Latest Cobalt Strike news

Europol takes down 593 Cobalt Strike servers used by cybercriminals

Europol coordinated a joint law enforcement action known as Operation Morpheus, which led to the takedown of almost 600 Cobalt Strike servers used by cybercriminals to infiltrate victims' networks.
- Sergiu Gatlan
- July 03, 2024
- 10:46 AM
- 0
Chinese Earth Krahang hackers breach 70 orgs in 23 countries

A sophisticated hacking campaign attributed to a Chinese Advanced Persistent Threat (APT) group known as 'Earth Krahang' has breached 70 organizations and targeted at least 116 across 45 countries.
- Bill Toulas
- March 18, 2024
- 04:49 PM
- 0
FBI shares AvosLocker ransomware technical details, defense tips

The U.S. government has updated the list of tools AvosLocker ransomware affiliates use in attacks to include open-source utilities along with custom PowerShell, and batch scripts.
- Ionut Ilascu
- October 12, 2023
- 07:38 PM
- 0
Cuba ransomware uses Veeam exploit against critical U.S. organizations

The Cuba ransomware gang was observed in attacks targeting critical infrastructure organizations in the United States and IT firms in Latin America, using a combination of old and new tools.
- Bill Toulas
- August 20, 2023
- 10:15 AM
- 1
Hackers use VPN provider's code certificate to sign malware

The China-aligned APT (advanced persistent threat) group known as 'Bronze Starlight' was seen targeting the Southeast Asian gambling industry with malware signed using a valid certificate used by the Ivacy VPN provider.
- Bill Toulas
- August 19, 2023
- 10:07 AM
- 0
New Nitrogen malware pushed via Google Ads for ransomware attacks

A new 'Nitrogen' initial access malware campaign uses Google and Bing search ads to promote fake software sites that infect unsuspecting users with Cobalt Strike and ransomware payloads.
- Bill Toulas
- July 26, 2023
- 11:04 AM
- 0
BlackCat ransomware pushes Cobalt Strike via WinSCP search ads

The BlackCat ransomware group (aka ALPHV) is running malvertizing campaigns to lure people into fake pages that mimic the official website of the WinSCP file-transfer application for Windows but instead push malware-ridden installers.
- Bill Toulas
- July 01, 2023
- 11:18 AM
- 0
Open-source Cobalt Strike port 'Geacon' used in macOS attacks

Geacon, a Go-based implementation of the beacon from the widely abused penetration testing suite Cobalt Strike, is being used more and more to target macOS devices.
- Bill Toulas
- May 16, 2023
- 08:10 AM
- 2
Microsoft and Fortra crack down on malicious Cobalt Strike servers

Microsoft, Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC) have announced a broad legal crackdown against servers hosting cracked copies of Cobalt Strike, one of the primary hacking tools used by cybercriminals.
- Sergiu Gatlan
- April 06, 2023
- 01:04 PM
- 0
Gootkit malware abuses VLC to infect healthcare orgs with Cobalt Strike

The Gootkit loader malware operators are running a new SEO poisoning campaign that abuses VLC Media Player to infect Australian healthcare entities with Cobalt Strike beacons.
- Bill Toulas
- January 11, 2023
- 12:24 PM
- 5
Google releases 165 YARA rules to detect Cobalt Strike attacks

The Google Cloud Threat Intelligence team has open-sourced YARA Rules and a VirusTotal Collection of indicators of compromise (IOCs) to help defenders detect Cobalt Strike components in their networks.
- Sergiu Gatlan
- November 21, 2022
- 11:32 AM
- 0
New hacking group uses custom 'Symatic' Cobalt Strike loaders

A previously unknown Chinese APT (advanced persistent threat) hacking group dubbed 'Earth Longzhi' targets organizations in East Asia, Southeast Asia, and Ukraine.
- Bill Toulas
- November 09, 2022
- 02:15 PM
- 0
Fake US govt job offers push Cobalt Strike in phishing attacks

A new phishing campaign targets US and New Zealand job seekers with malicious documents installing Cobalt Strike beacons for remote access to victims' devices.
- Bill Toulas
- September 30, 2022
- 12:33 PM
- 0
Hackers now sharing cracked Brute Ratel post-exploitation kit online

The Brute Ratel post-exploitation toolkit has been cracked and is now being shared for free across Russian-speaking and English-speaking hacking communities.
- Lawrence Abrams
- September 28, 2022
- 07:00 PM
- 0
Ransomware gang's Cobalt Strike servers DDoSed with anti-Russia messages

Someone is flooding Cobalt Strike servers operated by former members of the Conti ransomware gang with anti-Russian messages to disrupt their activity.
- Ionut Ilascu
- September 07, 2022
- 09:09 AM
- 4
Winnti hackers split Cobalt Strike into 154 pieces to evade detection

The Chinese Winnti hacking group, also known as 'APT41' or 'Wicked Spider,' targeted at least 80 organizations last year and successfully breached the networks of at least thirteen.
- Bill Toulas
- August 18, 2022
- 11:48 AM
- 0
Chinese hackers use new Cobalt Strike-like attack framework

Researchers have observed a new post-exploitation attack framework used in the wild, named Manjusaka, which can be deployed as an alternative to the widely abused Cobalt Strike toolset or parallel to it for redundancy.
- Bill Toulas
- August 02, 2022
- 04:01 PM
- 1
LockBit ransomware abuses Windows Defender to load Cobalt Strike

Security analysts have observed an affiliate of the LockBit 3.0 ransomware operation abusing a Windows Defender command line tool to decrypt and load Cobalt Strike beacons on the target systems.
- Bill Toulas
- July 29, 2022
- 10:29 AM
- 5
Ransomware, hacking groups move from Cobalt Strike to Brute Ratel

Hacking groups and ransomware operations are moving away from Cobalt Strike to the newer Brute Ratel post-exploitation toolkit to evade detection by EDR and antivirus solutions.
- Lawrence Abrams
- July 06, 2022
- 01:32 PM
- 5
Russian govt hackers hit Ukraine with Cobalt Strike, CredoMap malware

The Ukrainian Computer Emergency Response Team (CERT) is warning that Russian hacking groups are exploiting the Follina code execution vulnerability in new phishing campaigns to install the CredoMap malware and Cobalt Strike beacons.
- Bill Toulas
- June 21, 2022
- 03:34 PM
- 0