Cobalt StrikeMalware
- agentemis
- CobaltStrike
- cobeacon
Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement.From MISP Galaxy
Last reported 3 days ago, by Help Net Security113 reports
ATT&CK techniques
6 of 208 · each with the sentence it comes from- T1053.005Scheduled Task
“It collects process trees, executables loaded into memory, memory dumps where injection is suspected, and the files behind scheduled tasks and autoruns.”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1027Obfuscated Files or Information
“T1027 Obfuscate or Encode Files or Information”
- T1021.001Remote Desktop Protocol
“The attackers also used Remote Desktop Protocol (RDP) for lateral movement.”
- T1505.003Web Shell
“… automated execution scanned 4,708 targets, confirming access to 429 WordPress administration panels, followed by the deployment of 32 web shells in a 61-second window.”
- T1053Scheduled Task/Job
“… APIThe GOSHELL shellcode loader used the QueueUserAPC native API call to execute the second-stage shellcode within its own process.T1053.005Persistence, Scheduled Task/Job: Scheduled TaskThe GOGITTER downloader created a scheduled task to execute a dropped VBScript every 50…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
113 reports · the newest 20, newest first · the exact sentence from each-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“ReliaQuest also tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity.”
-
AI Decision Models and Their Impact on AI SOC Platforms“The most common families we found in memory last year were tools like Mimikatz, Meterpreter and Cobalt Strike.”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“Cobalt Strike Beacon Corpus: Fox-IT has released more than 56,000 signatures for Cobalt Strike beacons.”
-
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records“… to roles like exploit chaining, lateral movement, and reconnaissance, plus a separate AI pentesting framework wired directly into a Cobalt Strike command server.”
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups“…ettra ransomware groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero.”
-
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure“…he full report (PDF) for the complete technical analysis, including the node-by-node infrastructure walkthrough, the Chinese-cluster Cobalt Strike operation, the PentAGI model configuration, and the full indicator set.”
-
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage“If a rule already has Threat: Cobalt Strike or another malware-family label, the pipeline leaves it alone.”
-
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage“If a rule already has Threat: Cobalt Strike or another malware-family label, the pipeline leaves it alone.”
-
The First 24 Hours: What Happens When Ransomware Lands“UnderDefense's account of a Colorado engagement describes moving from detecting Cobalt Strike to removing it from 11 critical servers in under 24 hours, which is achievable only when the entry point and the credential scope get answered while containment is still running.”
-
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor“It also loads and executes Beacon Object Files (BOF), a format introduced in Cobalt Strike and since adopted by other red-teaming frameworks.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“The framework is compatible with Cobalt Strike BOFs (Beacon Object Files), which should give it access to a widespread module arsenal out of the get go.”
-
Technical Analysis of MLTBackdoor“Using BOFs for post-exploitation tasks was first popularized by Cobalt Strike, and there are now hundreds of community-made BOFs for a wide range of tasks.MLTBackdoor’s BOF dispatcher follows these steps:Creates one memory block per section.Walks the COFF symbol table.Applies rel…”
-
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability“Cobalt Strike Infection”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“… Beacon listener, leveraging GitHub as their command-and-control (C2) platform.The staging server involved in this attack also hosted CobaltStrike Beacon and an EntryShell backdoor.”
-
JSAC2026 -Day 1-“After gaining access, the operators deployed SnakeC2, NEOBEACON (which abuses OneDrive and the Microsoft Graph API for C2), Cobalt Strike, VShell, and SoftEther VPN.”
-
Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise“…tedly used by UNC5174, a Golang-based HISONIC backdoor [2] reportedly used by UNC6603, and CrossC2 RAT [3], the Linux version of the Cobalt Strike implementation, which was installed at the same time as SNOWLIGHT.”
-
APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1“…r, a backdoor called GITSHELLPAD for command-and-control (C2) communication, and GOSHELL, a Golang shellcode loader used to deploy a Cobalt Strike Beacon.”
-
GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign“According to Cisco Talos, the threat actor exploited PHP-CGI installations on Windows systems to deploy Cobalt Strike beacons and conduct post-exploitation activities using the TaoWu toolkit.”
-
Secrets of Cobalt“Each message contains an attachment that loads the payload – part of Cobalt Strike software – to the computer’s operating memory.”
Indicators in its reports
named in the reports above- 46.21.250[.]135in 3 reports
- exploit[.]inin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.