An open-source Cobalt Strike rival that talks to LLMs

What it does VIPER is a visual red team platform for adversary simulation and post-exploitation. It provides implants for Windows, Linux, and macOS, a pivot graph for tracking compromised hosts, and over 100 built-in modules mapped to the MITRE ATT&CK framework. The platform also includes automation workflows and an integrated LLM agent for persistent environment monitoring and decision support.

The interesting bit Commercial red-team frameworks like Cobalt Strike and NightHawk cost thousands of dollars per user annually. VIPER is free and open source, yet bundles team collaboration, multi-platform implants, and an LLM agent—features that are either scattered or missing in its paid competitors according to its own comparison table.

Key highlights

• Cross-platform implants for Windows, Linux, and macOS.
• 100+ built-in post-exploitation modules covering MITRE ATT&CK tactics.
• Visual pivot graph and team collaboration features.
• Python-based custom module development.
• Built-in automation, defense evasion, anti-tracing, and notification mechanisms.
• Integrated LLM agent for automated processing.

Verdict Red teams and penetration testers who want a free, collaborative command center for cross-platform adversary simulation should evaluate VIPER. If you need deep technical specifics on evasion techniques or LLM model compatibility, the README keeps things high-level and points to external documentation.