MEPHISTO: a Red Team Tool for Offensive Security

A realistic assessment for the cybersecurity posture of an organization involves a red team that acts as an attacker, using offensive security tools to test the existing defenses. We propose MEPHISTO, a red team tool that emulates a malware infrastructure, targeting cloud containers. The tool simulates an entire cybersecurity kill chain, including weaponization, exploitation and the command and control. The experimental results show that MEPHISTO can be used in a realistic attack simulation, featuring stealth communication with the command and control server and security solutions evasion.