A two-hour hands-on workshop/tactic where attendees stand up a red team operator stack (https://github.com/BaddKharma/redStack) and execute a multi-C2 kill chain against a live cyber range. Each attendee gets their own range instance delivered over an OpenVPN tunnel, so no public DNS or exposed infrastructure is required.

Agenda:
10 min, theory and setup verification. Attendees arrive prepped per the prereq packet (AWS CLI, Terraform, AWS account, OpenVPN client). I frame the session with the multi-C2 segmentation tradecraft pattern that the rest of the time builds on.

40 min, staging and provisioning, narrated live. Attendees stand up their operator stack while I talk through each component, the design choices behind it, and the operator decisions that show up at deploy time.

10 min break.

45 min, attack path on a live cyber range. Each attendee runs against their own individually instanced range over OpenVPN. We work through the chain together: Mythic for initial access, Sliver for lateral movement, Havoc for domain dominance. I stay at the table answering questions while attendees execute.
15 min, Q&A, and teardown. I remain available after the slot for one-on-ones with anyone who wants more time on a specific piece.

A prerequisites packet will be published in advance and will cover AWS account setup, CLI and Terraform install, OpenVPN client, and any local tooling. Total AWS footprint stays within default account quotas at 8 instances and 16 vCPU, so no quota increase request is required.