https://simplecast.com Kill Chains and Coffee "Kill Chains and Coffee" breaks down how real AI attacks unfold, one kill chain at a time. Host Greg Heon, VP of Product Management at Armadin, joins red team operators and security researchers to show how attackers break in, move laterally, and reach their objective—and explains where defenders can break the chain. As AI-generated attacks spread, the series explores how offensive security is changing and how pairing experienced red teamers with AI tooling lets you test your defenses the way modern adversaries attack. For CISOs, security leaders, and practitioners who want the attacker's viewpoint without the hype. 2026 Armadin en Thu, 12 Nov 2026 20:54:53 +0000 Thu, 12 Nov 2026 20:55:00 +0000 https://kill-chains-and-coffee.simplecast.com Kill Chains and Coffee https://image.simplecastcdn.com/images/ad624afe-5838-4c7a-b2cb-f92d99708994/15882b02-364d-4988-b989-23845b521bbd/3000x3000/cropped_1790265402298.jpg?aid=rss_feed https://kill-chains-and-coffee.simplecast.com episodic "Kill Chains and Coffee" breaks down how real AI attacks unfold, one kill chain at a time. Host Greg Heon, VP of Product Management at Armadin, joins red team operators and security researchers to show how attackers break in, move laterally, and reach their objective—and explains where defenders can break the chain. As AI-generated attacks spread, the series explores how offensive security is changing and how pairing experienced red teamers with AI tooling lets you test your defenses the way modern adversaries attack. For CISOs, security leaders, and practitioners who want the attacker's viewpoint without the hype. Armadin false https://feeds.simplecast.com/o0rdTWqv ai security, hyperattack, ai hyperattack, ill chains and coffee, autonomous cyberattacks, offensive security, kevin mandia, ssrf, cybersecurity, continuous assessment, cloud security, machine-speed attacks, red teaming, penetration testing, greg heon, rce, attack surface, kill chain, armadin, evan pena, agentic ai, ai agents, pentest, privilege escalation, cve exploitation Armadin helena.davis@armadin.com d71e07b7-35fd-4ccb-a85f-52360ad471ad Pre-Auth RCE in Opengear Servers | Kill Chains and Coffee The speed of offensive security is rapidly compounding. As AI performs a larger portion of the security testing workload, human experts are free to explore strategic insights that they can then turn into new agentic skills. 

This repeatable cycle is broadening attack surface coverage while helping human researchers discover critical vulnerabilities and kill chains they never had the time to look for. That includes embedded devices at the network edge, which aren’t typically as scrutinized as web applications during pentesting. 

In this episode of “Kill Chains and Coffee,” host Greg Heon and red team operator Nick Cerne discuss the discovery of a zero-day vulnerability on an internet-facing Opengear server that led to remote code execution (RCE). 

Administrators can use these out-of-band devices to manage other network assets through physical serial ports in the event of network failure. That’s why exposing Opengear devices to the internet could potentially grant serial root access to multiple connected devices. 

As part of this kill chain discovery, the Armadin team downloaded firmware, created a software bill of materials, and used a large language model (LLM) to target the internet-facing vulnerability. The vulnerability itself stemmed from a heap corruption issue within an HTTP request where a 256-byte buffer was allocated. 

Armadin reported the vulnerability to Opengear through coordinated disclosure, and Opengear has already released updated firmware. The issue is tracked as CVE-2026-102212: https://www.cve.org/CVERecord?id=CVE-2026-102212 

Remediation guidance: The near-term action is to apply firmware version 5.5.3 (or later) to remediate CVE-2026-102212 across all CM7100 and related models running vulnerable libgcgi builds. 

You can read the full remediation guidance here: https://www.armadin.com/blog-posts/compromising-the-out-of-band-management-plane-pre-auth-rce-via-heap-overflow-in-opengear-console-servers 

Discover how Armadin Hyperattacks safely deliver the machine speed and scale to help you identify and eliminate exploitable risk across your entire environment. Learn how at https://hyperattack.ai 

RESOURCES 
Companion Blog Post: https://www.armadin.com/blog-posts/compromising-the-out-of-band-management-plane-pre-auth-rce-via-heap-overflow-in-opengear-console-servers 
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity
 

]]> Thu, 12 Nov 2026 20:54:53 +0000 helena.davis@armadin.com (Armadin) https://kill-chains-and-coffee.simplecast.com/episodes/pre-auth-rce-in-opengear-servers-kill-chains-and-coffee-QTkNQ522 The speed of offensive security is rapidly compounding. As AI performs a larger portion of the security testing workload, human experts are free to explore strategic insights that they can then turn into new agentic skills. 

