The full-featured C2 platform for professional red teams. Live session management, a modular shard engine, AES-256-CBC encryption end-to-end, and an Arsenal that builds, signs, and stages Windows & Linux agents, all from one interface.
Ship capability without bloating the implant. Perceptor's shard engine
delivers self-contained modules to the agent on demand,
compatible with Windows and Linux. Drop a .shard file and
it's immediately available to every operator on the team.
The Arsenal is Perceptor's end-to-end implant factory. Configure your callback URL, AES comms key, jitter, and namespace. Compose evasion and persistence fragments, then compile and Authenticode-sign a Windows or Linux agent in seconds, all server-side.
Know exactly where your implants are operating. Perceptor automatically resolves each agent's geolocation and identity, plotting them on a tactical dark map with country, city, ISP, ASN, and coordinates surfaced at a glance.
Every byte between Perceptor's implant and your teamserver is encrypted with AES-256-CBC using a per-build pre-shared key registered at agent build time. A passive observer sees nothing actionable.
AES-256-CBC · HMAC-SHA256 Request Signing · Per-Build KeyMake your C2 traffic look like anything. Perceptor's malleable profile engine lets you remap request headers, spoof the User-Agent, customize URI paths, and wrap response bodies so agent check-ins blend seamlessly with legitimate web traffic.
Your teamserver's login page is operator-controlled. Select from built-in templates: a generic network monitor, a Windows-era server manager, a neutral admin panel. Or write a fully custom HTML template with CSS inline. No external URLs. No fingerprint.
From initial foothold to full domain visibility. Perceptor gives your operators the infrastructure to run sophisticated, multi-stage engagements with full accountability.
Three-tier role system (Analyst, Operator, Admin) enforced server-side on every endpoint. Analysts observe, operators execute, admins govern. Concurrent sessions with no conflicts.
Every operator action is timestamped, attributed by user and role, and logged with source IP. 2,000-entry audit trail with event stream for complete deconfliction in any engagement debrief.
Real-time agent table with alive/dead status derived from beacon intervals. Per-agent task queuing, output capture, screenshot exfiltration, file download, and geolocation, all in one view.
14 fragment primitives for AMSI bypass, ETW patching, AntiVM (sleep timing), persistence via registry, COM hijacking hooks, and sleep-based sandbox detection, composable at agent build time.
Spawn multiple simultaneous listeners on different ports, health-checked on every poll cycle. PID-tracked and reconciled on startup, no stale state after reboots.
Persistent team chat, named colour-coded agent groups, per-agent notes, and a shared event stream. Run a coordinated multi-operator engagement without stepping on each other.
Perceptor was built by red teamers, for red teamers. No bloat, no academic UX. Just the tools that matter during a live engagement, when every second counts.
Request AccessPerceptor is available exclusively to verified red teams, penetration testing firms, and authorized government operations. Submit your details and a Black Star operator will reach out promptly.
