Raphael Mudge is the creator of Cobalt Strike, which he built in 2012 to enable threat-representative security tests. For nearly a decade, he was the driving force behind the product, designing, developing, and maintaining it while building the community around it through blogs, user manuals, and training videos that became foundational resources for red team operators. Raphael sold his interest in Cobalt Strike to Fortra in 2020 and stayed on to help ensure a smooth transition before taking a hiatus from the cybersecurity field in 2021.
Raphael’s work in the offense space began in 2010 with Armitage, an open-source GUI for the Metasploit Framework that he created to advocate for and explore red team collaboration ideas. He also created the Sleep programming language and the IRC client jIRCii. Previously, Raphael worked as a security researcher for the US Air Force, a penetration tester, and invented a grammar checker that was sold to Automattic.
In 2025, Raphael returned to the cybersecurity community with the Adversary Fan Fiction Writers Guild blog, where he shares thoughts on leadership and advocacy in technical professions, red team C2 technical topics, future security ideas, and misinformation in the cybersecurity industry. His latest technical effort is Tradecraft Garden, a collection of projects that focus on self-contained units of evasion tradecraft, separate from but usable with C2 frameworks. The initiative aims to serve as a public resource that contributes value to the security community by providing applications across breach and attack simulation, detection engineering, EDR evaluation, and security testing exercises.
He can be found on Bluesky at @raphaelmudge.bsky.social.