# RedHerd: Offensive Cyberspace Operations as a Service
###### Abstract
In relation to this, powerful infrastructure, high-performance instruments and most importantly skilled personnel are the keys for effective OCOs [2]. It is not so easy to recruit skilled cyber operators and involvement of scarce talent may need adjustment of requirements, with possible consequences on the operation plan. Skills are highly perishable, and this has an impact on the management of human resources, requiring constant attention not only to the attraction of new talents, but mainly to the education and re-training of existing personnel. As a result, the engagement in training activities is vital, and a crucial support for reducing the skills gap is the cyber range [3, 4]. A cyber range is a platform for the development, delivery and use of interactive simulation environments. A simulation environment is a representation of an organisation's Information and Communication Technology (ICT), Operational Technology (OT), mobile and physical systems, applications and infrastructures, including the simulation of attacks, users and their activities and of any other Internet, public or third-party services which the fictitious environment may depend upon [5]. Cyber ranges are part of an actor's cyber capabilities and can be used for developing the potentiality of security professionals, for the research and development of cyber tools and other assets, and for the continuous delivery of cyber exercises to test those cyber capabilities [5]. It is also expected that cyber ranges will change hiring practices allowing organisations to better identify, validate and hire suitable candidates [5]. Training becomes even more crucial considering that the most dangerous cyber attacks are not randomly performed, but are complex and structured operations. There are a lot of doctrinal and technical references which identify and describe the offensive flow followed by an actor conducting hostile operations, one of the universally recognized is the Cyber Kill Chain (CKC) [6, 7]. The CKC represents a systematic approach that includes a wide variety of elements, ranging from malicious payload development to lateral movement inside a compromised environment [8]. In a complex scenario, the actions on the identified objectives could violate confidentiality, integrity, or availability of a system. Taking into account these offensive purposes, the chain phases can be identified as follows:  
1. Reconnaissance: identification, selection, profiling of potential targets and vulnerability discovery via passive and active information gathering. This phase could range from technical activities to Open Source Intelligence (OSINT), passing through social engineering techniques [9] in order to extract unique and high value intelligence by harvesting public records to create a comprehensive profile of certain targets [10];
2. Weaponization: design and implementation of a malware, i.e., a Remote Access Trojan (RAT), a Meterpreter shell [11] or a different backdoor, which exploits a system vulnerability or tricks the user to act as the attacker expects. This malicious software is hidden inside unsuspected files, e.g., a PDF or a Microsoft Office document, in order to evade network and host detection;
3. Delivery: dispatching the weaponized malware to the target environment via spear phishing [12], removable media or using legitimate public facing services which have been compromised, e.g., websites or FTP servers;
4. Exploitation: triggering the malicious code execution on the target by waiting for user interaction, exploiting a specific application or the operating system directly, e.g., via a _zero-day_ or other known vulnerabilities;
5. Installation: installation of a backdoor which grants a persistent access to the exploited target's system or network. This phase could involve Windows registry keys manipulation, DLL search order hijacking, DLL side loading, startup folders abuse, scheduled tasks creation or even rootkits installation;
6. Command and Control: connection of the malware previously installed, to the attacker C2 server.