"Kill Chains and Coffee" breaks down how real AI attacks unfold, one kill chain at a time. Host Greg Heon, VP of Product Management at Armadin, joins red team operators and security researchers to show how attackers break in, move laterally, and reach their objective—and explains where defenders can break the chain.
As AI-generated attacks spread, the series explores how offensive security is changing and how pairing experienced red teamers with AI tooling lets you test your defenses the way modern adversaries attack.
For CISOs, security leaders, and practitioners who want the attacker's viewpoint without the hype.
Transforming the Speed and Scale of Web App Testing | Kill Chains and Coffee
Traditional penetration testing lacks the ability to cover large attack surfaces with the speed and sophistication needed to address AI-driven threats. In contrast, Hyperattacks can deploy tens of thousands of agents working in parallel to broaden coverage at machine speed.
In this episode of “Kill Chains and Coffee,” host Greg Heon welcomes Armadin red team operator Ethan Wilkins to discuss web application testing. They cover a kill chain where Armadin gained control of a test server and exploited vulnerabilities through a Hyperattack to breach the organization’s perimeter.
It’s an insightful example of administrative account takeover from an unauthenticated attacker on the internet. The episode reflects a known lack of built-in security with mainstream but aging software applications still in wide use today.
The engagement started by testing a first-party web app used in a document management system. The Armadin team quickly discovered that an “encryption” key was hardcoded into the source code rather than a deployment-specific configuration file. That meant the same key would unlock all instances of the app wherever it was deployed, ultimately exposing it to full compromise.
An even broader issue was the deployment of the app in production environments for multiple customers. What originally began as a pre-production vulnerability assessment led to Armadin finding exploitable risk in a live environment, elevating it to a high-priority fix within days of discovery.
This kill chain demonstrates the value of knowing all paths into internet-facing web apps so organizations can eliminate vulnerabilities before AI-enabled attacks occur.
For security teams: Armadin Hyperattacks safely deliver the machine speed and scale to identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI (https://www.youtube.com/redirect?event=video_description&redir_token=QUlxb01IWUI3NVNHQnl0WjVvRW9uVE9yelBzbXxBSTVJdTV0N3hFaDh0b2Nod0lfVFc2YnZWc0pSNXF2VUplUVNsdUJpWHo5NnFCTEx5UU9TSVZ4Sm9Jdnc5el84ejU1UWQyNTJjbzVvTy1mc1MyN0d0NmtOYnJzS2pHd2hOS1BO&q=http%3A%2F%2Fhyperattack.AI%2F&v=s_qh_HZmvBw).
RESOURCES
Related Blog Post: www.armadin.com/blog-posts/weaponizing-cryptography-mistakes-to-achieve-rce-and-administrative-access-kill-chains-and-coffee (https://www.armadin.com/blog-posts/weaponizing-cryptography-mistakes-to-achieve-rce-and-administrative-access-kill-chains-and-coffee)
Armadin Offensive Security Platform: https://armadin.com/platform (https://armadin.com/platform)
AI Hyperattacks: https://hyperattack.AI (https://hyperattack.ai/)
Request a Demo: https://www.armadin.com/request-a-demo (https://www.armadin.com/request-a-demo)
CONNECT WITH ARMADIN
Website: https://armadin.com (https://armadin.com/)
LinkedIn: https://www.linkedin.com/company/armadin (https://www.linkedin.com/company/armadin)
Twitter/X: https://x.com/armadinsecurity (https://x.com/armadinsecurity)
15 Oct 2026
Zero-Day Exploitation to Internal Compromise | Kill Chains and Coffee
Zero-day vulnerabilities in commonly used third-party applications can put your environment at risk, especially if AI-enabled adversaries move faster than you do in finding them.
In this episode of “Kill Chains and Coffee,” host Greg Heon dives deep with Armadin Founder, Evan Peña and Senior Capabilities Researcher, Kai Huang on a series of unauthenticated remote code executions (RCEs) Armadin conducted on SolarWinds products.
The Armadin team combined assumed breach scenarios with advanced zero-day capabilities to build complete kill chains from external assets to internal systems. They discovered the zero-days using large language models (LMMs) to handle approximately 90% of the workload, with human red team guidance driving the final 10%.
The AI models were a significant force multiplier of human expertise, in terms of both speed and scale. One attack path ended in domain admin compromise, while another reached internal network switches, potentially exposing industrial devices.
These attacks foreshadow what might become commonplace in the next few years: future LLMs advancing AI-driven attacks to an impact level that only nation-state adversaries can currently achieve.
Guidance for security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify and eliminate exploitable risk across your entire environment. Learn how at https://hyperattack.AI (https://hyperattack.AI).
RESOURCES
Companion Blog Posts:
Part I: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1 (https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1)
Part II: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2 (https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2)
Part III: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3 (https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3)
Armadin Offensive Security Platform: https://armadin.com/platform (https://armadin.com/platform)
AI Hyperattacks: https://hyperattack.AI (https://hyperattack.AI)
Request a Demo: https://www.armadin.com/request-a-demo (https://www.armadin.com/request-a-demo)
CONNECT WITH ARMADIN
Website: https://armadin.com (https://armadin.com/)
LinkedIn: https://www.linkedin.com/company/armadin (https://www.linkedin.com/company/armadin)
Twitter/X: https://x.com/armadinsecurity (https://x.com/armadinsecurity)
24 Sept 2026
Command Execution on Cleo Harmony via SAML Bypass | Kill Chains and Coffee
In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one.
In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents.
