handlers with graceful error propagation
  • Cryptographically secure random nonce generation for all response frames
  • Enhanced rekey handling in protocol services

Infrastructure

  • Conductor: RedOps Final Alignment track marked 100% complete with full task tracking
  • xtask: Added build-runner subcommand for .NET assembly compilation automation
  • Version bumped across all workspace Cargo.toml files and documentation

Statistics

Metric Value
Commits 20
Tests 2,148 passing (2,123 workspace + 11 spectre-implant + 14 doc)
Security Zero vulnerabilities
RedOps Gap Findings Resolved 13/13 (100%)
MITRE ATT&CK Coverage ~95%+ (39/40 techniques)

Full Changelog: v2.3.5...v2.3.6

Assets 14
Loading