This repeatable cycle is broadening attack surface coverage while helping human researchers discover critical vulnerabilities and kill chains they never had the time to look for. That includes embedded devices at the network edge, which aren’t typically as scrutinized as web applications during pentesting. 

In this episode of “Kill Chains and Coffee,” host Greg Heon and red team operator Nick Cerne discuss the discovery of a zero-day vulnerability on an internet-facing Opengear server that led to remote code execution (RCE). 

Administrators can use these out-of-band devices to manage other network assets through physical serial ports in the event of network failure. That’s why exposing Opengear devices to the internet could potentially grant serial root access to multiple connected devices. 

As part of this kill chain discovery, the Armadin team downloaded firmware, created a software bill of materials, and used a large language model (LLM) to target the internet-facing vulnerability. The vulnerability itself stemmed from a heap corruption issue within an HTTP request where a 256-byte buffer was allocated. 

Armadin reported the vulnerability to Opengear through coordinated disclosure, and Opengear has already released updated firmware. The issue is tracked as CVE-2026-102212: https://www.cve.org/CVERecord?id=CVE-2026-102212 

Remediation guidance: The near-term action is to apply firmware version 5.5.3 (or later) to remediate CVE-2026-102212 across all CM7100 and related models running vulnerable libgcgi builds. 

You can read the full remediation guidance here: https://www.armadin.com/blog-posts/compromising-the-out-of-band-management-plane-pre-auth-rce-via-heap-overflow-in-opengear-console-servers 

Discover how Armadin Hyperattacks safely deliver the machine speed and scale to help you identify and eliminate exploitable risk across your entire environment. Learn how at https://hyperattack.ai 

RESOURCES 
Companion Blog Post: https://www.armadin.com/blog-posts/compromising-the-out-of-band-management-plane-pre-auth-rce-via-heap-overflow-in-opengear-console-servers 
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity
 

]]> Pre-Auth RCE in Opengear Servers | Kill Chains and Coffee Armadin 00:15:21 false full 7 d78d0309-865f-4e6a-83e9-47d8ce0427af Transforming the Speed and Scale of Web App Testing | Kill Chains and Coffee Traditional penetration testing lacks the ability to cover large attack surfaces with the speed and sophistication needed to address AI-driven threats. In contrast, Hyperattacks can deploy tens of thousands of agents working in parallel to broaden coverage at machine speed.

In this episode of “Kill Chains and Coffee,” host Greg Heon welcomes Armadin red team operator Ethan Wilkins to discuss web application testing. They cover a kill chain where Armadin gained control of a test server and exploited vulnerabilities through a Hyperattack to breach the organization’s perimeter.

It’s an insightful example of administrative account takeover from an unauthenticated attacker on the internet. The episode reflects a known lack of built-in security with mainstream but aging software applications still in wide use today.

The engagement started by testing a first-party web app used in a document management system. The Armadin team quickly discovered that an “encryption” key was hardcoded into the source code rather than a deployment-specific configuration file. That meant the same key would unlock all instances of the app wherever it was deployed, ultimately exposing it to full compromise.

An even broader issue was the deployment of the app in production environments for multiple customers. What originally began as a pre-production vulnerability assessment led to Armadin finding exploitable risk in a live environment, elevating it to a high-priority fix within days of discovery.

This kill chain demonstrates the value of knowing all paths into internet-facing web apps so organizations can eliminate vulnerabilities before AI-enabled attacks occur.

For security teams: Armadin Hyperattacks safely deliver the machine speed and scale to identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI. 

RESOURCES 
Related Blog Post: www.armadin.com/blog-posts/weaponizing-cryptography-mistakes-to-achieve-rce-and-administrative-access-kill-chains-and-coffee
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity
 

]]> Thu, 29 Oct 2026 17:31:31 +0000 helena.davis@armadin.com (Armadin) https://kill-chains-and-coffee.simplecast.com/episodes/transforming-the-speed-and-scale-of-web-app-testing-kill-chains-and-coffee-96RioRtK Traditional penetration testing lacks the ability to cover large attack surfaces with the speed and sophistication needed to address AI-driven threats. In contrast, Hyperattacks can deploy tens of thousands of agents working in parallel to broaden coverage at machine speed.

In this episode of “Kill Chains and Coffee,” host Greg Heon welcomes Armadin red team operator Ethan Wilkins to discuss web application testing. They cover a kill chain where Armadin gained control of a test server and exploited vulnerabilities through a Hyperattack to breach the organization’s perimeter.

It’s an insightful example of administrative account takeover from an unauthenticated attacker on the internet. The episode reflects a known lack of built-in security with mainstream but aging software applications still in wide use today.

The engagement started by testing a first-party web app used in a document management system. The Armadin team quickly discovered that an “encryption” key was hardcoded into the source code rather than a deployment-specific configuration file. That meant the same key would unlock all instances of the app wherever it was deployed, ultimately exposing it to full compromise.

