Cobalt Strike

Cobalt Strike is a commercial tool built for red teams to emulate real attackers. Its post-exploitation agent, called Beacon, is so capable that cracked and leaked copies became a favourite of ransomware operators and state groups. In June 2024 Operation Morpheus, led by the UK National Crime Agency and coordinated by Europol, targeted unlicensed copies on criminal infrastructure.

Public attribution and associated actors: A legitimate commercial adversary-simulation product. Europol reports that old, unlicensed copies are abused by criminals; MITRE ATT&CK lists dozens of state and criminal groups using it.As publicly reported:APT29 APT41 FIN7 Wizard Spider Mustang Panda
First seen: Around 2012
Platforms: Windows, Linux, macOS
MITRE ATT&CK software entries: S0154 Cobalt Strike

Status: In June 2024 Operation Morpheus flagged 690 IP addresses hosting unlicensed copies and 593 were taken down (Europol).

How it spreads or gets in

Not self-spreading. Attackers deploy Beacon after initial access, often through a loader, and use it to move across the network.

Key behaviours

Injected into processes and impersonated tokens to blend in.
Dumped credentials and moved laterally over SMB, WMI and WinRM.
Communicated over HTTP, HTTPS or DNS with configurable traffic profiles.

ATT&CK techniques

Selected from the family's MITRE ATT&CK software entry.

Detection ideas

Hunt for named pipes, injected threads and beacon-like regular network callbacks.
Alert on remote service creation and PowerShell download cradles.
Use memory scanning on endpoints, since Beacon often lives only in memory.

Defences that work

Deploy EDR with memory protection and tune it against injection techniques.
Protect LSASS and limit administrative access paths.
Restrict and inspect outbound traffic, including DNS.
Authorise and register legitimate red-team use so real abuse stands out.

Sources

Dual-use toolATT&CK S0154