Attackers Actively Striking with Cobalt Strike

Continued exploitation 

• The source code for version 4.0 was allegedly leaked in 2020, and since then became a go-to tool for APT groups such as Carbanak and Cozy Bear.
• According to Fox-IT, thousands of instances of Cobalt Strike abuse have been observed, however, most of them are using the legacy, cracked, or pirated copies of this tool.
• The existing exploitation of Cobalt Strike is linked to ransomware deployment, surveillance, and data exfiltration campaigns. It allows users to create flexible C2 architectures and makes it hard to trace C2 owners.
• It is a very popular and common second-stage payload for various malicious campaigns (such as TA511 and RustyBuer, and more) and malware families (such as Trickbot, IcedID, and QakBot).

Recent abuse of Cobalt Strike 

• The Hancitor downloader fueled Cuba ransomware operations and deployed Cobalt Strike Beacon on the hosts located in Active Directory environments in post-exploitation activities.
• Last month, unpatched Fortinet VPN devices were hacked to deploy Cring ransomware inside corporate networks. During that campaign, the attackers were found to be using the Cobalt Strike framework.

Conclusion