Empire Red Teaming Tool Updated With Enhanced Agents and API Support

Empire’s makers, the BC-SECURITY team, have released a major update to its offensive security framework, Empire, adding enhanced agent capabilities and comprehensive API support to streamline post-exploitation operations and adversary emulation for Red Teams and testers.

The release introduces a server/client architecture engineered for multiplayer collaboration across complex engagements, with fully encrypted communications and multiple listener types including HTTP/S, Malleable HTTP, OneDrive, Dropbox, and PHP listeners. It expands Empire’s toolset to over 400 tools spanning PowerShell, C#, and Python modules, with integrations such as Mimikatz, Seatbelt, Rubeus, and Certify, plus Donut for shellcode generation and a modular plugin interface.

Security evasion is strengthened by obfuscation via ConfuserEx 2 and Invoke-Obfuscation, alongside JA3/S and JARM evasion techniques, while in-memory .NET assembly execution and customizable bypasses minimise forensic footprints.

Empire supports PowerShell, Python 3, C#, IronPython 3, and Go implementations, and includes MITRE ATT&CK mapping and a Starkiller REST API‑connected GUI enhancing cross‑environment use; installation guidance covers Docker, Kali Linux, ParrotOS, Ubuntu 20.04/22.04, and Debian 10/11/12, with setup commands such as git clone --recursive https://github[.]com/BC-SECURITY/Empire[.]git and subsequent steps, as of 3 September 2025 according to GBHackers On Security.