An even broader issue was the deployment of the app in production environments for multiple customers. What originally began as a pre-production vulnerability assessment led to Armadin finding exploitable risk in a live environment, elevating it to a high-priority fix within days of discovery.

This kill chain demonstrates the value of knowing all paths into internet-facing web apps so organizations can eliminate vulnerabilities before AI-enabled attacks occur.

For security teams: Armadin Hyperattacks safely deliver the machine speed and scale to identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI. 

RESOURCES 
Related Blog Post: www.armadin.com/blog-posts/weaponizing-cryptography-mistakes-to-achieve-rce-and-administrative-access-kill-chains-and-coffee
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity
 

]]> Transforming the Speed and Scale of Web App Testing | Kill Chains and Coffee Armadin 00:25:21 false full 6 1390c0d5-6537-4621-8805-f213beabcf73 Zero-Day Exploitation to Internal Compromise | Kill Chains and Coffee Zero-day vulnerabilities in commonly used third-party applications can put your environment at risk, especially if AI-enabled adversaries move faster than you do in finding them. 

In this episode of “Kill Chains and Coffee,” host Greg Heon dives deep with Armadin Founder, Evan Peña and Senior Capabilities Researcher, Kai Huang on a series of unauthenticated remote code executions (RCEs) Armadin conducted on SolarWinds products. 

The Armadin team combined assumed breach scenarios with advanced zero-day capabilities to build complete kill chains from external assets to internal systems. They discovered the zero-days using large language models (LMMs) to handle approximately 90% of the workload, with human red team guidance driving the final 10%. 

The AI models were a significant force multiplier of human expertise, in terms of both speed and scale. One attack path ended in domain admin compromise, while another reached internal network switches, potentially exposing industrial devices. 

These attacks foreshadow what might become commonplace in the next few years: future LLMs advancing AI-driven attacks to an impact level that only nation-state adversaries can currently achieve.

Guidance for security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify and eliminate exploitable risk across your entire environment. Learn how at https://hyperattack.AI.

RESOURCES 
Companion Blog Posts:
Part I: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1
Part II: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2
Part III: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Thu, 15 Oct 2026 17:56:50 +0000 helena.davis@armadin.com (Armadin) https://kill-chains-and-coffee.simplecast.com/episodes/zero-day-exploitation-to-internal-compromise-kill-chains-and-coffee-e0yUF7Fr Zero-day vulnerabilities in commonly used third-party applications can put your environment at risk, especially if AI-enabled adversaries move faster than you do in finding them. 

In this episode of “Kill Chains and Coffee,” host Greg Heon dives deep with Armadin Founder, Evan Peña and Senior Capabilities Researcher, Kai Huang on a series of unauthenticated remote code executions (RCEs) Armadin conducted on SolarWinds products. 

The Armadin team combined assumed breach scenarios with advanced zero-day capabilities to build complete kill chains from external assets to internal systems. They discovered the zero-days using large language models (LMMs) to handle approximately 90% of the workload, with human red team guidance driving the final 10%. 

The AI models were a significant force multiplier of human expertise, in terms of both speed and scale. One attack path ended in domain admin compromise, while another reached internal network switches, potentially exposing industrial devices. 

These attacks foreshadow what might become commonplace in the next few years: future LLMs advancing AI-driven attacks to an impact level that only nation-state adversaries can currently achieve.

Guidance for security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify and eliminate exploitable risk across your entire environment. Learn how at https://hyperattack.AI.

RESOURCES 
Companion Blog Posts:
Part I: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1
Part II: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2
Part III: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3
Armadin Offensive Security Platform: https://armadin.com/platform 
AI Hyperattacks: https://hyperattack.AI
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Zero-Day Exploitation to Internal Compromise | Kill Chains and Coffee Armadin 00:23:02 false full 5 ae9d7302-5f8c-4558-bb07-881c9e529ff8 Command Execution on Cleo Harmony via SAML Bypass | Kill Chains and Coffee In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one.

In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents.

The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The Armadin attacker found two key vulnerabilities. The first was SAML XML Signature Wrapping (XSW). Cleo verified one SAML assertion but consumed an attacker-injected one and the attacker ultimately gained access to live support ticket files and customer data.

The second vulnerability was ‘cross-store identity confusion’, which escalated from forged low-privilege identity to full Cleo administration privileges. Chained together, these vulnerabilities culminated in Cleo Actions abuse, with admin access sufficient for OS command execution in a production environment with sensitive data that could have impacted multiple organizations.

The vulnerabilities were tracked as CVE-2026-84114 and CVE-2026-84115, and have already been patched.

