LazyOwn RedTeam / APT Framework
An AI-powered C2 framework for pentesters and red teams: 606+ CLI commands, a multi-operator web dashboard, and campaign orchestration that plans, executes, and learns autonomously.
Red-line triggered; dimension scoring withheld entirely. The product explicitly advertises and implements implants, backdoors, rootkits for campaign concealment, and 'undetectable' malleable implants; mutants/test exercises migrate, uac_bypass, persistence, credential upload, and reverse-shell C2 operations. These are malware/covert-exfiltration capabilities with no structural evidence of consent or recovery on the target side as a default. Although the README describes defensive hygiene (scope add, confirm gates, dry_run), the red line is judged on worst-case capability: malware, credential theft, and covert exfiltration are core selling points with no blocking evidence of an authorization/consent chain.
Dimensions zeroed under the red-line state. Noted anyway: pyproject.toml claims to be the 'single source of truth' yet its version (0.2.157) disagrees with the README (v0.2.158), a concrete claim/reality drift.
Dimensions zeroed under the red-line state. Target-side capabilities (Windows/Linux/macOS implants, UAC bypass, persistence) show the intended scenario is intrusive offensive operation, which triggers the red line.
Dimensions zeroed under the red-line state. GPL-3.0 metadata matches the LICENSE file, but that does not clear the red line; SECURITY.md's supported-versions table (1.x Yes) contradicts the actual 0.2.x versioning — a concrete documentation inaccuracy.
Dimensions zeroed under the red-line state. However detailed the feature claims (606+ commands, 153 MCP tools), the core marginal value lies in evading detection and covert control — precisely the use excluded by the red line.
Dimensions zeroed under the red-line state. The README's numeric claims (606+ commands, 148 vs 153 MCP tools — internally contradictory, 27k-line core) cannot be cross-verified from the given files; the test files hardcode an AES key and C2 credentials (LazyOwn/LazyOwn), both a recognizable defect and bad practice.
- Red-line ruling: this repository's core features are implants, rootkit concealment, 'undetectable' implants, and credential theft — a malware/covert-exfiltration red line that enables intrusion into real systems if obtained by unauthorized actors, with no authorization gate.
- mutants/test hardcodes an AES key and C2 credentials; SECURITY.md's supported-versions table (1.x) contradicts the actual 0.2.x versioning.
- Despite defensive design elements (scope/confirm), the product remains a functioning attack tool in unauthorized contexts; enterprise procurement should treat it as a high-risk exclusion.
What does this agent do, and when should you use it?
LazyOwn (grisuno/LazyOwn, GPL-3.0, currently v0.2.158) is a professional red team and Command & Control platform built around a Python cmd2 CLI and a Flask web GUI. It ships 606+ attack commands, 126 aliases, 120+ YAML/Lua plugins spanning the full kill chain, and implants that run across Linux, Windows, macOS and BSD. Its AI stack includes a Mixture-of-Experts LLM router, tabular Q-learning reinforcement, the SWAN orchestrator, a Hive Mind multi-agent system, and an ACI (Autonomous Campaign Intelligence) planner that the README bills as the first C2 able to plan, execute, replan and learn end-to-end. Deployment paths include a local virtualenv (install.sh + ./run), Docker (lazyown-docker/mkdocker.sh), and an MCP server exposing 153 tools to Claude Code, Claude Desktop, Hermes Agent and OpenCode. Safety mechanisms such as an authorization scope guard, session encryption and confirmation gates are built in, but this is a highly sensitive offensive tool that should only be operated in legally authorized engagement environments.
LazyOwn centers on an interactive (LazyOwn) > shell: doctor preflights the environment, wizard walks an 8-step configuration including LLM provider selection, and scope add / scope mode enforce gate offensive commands against your authorized target range. Recon commands like ping, lazynmap, auto_populate and facts_show extract structured facts from nmap XML and other tool output into a Parquet knowledge base (GTFOBins, LOLBas, MITRE ATT&CK). The C2 starts via bash fast_run_as_r00t.sh, after which blacksandbeacon delivers a Linux BOF-capable beacon or a two-stage XOR-obfuscated Go implant with AES-256 encrypted channels, VM/sandbox evasion, and commands such as exfil, persist and proxy. On the AI side, skills/lazyown_mcp.py exposes 153 MCP tools; aci_plan decomposes a natural-language goal into MITRE ATT&CK phases and injects objectives into sessions/objectives.l, auto_loop and the autonomous_daemon execute them step-by-step, and aci_replan regenerates techniques when phases stall. A Detection Oracle scores detection probability from 17 Sigma-style rules and feeds results back into RL-based expert routing. Multi-operator collaboration runs over SSE endpoints (/collab/, /collab/publish, /collab/lock), and telegram_hermes.py bridges Telegram messages into LazyOwn commands. Session data is encrypted on exit by auto_crypto (PBKDF2HMAC + Fernet).
