Research at @SpecterOps

Portland, OR
Joined August 2009
I haven't blogged in a bit and I think part of that is it feels like no one really reads them anymore and just summarize them with an LLM. Is that just a me thing or is there some truth to that?
29
1
1
64
4,366
enough people have been hounding me about GhidraMCP that I went ahead and updated it for those interested. works with latest ghidra, headless + some extra niceties just directly load plugin + start reversing
30
63
6
1,596
56,339
GLM 5.3 flash is pretty legit
8
782
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform. Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now. Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential. RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators. The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout. It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with. Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together. If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation. businesswire.com/news/home/2…
16
28
3
165
9,514
Garrett retweeted
At #OffensiveAICon, @harmj0y & @tifkin_ will explore optimized evasion attacks & their transferability across EDR products. They’ll share findings from reverse engineering four EDRs and experimenting with LLMs & GEPA to expand the search space for effective obfuscation.
5
23
2,198
Garrett retweeted
Replying to @MSNightmare2000
1
9
218
5,752
Garrett retweeted
Worried about your production agents going out of scope? Us too. AgentJudge is our agent hall monitor that stops out of scope tool calls before they execute. Before a tool runs, the judge reads the agent’s intent, the proposed call, and a rubric you define, then returns allow, deny, or ask (escalate to you). The agent stays autonomous; the judge is the guardrail. Available in the TUI today, UI updates coming to the Dreadnode Platform soon! 👀 Get Started: docs.dreadnode.io/getting-st… AgentJudge Docs: docs.dreadnode.io/tui/guard-… Related Research: dreadnode.io/research/scope-…
9
1
26
3,479
Garrett retweeted
Local AI is never down.
我的 Spark Cluster 还在线 😎
29
20
1
327
17,450
Garrett retweeted
ServiceNow won't let you query cleartext discovery credentials, not even as admin. @Tw1sm found a way to make the server hand them over anyway, no coercion or relay needed. Works on SSH keys, AWS keys, Entra secrets, and LDAP creds. Check it out ⤵️ ghst.ly/4y37KVo
1
68
188
13,591
Garrett retweeted
ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.
45
3
118
13,287
I'm releasing a new Python rewrite of ConfigManBearPig, my BloodHound collector for SCCM, next week w/ a TON of upgrades (SOCKS, hash/kerb auth, CVE scan, threads, pathfind) and am presenting at Black Hat Arsenal next Tues. Come say hi and grab a sticker! blackhat.com/us-26/arsenal/s…
1
3
15
1,403
Garrett retweeted
Compromise one node in a Windows Server Failover Cluster and you've compromised all of them. @unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster. Check it out! ghst.ly/4wSZSoW
50
1
162
9,469
Garrett retweeted
The ADHD dream career is being a highly paid consultant who swoops in, solves a complex crisis with a chaotic stroke of genius, and immediately exits before having to fill out the timesheets.
284
1,887
452
22,305
2,747,065
We used this technique on an op recently, and I wanted to create a simple resource on it due to it being seldom covered but very useful. It's a cool way to get around various NTLM relay constraints when operating over C2 from low-privilege. See it here: specterops.io/blog/2026/07/1…
1
26
95
4,783
If you're at Blackhat USA next month, I'm giving a talk on the Wednesday. Currently working on the presentation and attempting to avoid other rabbit holes until it's done! Excited to talk about this 😈 #BHUSA blackhat.com/us-26/briefings…
1
4
30
1,979
Garrett retweeted
[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows? youtube.com/watch?v=tOVcScKu…
5
38
162
14,344
Garrett retweeted
Planning to cover abuse cases relevant to initial access, post-exploitation techniques, lateral movement, and privilege escalation in this one. I'll be talking at the speed of a professional auctioneer to cover all of it. Come through if you're in Vegas this year!
1
3
28
1,703