For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: https://www.armadin.com/blog-posts/compromising-cleo-harmony-a-saml-bypass-chain-to-arbitrary-code-execution
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Thu, 24 Sep 2026 16:52:33 +0000 helena.davis@armadin.com (Greg Heon, Ilyass El Hadi) https://kill-chains-and-coffee.simplecast.com/episodes/command-execution-on-cleo-harmony-via-saml-bypass-kill-chains-and-coffee-bvRr8f5d In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one.

In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents.

The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The Armadin attacker found two key vulnerabilities. The first was SAML XML Signature Wrapping (XSW). Cleo verified one SAML assertion but consumed an attacker-injected one and the attacker ultimately gained access to live support ticket files and customer data.

The second vulnerability was ‘cross-store identity confusion’, which escalated from forged low-privilege identity to full Cleo administration privileges. Chained together, these vulnerabilities culminated in Cleo Actions abuse, with admin access sufficient for OS command execution in a production environment with sensitive data that could have impacted multiple organizations.

The vulnerabilities were tracked as CVE-2026-84114 and CVE-2026-84115, and have already been patched.

For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: https://www.armadin.com/blog-posts/compromising-cleo-harmony-a-saml-bypass-chain-to-arbitrary-code-execution
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Command Execution on Cleo Harmony via SAML Bypass | Kill Chains and Coffee Greg Heon, Ilyass El Hadi 00:19:21 In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one. In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents. The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The Armadin attacker found two key vulnerabilities. The first was SAML XML Signature Wrapping (XSW). Cleo verified one SAML assertion but consumed an attacker-injected one and the attacker ultimately gained access to live support ticket files and customer data. The second vulnerability was ‘cross-store identity confusion’, which escalated from forged low-privilege identity to full Cleo administration privileges. Chained together, these vulnerabilities culminated in Cleo Actions abuse, with admin access sufficient for OS command execution in a production environment with sensitive data that could have impacted multiple organizations. The vulnerabilities were tracked as CVE-2026-84114 and CVE-2026-84115, and have already been patched. For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI. In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one. In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents. The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The Armadin attacker found two key vulnerabilities. The first was SAML XML Signature Wrapping (XSW). Cleo verified one SAML assertion but consumed an attacker-injected one and the attacker ultimately gained access to live support ticket files and customer data. The second vulnerability was ‘cross-store identity confusion’, which escalated from forged low-privilege identity to full Cleo administration privileges. Chained together, these vulnerabilities culminated in Cleo Actions abuse, with admin access sufficient for OS command execution in a production environment with sensitive data that could have impacted multiple organizations. The vulnerabilities were tracked as CVE-2026-84114 and CVE-2026-84115, and have already been patched. For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI. ai security, armadin, attack surface, cleo actions abuse, cleo harmony, command execution, cross-store identity confusion, cve-2026-84114, cve-2026-84115, cybersecurity, hyperattack, idp, kill chains and coffee, managed file transfer, mft, offensive security, okta, os command execution, penetration testing, privilege escalation, red team, saml bypass, saml xml signature wrapping, xsw false full 4 27b5a0d4-c847-4d79-b472-0d590e8c1869 Why AI Beats Human Pentesting | Kill Chains and Coffee Human-led penetration testing is too narrow and slow. Only AI agents can give you the scale and speed of 1,000 virtual pentesters collaborating on a single mission.

In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin Principal Red Team Operator Craig Wright go in depth on a recent kill chain that targeted a large telco provider. The results revealed the widening gap between legacy pentesting and using Armadin’s AI attacker as an offensive security tool.

The managed assessment covered 22,749 internet-facing services, with 175 services selected through intelligent targeting. The attack included thousands of AI agents taking 220,479 actions and finding exploitable risk that might have been hiding for decades.

The kill chain sequence began with an AI agent identifying a hidden registration endpoint using route name inference. It self-registered an account, then found a second registration mechanism and used the new account to generate an authorization token before pivoting to authenticated testing. It then identified three endpoints and produced working SQL injection payloads, eventually accessing five additional internal SQL servers.

The kill chain exposed 68.5 million rows of critical data, including workforce Personally Identifiable Information (PII), 911 call geolocation data, and enough SIM swap precursor data to fuel a social engineering campaign and execute a full SIM swap.

The key lesson is you can’t expect an 80-hour human-led pentest to address thousands of internet-facing services, but an agentic AI approach can easily cover the entire attack surface—all paths, all the time.

For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify critical exploitable risk across your entire environment.

Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-5-why-ai-beats-human-pentesting
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Thu, 24 Sep 2026 16:52:24 +0000 helena.davis@armadin.com (Greg Heon, Craig Wright) https://kill-chains-and-coffee.simplecast.com/episodes/why-ai-beats-human-pentesting-kill-chains-and-coffee-nI2WlYtH Human-led penetration testing is too narrow and slow. Only AI agents can give you the scale and speed of 1,000 virtual pentesters collaborating on a single mission.