- A red team lead running an authorized engagement needs consolidated C2 and implant infrastructure, using the scope guard to guarantee no out-of-scope targets are touched.
- A security researcher wants to drive the attack framework from Claude Code via MCP so an AI agent executes the recon-to-exploit chain (auto_loop, auto_pwn) instead of a human operator.
- A purple team uses purple_exec / purple_score to validate local detection rules (Sigma, proc_scan, fim_scan) and export purple_dataset.csv training data.
- A multi-operator team needs shared real-time event streams and target locks, collaborating through the /collab/ dashboard and collab_join.
- An ATT&CK assessor uses hunt and adversary commands to map known TTPs onto discovered services and run atomic red team simulations.
- A remote operator monitors campaign status from a phone via the Telegram Hermes bot using /sitrep, /c2 and /cron.
What are this agent's strengths and limitations?
- Extremely broad coverage: 606+ commands, 126 aliases, 153 MCP tools, 120+ plugins across 13 kill-chain phases and four OS targets.
- README claims firsts for an open-source C2: Linux BOF support via an ELF dlopen runtime, and the ACI plan-execute-replan-learn loop.
- The AI architecture is concrete and auditable: five-expert MoE routing, tabular Q-learning (documented hyperparameters and persistence files), and a 17-rule Detection Oracle, all backed by named files under modules/ and skills/.
- Strong engineering discipline: scope guard, destructive-command confirmation gates, credential provenance and confidence annotations, evidence freshness markers, auto_crypto session encryption, plus 48 BDD security tests and mutation-testing gates.
- High legal and ethical risk: it ships genuine rootkit, keylogger, botnet/RAT, anti-forensics and exfiltration capabilities — misuse is illegal and use must be confined to authorized engagements.
- Non-trivial deployment and operational cost: the full ML stack adds ~2 GB of torch/CUDA dependencies, the C2 requires root (fast_run_as_r00t.sh), and certs, SecLists and external binaries all need doctor maintenance.
- Long external dependency chain: AI features depend on Groq API or a local Ollama runtime, collaboration depends on the Flask/SSE C2 server; missing packages degrade the affected commands rather than crash, but functionality is lost.
- Several claims (full undetectability, end-to-end ACI autonomy) are README self-descriptions with no independently visible evaluation evidence — verify in an isolated lab before adopting.
How do you install or deploy this agent?
bash
git clone https://github.com/grisuno/LazyOwn.git && cd LazyOwn
bash install.sh # virtualenv + pinned dependencies + C2 certificates
./run # launches the shell; first run offers the setup wizardThe default install is light; add --with-ml (2 GB torch/CUDA stack), --with-ollama (local LLM runtime) and --with-tools (external binaries) as needed. Dependencies are declared in pyproject.toml and pinned in requirements.txt / requirements-ml.txt. For isolated deployment use Docker: cd lazyown-docker && ./mkdocker.sh build && ./mkdocker.sh run --vpn 1. For Claude Code: claude mcp add lazyown python3 /path/to/LazyOwn/skills/lazyown_mcp.py, or configure mcpServers in claude_desktop_config. with LAZYOWN_DIR set; C2 address/port/credentials come from LAZYOWN_C2_HOST/PORT/USER/PASS or payload..
How do you use this agent?
After launching the shell, run doctor to verify Python, venv, packages, certs, SecLists and tools — fix any red blocking failures first. Then wizard completes configuration with lhost auto-detection. Define your authorized scope: scope add 10.10.11.0/24 then scope mode enforce. Recon with ping && lazynmap && auto_populate && facts_show. Start C2 in a separate terminal: bash fast_run_as_r00t.sh --no-attach --vpn 1. Get a shell with (LazyOwn) > blacksandbeacon, then run the printed curl download command on the target. Invite teammates with collab_join alice, which prints the /collab/ dashboard URLs. Agent path: call lazyown_aci_plan in Claude Code to submit a campaign goal, start lazyown_auto_loop for autonomous execution, monitor with lazyown_aci_status, and replan with lazyown_aci_replan when stalled. Destructive commands (rm -rf, exfil, etc.) require an explicit confirm=true at the MCP layer.
How does this agent compare with similar options?
The README positions LazyOwn against Cobalt Strike, Sliver, Havoc, Metasploit and CALDERA: those tools either require operator-driven step planning (Cobalt Strike/Sliver/Havoc), offer automation without intelligence (Metasploit), or emulate fixed ATT&CK procedures without adapting (CALDERA); LazyOwn's ACI claims continuous planning, execution, replanning and cross-engagement learning.
FAQ
Which API keys or accounts are required?
Can it run as the operator console on Windows or macOS?
How do I prevent accidentally attacking unauthorized hosts?
scope add <CIDR-or-hostname> to define the authorized range and scope mode enforce to block out-of-scope offensive commands (refused outright in non-interactive sessions). Default is warn-only, and an empty scope leaves the guard dormant (fail-open), so you must configure it.