Overview
Crimson7 offers offensive security and continuous threat validation services, translating adversary research into operational defense. The company provides offensive engineering, defensive engineering, and managed security services, with specialty products including HackerFlow and 7Hunter.
Key people
In the news
- A fraud operator took OpenCode, a legitimate MIT-licensed AI coding agent, stripped out its guardrails and now sells it on Telegram as CrimeCode. $20 a month. The fork chain is short. SST's OpenCode became OpenWorm, a GitHub fork that swapped the models for WormGPT. OpenWorm became CrimeCode, which added a jailbreak proxy and a fraud toolkit. The proxy is a few dozen lines of JavaScript. Before each request it checks which model family it's calling and prepends a matching jailbreak prompt: "Author Mode" for Claude, DAN for GPT,
- We're hiring a Customer Success & Delivery Manager in Europe. It's the role between a signed contract and a customer getting value. Part of the job is our platform. You'd coordinate how new customers get C7ATTACK and C7DEFEND deployed, configured and onboarded, then stay in regular contact: how is adoption going, are they satisfied, and what do they need next, before they have to ask. The other part is our managed services. You'd plan, coordinate and oversee their delivery, so it lands on time, within scope and within budget. In
- What leaked from eSignFlow, the e-signature module more than 120 Belgian municipalities use, was mostly metadata: names linked to document titles. Days later, Peer and Genk were warning residents about phishing and fake GAS 5 fine payment requests. That's how a "small" leak works. A real name next to a real document makes the next scam believable. How the attacker got into eSignFlow isn't public, and we won't guess. It also matters less than you'd think. The way in keeps changing: exploited software, stolen keys, a phone call to the
- We're hiring a Senior Red Team Operator in Brussels. Hands-on TLPT experience is a big part of what we're looking for. The work is long-running, stealthy operations against mature, well-defended environments. You'd lead engagements from scoping and threat modelling through to the report, and contribute to TIBER-EU and DORA TLPT tests alongside control teams and threat intelligence providers. Between engagements you build. Custom implants and tooling, C2 tradecraft, EDR evasion, and research into new techniques that ends up
- This morning Joey Verleg and Atilla B. presented our report on the Lunex infostealer at the FS-ISAC EMEA Threat Call. Lunex is a Malware-as-a-Service platform. Its stealer, also tracked as Psychedelic Stealer, reaches victims through a fake CAPTCHA on compromised websites that talks them into running an installer. Before it steals anything, the loader uses a signed but vulnerable AMD driver (CVE-2023-20598) to blind endpoint security. Then it takes credentials, cookies and session tokens from seven Chromium browsers, plus
- The breach trackers and Belgian press put the dataset at about 700,000 people: names, addresses, phone numbers, birth dates, national register numbers, and more than 85,000 IBANs. You can change an IBAN. You can't change a rijksregisternummer. We don't know how the attacker got in, and nobody reporting on it does either. IFAPME's own notice says user profiles were viewed, data was exported without authorization, and the compromised access point has been secured. That fits the two usual paths: a legitimate account in the wrong
- The quarterly board report says the controls are in place. It rarely says when anyone last watched a detection fire. "We have a detection for credential theft" and "we proved last month that our credential-theft detection fires" sit in the same row of the same slide. Only the second one is evidence. Rules break quietly. A log source stops sending, or a threshold gets tuned for noise and never tuned back, and nothing alerts, because the alert is the part that broke. Our co-founder Nick Maeckelberghe wrote up five questions a CISO or
- Your browser can download malware without showing a download. Browser Cache Smuggling turns the disk cache into a payload stash. An attacker-controlled page loads a hidden image. The server labels the response `image/jpeg`, adds aggressive cache headers and sends a payload that the browser writes under a random hex filename. ClickFix handles execution. A fake verification checkbox copies a command to the clipboard. The victim presses Win+R and pastes it. The command walks the local browser cache, finds the payload by exact
Related profiles
Something wrong or missing? Send an update. Fixed within 24 hours.