In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin Principal Red Team Operator Craig Wright go in depth on a recent kill chain that targeted a large telco provider. The results revealed the widening gap between legacy pentesting and using Armadin’s AI attacker as an offensive security tool.

The managed assessment covered 22,749 internet-facing services, with 175 services selected through intelligent targeting. The attack included thousands of AI agents taking 220,479 actions and finding exploitable risk that might have been hiding for decades.

The kill chain sequence began with an AI agent identifying a hidden registration endpoint using route name inference. It self-registered an account, then found a second registration mechanism and used the new account to generate an authorization token before pivoting to authenticated testing. It then identified three endpoints and produced working SQL injection payloads, eventually accessing five additional internal SQL servers.

The kill chain exposed 68.5 million rows of critical data, including workforce Personally Identifiable Information (PII), 911 call geolocation data, and enough SIM swap precursor data to fuel a social engineering campaign and execute a full SIM swap.

The key lesson is you can’t expect an 80-hour human-led pentest to address thousands of internet-facing services, but an agentic AI approach can easily cover the entire attack surface—all paths, all the time.

For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify critical exploitable risk across your entire environment.

Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-5-why-ai-beats-human-pentesting
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Why AI Beats Human Pentesting | Kill Chains and Coffee Greg Heon, Craig Wright 00:19:37 Human-led penetration testing is too narrow and slow. Only AI agents can give you the scale and speed of 1,000 virtual pentesters collaborating on a single mission. In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin Principal Red Team Operator Craig Wright go in depth on a recent kill chain that targeted a large telco provider. The results revealed the widening gap between legacy pentesting and using Armadin’s AI attacker as an offensive security tool. The managed assessment covered 22,749 internet-facing services, with 175 services selected through intelligent targeting. The attack included thousands of AI agents taking 220,479 actions and finding exploitable risk that might have been hiding for decades. The kill chain sequence began with an AI agent identifying a hidden registration endpoint using route name inference. It self-registered an account, then found a second registration mechanism and used the new account to generate an authorization token before pivoting to authenticated testing. It then identified three endpoints and produced working SQL injection payloads, eventually accessing five additional internal SQL servers. The kill chain exposed 68.5 million rows of critical data, including workforce Personally Identifiable Information (PII), 911 call geolocation data, and enough SIM swap precursor data to fuel a social engineering campaign and execute a full SIM swap. The key lesson is you can’t expect an 80-hour human-led pentest to address thousands of internet-facing services, but an agentic AI approach can easily cover the entire attack surface—all paths, all the time. For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify critical exploitable risk across your entire environment. Learn how at http://hyperattack.AI. Human-led penetration testing is too narrow and slow. Only AI agents can give you the scale and speed of 1,000 virtual pentesters collaborating on a single mission. In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin Principal Red Team Operator Craig Wright go in depth on a recent kill chain that targeted a large telco provider. The results revealed the widening gap between legacy pentesting and using Armadin’s AI attacker as an offensive security tool. The managed assessment covered 22,749 internet-facing services, with 175 services selected through intelligent targeting. The attack included thousands of AI agents taking 220,479 actions and finding exploitable risk that might have been hiding for decades. The kill chain sequence began with an AI agent identifying a hidden registration endpoint using route name inference. It self-registered an account, then found a second registration mechanism and used the new account to generate an authorization token before pivoting to authenticated testing. It then identified three endpoints and produced working SQL injection payloads, eventually accessing five additional internal SQL servers. The kill chain exposed 68.5 million rows of critical data, including workforce Personally Identifiable Information (PII), 911 call geolocation data, and enough SIM swap precursor data to fuel a social engineering campaign and execute a full SIM swap. The key lesson is you can’t expect an 80-hour human-led pentest to address thousands of internet-facing services, but an agentic AI approach can easily cover the entire attack surface—all paths, all the time. For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify critical exploitable risk across your entire environment. Learn how at http://hyperattack.AI. agentic ai, ai agents, ai hyperattack, ai security, armadin, attack surface, authentication bypass, cybersecurity, kill chain, offensive security, penetration testing, pentest, pii exposure, red teaming, route name inference, sim swap, sqli, sql injection, telco security, virtual pentesters false full 3 748a35a2-d670-45f0-9892-4bb82af21d50 World’s Largest Controlled Hyperattack | Kill Chains and Coffee What’s worse: Getting an RCE dropped on you at 5 pm on a Friday or waking up on Monday with 12 RCEs sitting in your inbox?

