Threat Actors Use of Cobalt Strike: Why Defense is Offense’s Child

Share and earn Cybytes
Facebook Twitter LinkedIn Email

I’m a big fan of the Cobalt Strike threat emulation software. Here at Digital Shadows, it’s a staple of our internal Purple Team assessments and we’re always impressed by its capabilities. However, it appears that we are not the only ones to feel this way and we have seen how Cobalt Strike is used for illegitimate purposes by threat actors. It is therefore important for network defenders to familiarize themselves with the capabilities of this offensive toolset. We would like to stress here that Raphael Mudge, the creator of Cobalt Strike, is firmly against this unauthorized usage of his creation and we applaud his commitment to doing the right thing.

What is Cobalt Strike

Cobalt Strike is a powerful platform for conducting offensive cyber operations. It contains a wide variety of tools for conducting spear phishing and web drive-by attacks to gain initial access. Through the artefact kit, Cobalt Strike also has a flexible obfuscation framework. However, it is in the arena of post-exploitation that Cobalt Strike really shines. It has a custom implant, called Beacon, which can handle command and control (C2) communications via HTTP(S), DNS and even SMB named pipes. Beacon has numerous options for lateral movement, e.g., WMI and psexec as well as the ability to load PowerShell and .Net assemblies for additional modules such as mimikatz.

An Attractive Tool for Threat Actors

All these features mean that Cobalt Strike is also attractive tool of choice for criminal and nation-state actors who use Cobalt Strike illegitimately. One way in which this is achieved is by taking the Trial version of Cobalt Strike and cracking it to remove the copy protection, as well as the deliberate artefacts which are present in the Trial version. For example, the Trial version of the Beacon implant contains the EICAR Anti-Virus Test File!

On the popular messaging platform Telegram, there is a dedicated channel for sharing information about cracked versions of Cobalt Strike for unauthorized uses.


Figure 1 – Telegram channel offering cracked versions of Cobalt Strike


An example posting from the channel can be seen below.


Figure 2 – Example posting of the latest Cobalt Strike with Chinese-language support


Following the links in the channel leads to a Chinese-language posting on Github which contains the instructions on how to crack Cobalt Strike:


Figure 3 – Chinese-language instructions for cracking Cobalt Strike


The above approach also attempts to remove some of the artefacts which are present in the Trial version of Cobalt Strike which can be used by defensive technologies to detect or block Cobalt Strike activity.

The post also links to another Github repository that contains the necessary files:


Figure 4 – Github repository hosting the Cobalt Strike Trial files for crackers


Suspicious Cobalt Strike Team Servers

We have uncovered instances of Cobalt Strike team servers (the server component of Cobalt Strike) being hosted in China, Russia, France and other countries. While some of these may be legitimate purchases of Cobalt Strike, we assess that some are not.


Figure 5 – Example of Cobalt Strike teamserver being run from China

From open source reporting it is clear that there are many threat actors who use Cobalt Strike for their network intrusions. This is an opportunity for network defenders as not only is it possible to legitimately get access to Cobalt Strike itself for testing, but there is also a wealth of documentation and training material online about Cobalt Strike’s capabilities and how to use it as an operator.


Defense is Offense’s Child

A popular maxim in security is “defense is offense’s child”. With such a popular toolset like Cobalt Strike being used by threat actors as well as legitimate Red Teams and Penetration Testers, it is valuable for network defenders to assess how their security controls prevent or detect Cobalt Strike’s behavior. While Cobalt Strike provides threat emulation capabilities in terms of being able to mimic particular malware C2 traffic or in-memory artefacts, it is also important to be able to detect and prevent Cobalt Strike in its default configuration as used by threat actors today. In particular, Cobalt Strike’s built-in privilege escalation, lateral movement and command and control capabilities are worth understanding and assessing how security controls can either prevent or detect this activity. The “Advanced Threat Tactics” online course provided for free by Raphael Mudge is an excellent place to start learning.

When considering network defenses, it is worthwhile to consider that even moderately sophisticated threat actors can easily gain access to advanced offensive tooling and while they may not be as capable as others in terms of their ability to operate Cobalt Strike effectively, the range of functionality which is available and its comparative ease of use mean that it is a force to be reckoned with.

Share this post and earn Cybytes
Facebook Twitter LinkedIn Email
About Digital Shadows
Digital Shadows is the leader in Digital Risk Protection. Digital Shadows minimizes digital risk by identifying unwanted exposure and protecting against external threats. Organizations can suffer regulatory fines, loss of intellectual property, and reputational damage when digital risk is left unmanaged. Digital Shadows SearchLight™ helps you minimize these risks by detecting data loss, securing your online brand, and reducing your attack surface. To learn more and get free access to SearchLight, visit
Promoted Content
A Practical Guide to Reducing Digital Risk - Tools and Approaches for Security, Intelligence, and Fraud Teams
For those working to secure organizations, life isn't getting any easier. As businesses continue to invest in technology, the environment that must be secured has become more complex and challenging. This guide is written for people whose role it is to deal with this complexity: the practitioners. It provides advice to help understand how to identify critical business assets, understand the threat, monitor for exposure, and take action.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Support Cybrary

Donate Here to Get This Month's Donor Badge


We recommend always using caution when following any link

Are you sure you want to continue?