How ApeX compares
ApeX against the commercial C2 frameworks red teams actually evaluate against. Updated per release.
Compared against Cobalt Strike 4.13, Brute Ratel C4 2.3, and Nighthawk 1.0. Havoc (archived February 2026) and Havoc Pro are not included in this comparison. If a row is wrong, email us and we will fix it.
Feature matrix
| Feature | ApeX | Cobalt Strike 4.13 | Brute Ratel C4 2.3 | Nighthawk 1.0 |
|---|---|---|---|---|
| License | Commercial | Commercial | Commercial | Commercial (vetted) |
| Agent Language | Zig | C/C++ | C/C++ | C++ |
| Platforms | Windows (Linux and macOS coming soon) | Windows | Windows | Windows |
| AI/LLM Operator | Yes (MCP, 25+ tools, audited) | No | No | HawkEye (docs chatbot) |
| HTTP/S | Yes (malleable profiles down to the packet) | Yes (malleable C2) | Yes (malleable JSON) | Yes (regex + Python) |
| DNS | Yes (TXT/CNAME/A) | Yes (A/AAAA/TXT, DoH) | DNS over HTTPS | Yes |
| SMB / TCP Pivoting | Yes / Yes | Yes / Yes | Yes / Yes | Yes / Yes |
| SOCKS Proxy | Yes (SOCKS5) | Yes | Yes (SOCKS 4a/5) | Yes (SOCKS4a) |
| Indirect Syscalls | Yes | Yes | Yes | Yes |
| Sleep Encryption | Yes (code + heap) | Yes (sleep mask kit) | Yes (multiple per-cycle) | Yes (~2% plaintext) |
| RWX-less Execution | Yes (primary code paths) | No (Needs customization) | Yes | Yes |
| CET Compatible | Yes (architectural) | No | Stack frame chaining | Yes (COOP gadgets, synthetic frames) |
| BOF Support | COFF + BOF-PE, API proxying | COFF (original) | COFF, module stomping, async | COFF, OpSec import rewriting, async |
| BOF API Proxying | Yes (clean OS stacks) | No (Needs BOF rewrite) | No | Yes (syscall rewriting) |
| Execute-Assembly | Yes (AMSI bypass) | Yes | Yes | Yes (.NET stomping) |
| On-Agent Scripting | Yes (Lua VM + rich API) | No | No | No |
| Operator Scripting | Python (Havoc-compat) | Aggressor (Sleep lang) | Click scripts + JSON | Python modules + RPC API |
| Inline PE Execution | BOF-PE/DLL + CLR | Fork-and-run | memexec + module stomp | execute-exe (in-process) |
| Per-Build Polymorphism | Yes (seed-driven) | No (kit-dependent) | Keying strategies | Code mutator |
Competitor profiles
Cobalt Strike 4.13
The industry standard with the largest ecosystem. Extensive BOF libraries, Aggressor Script, and kits (UDRL, Sleep Mask, Artifact, Process Injection). 4.13 adds BeaconGate, drip-loading, DNS-over-HTTPS, and EAF bypass. Weakness: the number one signatured C2 by every EDR vendor.
Brute Ratel C4 2.3
Purpose-built for EDR evasion. Traced syscalls that follow EDR hooks rather than unhooking. Advanced module stomping with full PEB patching. safe_http encrypts the entire badger during HTTP I/O. Async BOFs run while the badger is sleep-masked. Weakness: no general-purpose scripting, Windows-only.
Nighthawk 1.0
Most OPSEC-obsessed commercial C2 before ApeX. Approximately 2% code plaintext during active execution. CET-compatible call stack masking with user-defined synthetic frames per API. API-first architecture with JSON RPC + WebSocket. Open Agent system for custom agents. Weakness: Bank of America's acquisition of MDSec has sharply narrowed commercial availability. Also the most expensive of the four when available.
Where ApeX stands out
| Capability | Why it matters |
|---|---|
| AI-powered operations | Only C2 with native MCP integration. Reasoning-driven autonomy, not scripted playbooks. |
| On-agent scripting | Complex post-ex in a single task. Fewer heartbeats, less C2 traffic, lower detection risk. |
| Compile-time OPSEC | Encryption, hashing, and obfuscation resolved before the binary ships. Per-build polymorphism from a single seed. |
| Clean stacks by architecture | CET-compatible without gadgets or frame fabrication. BOF API calls produce genuine OS stacks. |
| Deploy anywhere | Air-gapped bundles, edge mTLS bootstrap, automated smoke tests. |