Find out what our experts think on this episode of “Kill Chains and Coffee.” Host Greg Heon sits down with Armadin Offensive Security Manager Christian Elston to cover two kill chains: Armadin’s first-ever AI Hyperattack and the world’s largest controlled AI Hyperattack.

Key conversations include:
The growing power behind AI agents attacking organizations from the outside in
Why safety and control are so critical in the wake of the HuggingFace incident and similar attacks.

In the first kill chain, Armadin engaged with a Fortune 600 company, launching 100 simultaneous attacks with thousands of agents—nearly 1 million autonomous actions.

The agents discovered 12 endpoints vulnerable to unauthenticated Remote Code Execution (RCE) from the internet through Server-Side Request Forgery (SSRF). A combination of SRRF and a known CVE led to an overly permissive Kubernetes service. The agents ultimately escaped the Kubernetes pod and compromised the organization’s entire cloud infrastructure.

The second kill chain was the world’s largest controlled cyberattack, conducted for an Armadin client with globally critical infrastructure. The attack targeted over 25,000 services and executed millions of autonomous actions. The resulting report generated over 200 findings with nearly 40 validated kill chains, including exposure to the company’s crown jewels.

For security teams: This type of repeatable controlled assessment from Armadin gives you the tools and confidence to identify truly exploitable risk across your environment.

Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-4-worlds-largest-controlled-hyperattack 
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> Thu, 24 Sep 2026 16:52:14 +0000 helena.davis@armadin.com (Greg Heon, Christian Elston) https://kill-chains-and-coffee.simplecast.com/episodes/worlds-largest-controlled-hyperattack-kill-chains-and-coffee-D_LuxCqK What’s worse: Getting an RCE dropped on you at 5 pm on a Friday or waking up on Monday with 12 RCEs sitting in your inbox?

Find out what our experts think on this episode of “Kill Chains and Coffee.” Host Greg Heon sits down with Armadin Offensive Security Manager Christian Elston to cover two kill chains: Armadin’s first-ever AI Hyperattack and the world’s largest controlled AI Hyperattack.

Key conversations include:
The growing power behind AI agents attacking organizations from the outside in
Why safety and control are so critical in the wake of the HuggingFace incident and similar attacks.

In the first kill chain, Armadin engaged with a Fortune 600 company, launching 100 simultaneous attacks with thousands of agents—nearly 1 million autonomous actions.

The agents discovered 12 endpoints vulnerable to unauthenticated Remote Code Execution (RCE) from the internet through Server-Side Request Forgery (SSRF). A combination of SRRF and a known CVE led to an overly permissive Kubernetes service. The agents ultimately escaped the Kubernetes pod and compromised the organization’s entire cloud infrastructure.

The second kill chain was the world’s largest controlled cyberattack, conducted for an Armadin client with globally critical infrastructure. The attack targeted over 25,000 services and executed millions of autonomous actions. The resulting report generated over 200 findings with nearly 40 validated kill chains, including exposure to the company’s crown jewels.

For security teams: This type of repeatable controlled assessment from Armadin gives you the tools and confidence to identify truly exploitable risk across your environment.

Learn how at http://hyperattack.AI.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-4-worlds-largest-controlled-hyperattack 
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn: https://www.linkedin.com/company/armadin 
Twitter/X: https://x.com/armadinsecurity

