CHOOSE YOUR
ACCESS TIER

Modern AV has three detection layers: static (bytes on disk), behavioural (API call chains at runtime), and cloud-submitted sandbox. IRON-DOME destroys static signatures with encryption, avoids the suspicious RWX→execute behavioural chain, removes the API hooks behavioural engines rely on, and defeats sandbox timing. Targeting all three layers simultaneously is what gets 0 detections — beating just one layer isn't enough.

Runs on the compromised machine. Sleeps for a configurable interval (default 30s with ±10s jitter), then sends an HTTPS callback to the handler. Jitter prevents detection by timing-pattern analysis — a beacon that checks in every exactly 30 seconds is trivial to spot in network logs. The jitter makes the pattern statistical noise. On callback the beacon receives a queued job (run command, upload file, spawn process etc.), executes it, and sends output back encrypted. If no job, it sleeps again. Minimal network footprint.

Receives beacon callbacks over HTTPS. Maintains a job queue per implant. Stores output. Serves a listener on configurable port. Traffic profile mimics a legitimate web server — responds to non-beacon requests with normal HTTP responses so port scans don't flag an open C2 port. Malleable comms profile lets you shape the HTTPS request headers to look like browser traffic (User-Agent, Accept headers etc.).

CLI interface for the pentester. List active beacons, select a session, run commands. Built-in modules: screenshot, keylogger, credential dump path, file upload/download, lateral movement (pass-the-hash via NTLM), persistence (registry run key, scheduled task, WMI subscription). Output is logged per-session for report generation.

C2 traffic is flagged by network defenders when it's periodic, encrypted in non-standard ways, or communicates with known-bad IPs. CHEYANNE uses HTTPS (standard encrypted channel), jitter (defeats periodicity detection), mimicked browser headers (passes application-layer inspection), and operator-controlled listener domains (fresh infrastructure = no threat-intel hits). Compare this to off-the-shelf tools like Metasploit — whose callback signatures are in every SIEM rule. This is custom, undocumented, and not in any threat intelligence database.

Android's security model is permission-based, not code-based. The OS doesn't analyse what your app does with a permission — it only checks if you have it. Once the user grants SMS, location, and contacts access (which apps legitimately request all the time), STARKILLER has the same access as a banking app. The APK build pipeline applies string obfuscation and class renaming — Google Play Protect scans by signature and behaviour; obfuscation defeats signature, and the behaviour (background service, network calls) looks identical to any live-data app.

Pure PowerShell and .NET — no external executables dropped to disk. Uses built-in Windows APIs and WMI rather than spawning child processes that trigger parent-child chain detection (e.g. powershell.exe → net.exe is flagged; WMI queries from powershell.exe are not). Output is structured JSON for direct import into pentest report templates. No external network calls — everything runs locally against the Windows API.

// Zero-width character map
U+200B = ZERO WIDTH SPACE        → binary 0
U+200C = ZERO WIDTH NON-JOINER  → binary 1

// Encoding "A" (ASCII 0x41 = 01000001)
Binary:   0 1 0 0 0 0 0 1
Encoded:  ​‌​​​​​‌
// ↑ That line contains 8 invisible characters. Try selecting it.

// Practical use: embed in a Slack message
msg = "Hey, meeting at 3pm" + encode(c2_command) + "."
// Recipient sees:  "Hey, meeting at 3pm."
// C2 decoder sees: "Hey, meeting at 3pm[EXEC:whoami]."

Data Loss Prevention tools scan for patterns: credit card numbers, keywords, binary file signatures, large base64 blobs. Zero-width characters are valid Unicode — they appear in legitimate documents (right-to-left markers, no-break joins in Arabic/Thai text). DLP tools see plain text, not binary exfiltration. The channel looks like a Slack message, not a data exfil event. Standard regex and keyword matching is completely blind to this. Only a tool explicitly checking for anomalous zero-width character density would flag it — and almost nothing does this by default.

Monthly: Web-hosted access — run scans through the hosted interface, download reports. No setup required.
Full Bundle: Full source code + deployment guide. Host it yourself, modify detection rules, integrate into your own toolchain, extend with custom checks.