PowerShell Empire

Background

PowerShell Empire is a post-exploitation and command-and-control (C2) framework designed to help red teams and penetration testers simulate advanced adversary behavior after an initial foothold has been gained on a target system. The original PowerShell Empire project was created by a group of security researchers credited on the project as @harmj0y, @sixdub, @enigma0x3, rvrsh3ll, @killswitch_gui, and @xorrior, and it was first publicly presented at BSidesLV in 2015. A companion Linux/macOS-focused project written in Python, called EmPyre, was separately debuted at HackMiami in 2016 before the two efforts were later merged under the Empire name.

Design and capabilities

Empire's core innovation was enabling PowerShell-based agents to run entirely in memory on Windows hosts, without needing to drop a traditional executable to disk, which at the time helped operators evade many antivirus products that inspected files rather than in-memory script execution. The framework used a client/server model with encrypted command-and-control communications and a modular library of post-exploitation modules covering credential harvesting, lateral movement, privilege escalation, and persistence. Later versions of the project, following the merger with EmPyre and continued development, expanded beyond PowerShell to support additional agent types including Python 3, C#, IronPython, and Go, alongside multiple listener types such as HTTP/S and SMB.

Adoption by red teams and abuse by threat actors

Because Empire was free, open-source, and effective at emulating realistic attacker tradecraft, it was quickly adopted not only by legitimate red teams and penetration testers but also by real-world malicious actors, who could use the same publicly available code to attack production networks. This dual-use nature led cybersecurity agencies from the Five Eyes alliance (including the UK's National Cyber Security Centre) to jointly name Empire among five publicly available tools flagged for widespread malicious use in a 2018 advisory on hacking tools. Threat intelligence tracking subsequently documented Empire being used by a wide range of groups, including state-linked actors such as APT33, APT41, MuddyWater, Turla, and Sandworm Team, as well as ransomware-affiliated operators including Wizard Spider and Indrik Spider.

Discontinuation and revival by BC Security

Development of the original EmpireProject/Empire repository slowed and the project was ultimately archived by its maintainers on GitHub on January 29, 2020, marking it as read-only and no longer actively supported. Recognizing the continued value of the framework to the offensive security community, the firm BC Security subsequently forked the project and took over its maintenance, releasing updated versions, adding new agent languages and evasion capabilities, and building a companion web-based graphical interface called Starkiller to make the framework more accessible to operators who preferred a GUI over the command line.

Legacy

PowerShell Empire is widely regarded as one of the tools that mainstreamed abuse of native Windows scripting engines for stealthy post-exploitation activity, contributing to the broader industry shift toward "living off the land" attack techniques. Its continued maintenance under BC Security, along with its inclusion in MITRE ATT&CK as tracked software (also referenced under the alias EmPyre) and its documented use across numerous real-world intrusions, has cemented its place as a long-running fixture of both red-team tooling and cataloged adversary tradecraft well over a decade after its original debut.

Timeline

• 2015PowerShell Empire is first publicly presented at BSidesLV by a team of researchers including harmj0y, sixdub, enigma0x3, rvrsh3ll, killswitch_gui, and xorrior.
• 2016The companion Python-based EmPyre project debuts at HackMiami before later merging with Empire into a single cross-platform framework.
• 2018Empire is named alongside four other tools in a joint advisory from Five Eyes cybersecurity agencies, including the UK's NCSC, on publicly available hacking tools being widely used by adversaries.
• 2020-01-29The original EmpireProject/Empire GitHub repository is archived by its owners and marked read-only, ending active development under the original team.
• 2020BC Security forks the project and begins maintaining and updating Empire, later adding the Starkiller graphical interface and additional agent languages.