]]> World’s Largest Controlled Hyperattack | Kill Chains and Coffee Greg Heon, Christian Elston 00:18:49 What’s worse: Getting an RCE dropped on you at 5 pm on a Friday or waking up on Monday with 12 RCEs sitting in your inbox? Find out what our experts think on this episode of “Kill Chains and Coffee.” Host Greg Heon sits down with Armadin Offensive Security Manager Christian Elston to cover two kill chains: Armadin’s first-ever AI Hyperattack and the world’s largest controlled AI Hyperattack. Key conversations include: The growing power behind AI agents attacking organizations from the outside in Why safety and control are so critical in the wake of the HuggingFace incident and similar attacks. In the first kill chain, Armadin engaged with a Fortune 600 company, launching 100 simultaneous attacks with thousands of agents—nearly 1 million autonomous actions. The agents discovered 12 endpoints vulnerable to unauthenticated Remote Code Execution (RCE) from the internet through Server-Side Request Forgery (SSRF). A combination of SRRF and a known CVE led to an overly permissive Kubernetes service. The agents ultimately escaped the Kubernetes pod and compromised the organization’s entire cloud infrastructure. The second kill chain was the world’s largest controlled cyberattack, conducted for an Armadin client with globally critical infrastructure. The attack targeted over 25,000 services and executed millions of autonomous actions. The resulting report generated over 200 findings with nearly 40 validated kill chains, including exposure to the company’s crown jewels. For security teams: This type of repeatable controlled assessment from Armadin gives you the tools and confidence to identify truly exploitable risk across your environment. Learn how at http://hyperattack.AI. What’s worse: Getting an RCE dropped on you at 5 pm on a Friday or waking up on Monday with 12 RCEs sitting in your inbox? Find out what our experts think on this episode of “Kill Chains and Coffee.” Host Greg Heon sits down with Armadin Offensive Security Manager Christian Elston to cover two kill chains: Armadin’s first-ever AI Hyperattack and the world’s largest controlled AI Hyperattack. Key conversations include: The growing power behind AI agents attacking organizations from the outside in Why safety and control are so critical in the wake of the HuggingFace incident and similar attacks. In the first kill chain, Armadin engaged with a Fortune 600 company, launching 100 simultaneous attacks with thousands of agents—nearly 1 million autonomous actions. The agents discovered 12 endpoints vulnerable to unauthenticated Remote Code Execution (RCE) from the internet through Server-Side Request Forgery (SSRF). A combination of SRRF and a known CVE led to an overly permissive Kubernetes service. The agents ultimately escaped the Kubernetes pod and compromised the organization’s entire cloud infrastructure. The second kill chain was the world’s largest controlled cyberattack, conducted for an Armadin client with globally critical infrastructure. The attack targeted over 25,000 services and executed millions of autonomous actions. The resulting report generated over 200 findings with nearly 40 validated kill chains, including exposure to the company’s crown jewels. For security teams: This type of repeatable controlled assessment from Armadin gives you the tools and confidence to identify truly exploitable risk across your environment. Learn how at http://hyperattack.AI. ai agents, ai hyperattack, ai security, armadin, autonomous cyberattacks, cloud infrastructure security, continuous assessment, critical infrastructure, cve exploitation, fortune 600 security, huggingface incident, kill chain, kubernetes pod escape, kubernetes security, machine-speed attacks, offensive security, rce, red teaming, remote code execution, server-side request forgery, ssrf, world's largest cyberattack false full 2 824c4225-9f11-4f55-9d97-ea1577c21b61 Cloud Compromise & OT Reachability | Kill Chains and Coffee Discover how low-priority vulnerabilities turn into complete kill chains in the AI era.

In this episode of “Kill Chains and Coffee," Armadin Founder and Chief Offensive Security Officer Evan Peña joins host Greg Heon to discuss two kill chains Armadin recently discovered.

Kill chain 1 progressed from SSRF to API remote code execution (RCE) to Kubernetes and the cloud. Kill chain 2 went from an assumed breach to an operational technology (OT) environment.

The kill chain 1 entry point was unauthenticated SSRF via a manipulated HTTP header. The SSRF chained to API RCE, landing the Armadin attacker in a Kubernetes pod. Reconnaissance on the pod revealed a local database with service account credentials stored in clear text.

The attacker used a privileged container to mount the host OS and break out of the pod—accessing an AWS tenant, additional pods, cloud accounts, and production data. Key takeaway: SSRF alone looked like a low-priority issue, but the full kill chain revealed production data exposure.

Kill chain 2 started with a low-privileged domain account on a Windows Server 2019 host, where the Armadin attacker gained access through a 5-year-old critical CVE (Print Nightmare). The payload was delivered via a Microsoft Defender AV exclusion folder configured for a third-party security tool. The attacker then found a local building management system (BMS) database, where it accessed sensor data, OT network views, and multiple protocols.

The customer had run annual penetration tests for a decade but had never surfaced the OT issue. The AI-powered Armadin attacker had the scale and speed to cover the entire attack surface: all paths in, all the time.

For security teams: This type of repeatable controlled assessment gives you the tools and confidence to identify truly exploitable risk across your environment.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-3-ssrf-to-api-rce 
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo 

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn:   / armadin   
Twitter/X: https://x.com/armadinsecurity

]]> Thu, 24 Sep 2026 16:51:59 +0000 helena.davis@armadin.com (Greg Heon, Evan Peña) https://kill-chains-and-coffee.simplecast.com/episodes/cloud-compromise-ot-reachability-kill-chains-and-coffee-Jokp964i Discover how low-priority vulnerabilities turn into complete kill chains in the AI era.

In this episode of “Kill Chains and Coffee," Armadin Founder and Chief Offensive Security Officer Evan Peña joins host Greg Heon to discuss two kill chains Armadin recently discovered.

Kill chain 1 progressed from SSRF to API remote code execution (RCE) to Kubernetes and the cloud. Kill chain 2 went from an assumed breach to an operational technology (OT) environment.

The kill chain 1 entry point was unauthenticated SSRF via a manipulated HTTP header. The SSRF chained to API RCE, landing the Armadin attacker in a Kubernetes pod. Reconnaissance on the pod revealed a local database with service account credentials stored in clear text.

