Security2 publishers2 min readPublished
RemoteThreat raises $7m to sell nation-state-grade attack tooling to corporate red teams
RemoteThreat left stealth Tuesday with $7 million and a platform that packages implants, C2 and evasion for enterprise and government red teams. Access is gated to vetted buyers over misuse concerns, with early customers including a major bank and a leading AI lab.
The Watch · Security desk
What happened
- Chris Thompson, now chief executive, and Shawn Jones, now chief technology officer, both led IBM's X-Force Red offensive team before founding RemoteThreat.
- Osage University Partners and DataTribe put up the pre-seed money behind the platform.
- Retired US Army General Paul M. Nakasone advises the company through his firm, the Nakasone Group.
- RemoteThreat has joined US Special Operations Command's SOF RACER program and partnered with Talon Defense.
- The Register reported the platform is built to simulate nation-state attacks for Fortune 500 companies and to arm government operators at speed and scale.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability A red team can buy cross-platform, in-memory implants and configurable evasion as a product instead of building them, so an exercise can mirror a live attacker's methods.
- exposure The platform sold to a bank, an exchange and an AI lab is the same one sold to government mission teams, and the only gate on who runs it is RemoteThreat's own vetting.
- decision Blue teams that scoped drills around noisy automated scanners now have to prepare for engagements using C2 and traffic shaping tuned to blend into their own networks.
- precedent A funded, government-advised commercial offensive platform under the US Cyber Strategy makes more such products likely to follow.
RemoteThreat's platform ships implants that run across operating systems and architectures and execute in memory, plus a command-and-control server with configurable traffic profiles that can run alongside a team's existing C2 [6][7]. Operators combine payloads and post-exploitation tools for each engagement, then apply control-flow obfuscation and configurable evasion to fit the target [8]. Those are the techniques an intruder uses to stay on a network undetected. There is no exploit here and no victim; the launch turns offensive capability of this grade into a product sold under the vendor's controls.
The eight connected systems are RemoteThreat's own description, relayed by SecurityWeek, and include mission planning, an initial access framework, an obfuscation pipeline, targeting and analysis engines, and AI assistants [5]. The early-customer list comes from The Register, which described them without names: a major bank, a securities exchange operator, a large US healthcare company and a leading AI lab [16][13]. Neither account includes a price or a demonstration of the implants.
RemoteThreat restricts access to vetted enterprises, defense contractors and US government buyers, citing the risk of misuse [12]. Operators can run tasks by hand, with AI assistance, or hand them to autonomous workflows, bounded by Rules of Engagement, approvals and no-strike controls [9]. The pitch to buyers is speed. "New AI-driven attacks are fast but noisy, while human-driven operations take too long and struggle to scale," Thompson said [10]. The launch aligns with the US Cyber Strategy's call for more private-sector involvement in offensive cyber operations [15].
What to watch
- Whether RemoteThreat or an independent tester publishes any demonstration of its implants and evasion against current EDR.
- Who clears RemoteThreat's vetting bar, and whether the tooling ends up outside the approved buyer set.
- Whether other X-Force or government-trained teams launch rival commercial offensive platforms under the same US policy push.