I worked at a $xxxB company that had an internal red team. They ran almost as a separate company but were housed in one of our offices.

I was involved in probably 15 operations with them while I was there. They would usually get C&C within six hours, every single time it was phishing lol.