The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The Armadin attacker found two key vulnerabilities. The first was SAML XML Signature Wrapping (XSW). Cleo verified one SAML assertion but consumed an attacker-injected one and the attacker ultimately gained access to live support ticket files and customer data.
The second vulnerability was ‘cross-store identity confusion’, which escalated from forged low-privilege identity to full Cleo administration privileges. Chained together, these vulnerabilities culminated in Cleo Actions abuse, with admin access sufficient for OS command execution in a production environment with sensitive data that could have impacted multiple organizations.
The vulnerabilities were tracked as CVE-2026-84114 and CVE-2026-84115, and have already been patched.
For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify exploitable risk across your entire environment. Learn how at http://hyperattack.AI.
24 Sept 2026
Why AI Beats Human Pentesting | Kill Chains and Coffee
Human-led penetration testing is too narrow and slow. Only AI agents can give you the scale and speed of 1,000 virtual pentesters collaborating on a single mission.
In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin Principal Red Team Operator Craig Wright go in depth on a recent kill chain that targeted a large telco provider. The results revealed the widening gap between legacy pentesting and using Armadin’s AI attacker as an offensive security tool.
The managed assessment covered 22,749 internet-facing services, with 175 services selected through intelligent targeting. The attack included thousands of AI agents taking 220,479 actions and finding exploitable risk that might have been hiding for decades.
The kill chain sequence began with an AI agent identifying a hidden registration endpoint using route name inference. It self-registered an account, then found a second registration mechanism and used the new account to generate an authorization token before pivoting to authenticated testing. It then identified three endpoints and produced working SQL injection payloads, eventually accessing five additional internal SQL servers.
The kill chain exposed 68.5 million rows of critical data, including workforce Personally Identifiable Information (PII), 911 call geolocation data, and enough SIM swap precursor data to fuel a social engineering campaign and execute a full SIM swap.
The key lesson is you can’t expect an 80-hour human-led pentest to address thousands of internet-facing services, but an agentic AI approach can easily cover the entire attack surface—all paths, all the time.
For security teams: Armadin’s AI Hyperattacks safely deliver the machine speed and scale to help you identify critical exploitable risk across your entire environment.
Learn how at http://hyperattack.AI.
24 Sept 2026
World’s Largest Controlled Hyperattack | Kill Chains and Coffee
What’s worse: Getting an RCE dropped on you at 5 pm on a Friday or waking up on Monday with 12 RCEs sitting in your inbox?
Find out what our experts think on this episode of “Kill Chains and Coffee.” Host Greg Heon sits down with Armadin Offensive Security Manager Christian Elston to cover two kill chains: Armadin’s first-ever AI Hyperattack and the world’s largest controlled AI Hyperattack.
Key conversations include:
The growing power behind AI agents attacking organizations from the outside in
Why safety and control are so critical in the wake of the HuggingFace incident and similar attacks.
In the first kill chain, Armadin engaged with a Fortune 600 company, launching 100 simultaneous attacks with thousands of agents—nearly 1 million autonomous actions.
The agents discovered 12 endpoints vulnerable to unauthenticated Remote Code Execution (RCE) from the internet through Server-Side Request Forgery (SSRF). A combination of SRRF and a known CVE led to an overly permissive Kubernetes service. The agents ultimately escaped the Kubernetes pod and compromised the organization’s entire cloud infrastructure.
The second kill chain was the world’s largest controlled cyberattack, conducted for an Armadin client with globally critical infrastructure. The attack targeted over 25,000 services and executed millions of autonomous actions. The resulting report generated over 200 findings with nearly 40 validated kill chains, including exposure to the company’s crown jewels.
For security teams: This type of repeatable controlled assessment from Armadin gives you the tools and confidence to identify truly exploitable risk across your environment.
Learn how at http://hyperattack.AI.
24 Sept 2026
Cloud Compromise & OT Reachability | Kill Chains and Coffee
Discover how low-priority vulnerabilities turn into complete kill chains in the AI era.
In this episode of “Kill Chains and Coffee," Armadin Founder and Chief Offensive Security Officer Evan Peña joins host Greg Heon to discuss two kill chains Armadin recently discovered.
Kill chain 1 progressed from SSRF to API remote code execution (RCE) to Kubernetes and the cloud. Kill chain 2 went from an assumed breach to an operational technology (OT) environment.
The kill chain 1 entry point was unauthenticated SSRF via a manipulated HTTP header. The SSRF chained to API RCE, landing the Armadin attacker in a Kubernetes pod. Reconnaissance on the pod revealed a local database with service account credentials stored in clear text.
The attacker used a privileged container to mount the host OS and break out of the pod—accessing an AWS tenant, additional pods, cloud accounts, and production data. Key takeaway: SSRF alone looked like a low-priority issue, but the full kill chain revealed production data exposure.
Kill chain 2 started with a low-privileged domain account on a Windows Server 2019 host, where the Armadin attacker gained access through a 5-year-old critical CVE (Print Nightmare). The payload was delivered via a Microsoft Defender AV exclusion folder configured for a third-party security tool. The attacker then found a local building management system (BMS) database, where it accessed sensor data, OT network views, and multiple protocols.
The customer had run annual penetration tests for a decade but had never surfaced the OT issue. The AI-powered Armadin attacker had the scale and speed to cover the entire attack surface: all paths in, all the time.
For security teams: This type of repeatable controlled assessment gives you the tools and confidence to identify truly exploitable risk across your environment.
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
3 ratings
Contact Kill Chains and Coffee
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Kill Chains and Coffee?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
