Coming Soon The sequel to ROPS-RT1
Ready to become a SENIOR Red Team Operator?
RT1 taught you to operate. RT2 teaches you to develop and run the op. Build your own C2, select advanced TTPs, and lead a full engagement from planning to impact.
Positioning
From operator to team lead.
ROPS-RT1 gave you the tools and the plan. You learned to get in, persist, mine AD, and hit the objective.
ROPS-RT2 flips it. You're the senior operator building and leading the op. Plan engagements with a two-tier attack path (Plan A, Plan B), select TTPs that minimize operational risk, and make the calls: DC or workstation, which leads to chase, where the team spends its time.
You're also done borrowing tooling. RT2 leans hard into AI-assisted tradecraft: build your own "vibe-coded" C2 that bypasses EDR, write custom BOFs and plugins, set up exotic transports, and chain advanced tunnels. All of it, from scratch.
6Modules, 0 through 5. a full engagement lifecycle
45Hands-on labs in a live enterprise range
24/7Browser access. nothing to install
46+Enterprise VMs in your private range
Advanced CourseRT2 assumes RT1-level experience. we recommend completing ROPS-RT1 or equivalent hands-on Red Team experience before enrolling.
The Platform
Same platform you love. All-new enterprise lab.
RT2 runs on our same cutting-edge range platform, but the lab scenario was built from scratch. A larger, more complex enterprise network with new attack surfaces at every layer.
46+ Machine Enterprise Range
A full corporate network with domain controllers, workstations, servers, and segmented subnets.
Elastic Defend EDR
Real endpoint detection on target machines. Every payload and technique must survive live defenses.
Corporate Web Proxy Emulation
Fully emulated proxy infrastructure. Your C2 and exfil must route through it, not around it.
Browser Cookie Theft Opportunities
Multiple browser-based credential and session harvesting targets across the network.
Private Lab Instances
Your own isolated range. No shared state, no noisy neighbors, no cleanup after someone else.
24/7 Browser Access
Everything runs in the browser. Nothing to install, nothing to break on your host.
Signature Tradecraft
Ready to lead a Red Team operation? Make sure your toolkit is built and ready.
A sample of what you'll develop, weaponize, and deploy across the 45 labs. Most of it, you'll build yourself.
Custom C2 Development
Disposable Mythic Agents
AI-Assisted Obfuscation
Custom BOFs & Plugins
Exotic C2 Transports (ICMP, Chat)
EvilNoVNC Phishing
Supply Chain (Poisoned PIP)
HTML Smuggling
Credential Clone Pages
Simulated Vishing
AppDomainManager Injection
InvisibilityCloak
Metatwin Metadata Manipulation
CDN-Fronted C2
COM Object Hijacking
RegisterApplicationRestart
ADCS Exploitation (ESC1/ESC4)
DCOM Lateral Movement
Kerberos PTT via Proxifier
Browser Cookie Theft
Writable AD DACLs
NTLM Harvesting (Farmer)
Neo-reGeorg SOCKS
Chisel Tunneling
Redsocks
WebDAV Payload Delivery
Proxy-Aware C2
Nemesis Data Enrichment
TruffleHog Secret Scanning
BloodHound AD Mapping
Elastic Fleet API Recon
Rubeus
Certipy
SharpHound
Responder
hashcat
Nmap
Obsidian Op Logging
User Workstation Hunting
DCSync
Pass-the-Hash
Scheduled Task Hijacking
PowerShell Profile Injection
Kerberoasting
WAR File Webshell Deployment
XOR Payload Encryption
Curriculum
The full course schedule.
Six modules, 45 labs, one continuous engagement. from planning to impact.