The attacker used a privileged container to mount the host OS and break out of the pod—accessing an AWS tenant, additional pods, cloud accounts, and production data. Key takeaway: SSRF alone looked like a low-priority issue, but the full kill chain revealed production data exposure.

Kill chain 2 started with a low-privileged domain account on a Windows Server 2019 host, where the Armadin attacker gained access through a 5-year-old critical CVE (Print Nightmare). The payload was delivered via a Microsoft Defender AV exclusion folder configured for a third-party security tool. The attacker then found a local building management system (BMS) database, where it accessed sensor data, OT network views, and multiple protocols.

The customer had run annual penetration tests for a decade but had never surfaced the OT issue. The AI-powered Armadin attacker had the scale and speed to cover the entire attack surface: all paths in, all the time.

For security teams: This type of repeatable controlled assessment gives you the tools and confidence to identify truly exploitable risk across your environment.

RESOURCES 
Companion Blog Post: www.armadin.com/blog-posts/kill-chains-and-coffee-episode-3-ssrf-to-api-rce 
Armadin Offensive Security Platform: https://armadin.com/platform 
Request a Demo: https://www.armadin.com/request-a-demo 

CONNECT WITH ARMADIN 
Website: https://armadin.com 
LinkedIn:   / armadin   
Twitter/X: https://x.com/armadinsecurity

]]> Cloud Compromise & OT Reachability | Kill Chains and Coffee Greg Heon, Evan Peña 00:31:09 Discover how low-priority vulnerabilities turn into complete kill chains in the AI era. In this episode of “Kill Chains and Coffee," Armadin Founder and Chief Offensive Security Officer Evan Peña joins host Greg Heon to discuss two kill chains Armadin recently discovered. Kill chain 1 progressed from SSRF to API remote code execution (RCE) to Kubernetes and the cloud. Kill chain 2 went from an assumed breach to an operational technology (OT) environment. The kill chain 1 entry point was unauthenticated SSRF via a manipulated HTTP header. The SSRF chained to API RCE, landing the Armadin attacker in a Kubernetes pod. Reconnaissance on the pod revealed a local database with service account credentials stored in clear text. The attacker used a privileged container to mount the host OS and break out of the pod—accessing an AWS tenant, additional pods, cloud accounts, and production data. Key takeaway: SSRF alone looked like a low-priority issue, but the full kill chain revealed production data exposure. Kill chain 2 started with a low-privileged domain account on a Windows Server 2019 host, where the Armadin attacker gained access through a 5-year-old critical CVE (Print Nightmare). The payload was delivered via a Microsoft Defender AV exclusion folder configured for a third-party security tool. The attacker then found a local building management system (BMS) database, where it accessed sensor data, OT network views, and multiple protocols. The customer had run annual penetration tests for a decade but had never surfaced the OT issue. The AI-powered Armadin attacker had the scale and speed to cover the entire attack surface: all paths in, all the time. For security teams: This type of repeatable controlled assessment gives you the tools and confidence to identify truly exploitable risk across your environment. Discover how low-priority vulnerabilities turn into complete kill chains in the AI era. In this episode of “Kill Chains and Coffee," Armadin Founder and Chief Offensive Security Officer Evan Peña joins host Greg Heon to discuss two kill chains Armadin recently discovered. Kill chain 1 progressed from SSRF to API remote code execution (RCE) to Kubernetes and the cloud. Kill chain 2 went from an assumed breach to an operational technology (OT) environment. The kill chain 1 entry point was unauthenticated SSRF via a manipulated HTTP header. The SSRF chained to API RCE, landing the Armadin attacker in a Kubernetes pod. Reconnaissance on the pod revealed a local database with service account credentials stored in clear text. The attacker used a privileged container to mount the host OS and break out of the pod—accessing an AWS tenant, additional pods, cloud accounts, and production data. Key takeaway: SSRF alone looked like a low-priority issue, but the full kill chain revealed production data exposure. Kill chain 2 started with a low-privileged domain account on a Windows Server 2019 host, where the Armadin attacker gained access through a 5-year-old critical CVE (Print Nightmare). The payload was delivered via a Microsoft Defender AV exclusion folder configured for a third-party security tool. The attacker then found a local building management system (BMS) database, where it accessed sensor data, OT network views, and multiple protocols. The customer had run annual penetration tests for a decade but had never surfaced the OT issue. The AI-powered Armadin attacker had the scale and speed to cover the entire attack surface: all paths in, all the time. For security teams: This type of repeatable controlled assessment gives you the tools and confidence to identify truly exploitable risk across your environment. ai, ai in cybersecurity, api security, armadin, artificial intelligence, cloud security, cybersecurity, cyber security, kill chains, kubernetes security, offensive security, penetration testing, red teaming, remote code execution false full 1