04/27/2026
Empire 6.6.0 sponsors early access is live.
This is one of the biggest releases we've shipped. A new C agent, BOFs, and ATT&CK gap-filling modules, and serious performance work under the hood.
C agent (Cpire)
• A new lightweight C agent with full staging, encrypted communications, and task ex*****on. Shell, PowerShell, C #, BOFs, upload/download, and directory listing.
8 new BOF modules
• unhook — refresh DLLs to strip EDR/AV API hooks
• patchit — all-in-one AMSI + ETW patch/check/revert
• inject_amsi_bypass / inject_etw_bypass — remote-process bypass via syscalls
• credman — Credential Manager dump via SeTrustedCredManAccess
• handlekatz — handle-duplication LSASS dump
• bofroast — Kerberoasting without .NET CLR dependency
• nanodump — LSASS minidump via multiple evasion techniques (handle dup, process fork, snapshot, seclogon leak)
49 new modules (32 PowerShell, 17 Python)
• Built against Atomic Red Team to close ATT&CK coverage gaps: credential access, defense evasion, persistence, lateral movement, proxy ex*****on (mshta, CHM, CMSTP, InstallUtil, regasm, msiexec, rundll32, regsvr32), VM detection, BITS jobs, browser cookie theft, and more.
Scales cleanly under concurrent load
• Resolved DB pool exhaustion, unblocked the event loop across all 216 API endpoints, and isolated donut shellcode generation per-call to fix concurrency-driven failures.
Hardened obfuscation pipeline
• The Invoke-Obfuscation subprocess now runs with a configurable timeout, process group isolation, return-code checking, and graceful fallback to keyword obfuscation on failure. Eliminated double-obfuscation that was spawning a redundant PowerShell subprocess per task.
Plus roughly 20 more fixes across modules, agents, and core.
Sponsors get early access first; public release next month. Thanks to everyone supporting the project; your support is why these releases keep getting bigger.
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Pe*******on Testers. - BC-SECURITY/Empire