Hands-on lab
Lecture / concept
00Foundations
Building an Operation Plan (Plan A, Plan B)
Researching Advanced RT TTPs
AI/LLMs + Supercharged Research and POC
On-going Custom C2 Project
011 Lab
Lab Scenario Overview
Sifting Customer Expectations/Objectives & Planning
Tool/TTP Selection to Minimize Operational Risk
Lab 1 Advanced TTP Research
Introduction to Tools in this Class
Course TTP Overview
0214 Labs
Understanding Web Proxies & Protocol Behavior
Domain Aging, CDN Selection & Redirector Hardening
Infrastructure Cut Sheets & Stream Separation
Lab 2 Mythic C2 + CDN Infrastructure Setup
Static Sigs, Behavioral Detect & Shellcode Loading
Artifact Awareness & Entropy Concerns
AppDomainInjection & Obfuscation Techniques
Metatwin & Binary Metadata Manipulation
Lab 3 Loader Obfuscation & In-Memory Evasion
EvilNoVNC Overview
Lab 4 EvilNoVNC Configuration & Setup
Credential Harvesting & Clone Pages
Lab 5 Cred Grab Clone Development
AI-Assisted Obfuscation & Iterative Testing
Lab 6 C2 Obfuscation (Chisel + Claude)
Supply Chain Attack Concepts
Malicious Package Development
Lab 7 Supply Chain Attacks (PIP Poison)
Testing Methodology (Lab vs Live)
Lab 8 Test & Evaluate Everything
Execute-Assembly Detection & BOF Alternatives
Lab 9 BOFs: Stealthy Post-Exploitation
In-House C2 Development with AI
Why Vibe-Coded C2s Make Sense
Models & Tooling Options
Best Practices
Lab 10 Custom C2 — Mythic Agent Build
Automated Testing Methodology
Lab 11 Custom C2 — Automated Testing Matrix
Chat Platforms as C2 Transports
Lab 12 Custom C2 — Exotic Transport (Chatterbox)
IP Source Protection & HTML Smuggling
Lab 13 HTML Smuggling Through Web Proxies
Brief Scanning & Port Recon
Lab 14 Reconnaissance (Shodan + Nmap)
Reconnaissance & Target Mapping
Vishing Tradecraft & Phone Presence
Lab 15 Vishing Plan
039 Labs
Redirector Security & Managing Multiple IA Techniques
Lab 16 Deploying Cred Grab Clone
Campaign Play-by-Play & First Credentials
Lab 17 First Callback
Novel User Persistence
Lab 18 Installing User Persistence
Lab 19 Deploying EvilNoVNC
Phishing Email Tradecraft
Lab 20 Capturing Credentials w/ EvilNoVNC
Supply Chain Deployment & SOC Response
Lab 21 Deploying Poisoned PIP
Lab 22 Triaging Loretta's Email
Webshell Deployment & SOCKS Tunneling
Lab 23 Webshell Deployment + DMZ SA
Lab 24 SOCKS Tunneling (Neo-reGeorg)
0412 Labs
Day-of-Ops Team Lead Standup
Evaluating Leads & Dead Ends
Lab 25 LDAP Dump via SOCKS
Redsocks Overview
Lab 26 Redsocks
ADCS Overview & Certificate Authentication
Lab 27 ADCS Discovery
Lab 28 ADCS Exploitation (ESC1)
Why Fortification Matters & Anti-Forensics
Lab 29 Domain Fortification
Operational Logging
Lab 30 Logging (Obsidian)
Data Analysis with Nemesis
Lab 31 Data Mining (Nemesis)
Team Lead Moment: Picking a Workstation
Lab 32 Domain Fortification (Target Selection + DCOM)
Child Domains & Enterprise Admin
Lab 33 Manufacturing Domain Compromise
Corporate Web Proxy Challenges
Finding Target User Workstations
Lab 34 Compromising the Integrator
Cookie Stealing (AD Auth vs Password-Based Auth)
Lab 35 Hijacking Authentication Cookies
TruffleHog & Git Repo Triage
Lab 36 Triaging Git Repos (TruffleHog)
059 Labs
Breaking Down Complex Tunnels
Team Lead: Decomposing Complex Attacks Into Steps
Elastic Fleet API & Agent Management
Lab 37 Elastic Fleet Recon
Lab 38 WebDAV Payload Delivery
NTLMv2 Hash Harvesting via File Shares
Hunting Writable Active Directory DACLs
Lab 40 Writable Active Directory DACLs
Lab 41 AD Target Discovery & Token Theft
Proxifier & Kerberos Ticket Injection
Lab 42 Kerberos Pass-the-Ticket with Proxifier
Custom C2 over ICMP
Lab 43 Custom C2 — ICMP Transport + Deployment
Lab 44 Getting Caught: Testing Blue Team Detection
Lab 45 Post-Op Cleanup
Conclusion & Assessment Completion
Certification
A new take on certification
No multiple choice. No memorization. You prove it by doing it. the way a real engagement plays out. Finished the exam? Prepare your 15 minute brief to existing Senior Red Team Operators and be ready to answer any questions they may have.
ROPS-RT2 Certified
Fully hands-on, proctored exam. Prove your skills live. there is no multiple choice.
End-to-end mock engagement in a fresh environment you've never touched.
Tradecraft & operator-logging review. you're judged on how you work, not just the flag.
15-minute live brief to senior Red Team operators. Present your findings, defend your decisions, and answer hard questions from experienced operators who have been there.
Exam format and duration will be confirmed at launch.
Your Instructor
Taught by someone who's led the op.
