Threat Actors Use of Cobalt Strike: Why Defense is Offense’s Child

save
Share and earn Cybytes
Facebook Twitter Google+ LinkedIn Email

I’m a big fan of the Cobalt Strike threat emulation software. Here at Digital Shadows, it’s a staple of our internal Purple Team assessments and we’re always impressed by its capabilities. However, it appears that we are not the only ones to feel this way and we have seen how Cobalt Strike is used for illegitimate purposes by threat actors. It is therefore important for network defenders to familiarize themselves with the capabilities of this offensive toolset. We would like to stress here that Raphael Mudge, the creator of Cobalt Strike, is firmly against this unauthorized usage of his creation and we applaud his commitment to doing the right thing.

What is Cobalt Strike

Cobalt Strike is a powerful platform for conducting offensive cyber operations. It contains a wide variety of tools for conducting spear phishing and web drive-by attacks to gain initial access. Through the artefact kit, Cobalt Strike also has a flexible obfuscation framework. However, it is in the arena of post-exploitation that Cobalt Strike really shines. It has a custom implant, called Beacon, which can handle command and control (C2) communications via HTTP(S), DNS and even SMB named pipes. Beacon has numerous options for lateral movement, e.g., WMI and psexec as well as the ability to load PowerShell and .Net assemblies for additional modules such as mimikatz.

An Attractive Tool for Threat Actors

All these features mean that Cobalt Strike is also attractive tool of choice for criminal and nation-state actors who use Cobalt Strike illegitimately. One way in which this is achieved is by taking the Trial version of Cobalt Strike and cracking it to remove the copy protection, as well as the deliberate artefacts which are present in the Trial version. For example, the Trial version of the Beacon implant contains the EICAR Anti-Virus Test File!

On the popular messaging platform Telegram, there is a dedicated channel for sharing information about cracked versions of Cobalt Strike for unauthorized uses.

 

Figure 1 – Telegram channel offering cracked versions of Cobalt Strike

 

An example posting from the channel can be seen below.

 

Figure 2 – Example posting of the latest Cobalt Strike with Chinese-language support

 

Following the links in the channel leads to a Chinese-language posting on Github which contains the instructions on how to crack Cobalt Strike:

 

Figure 3 – Chinese-language instructions for cracking Cobalt Strike

 

The above approach also attempts to remove some of the artefacts which are present in the Trial version of Cobalt Strike which can be used by defensive technologies to detect or block Cobalt Strike activity.

The post also links to another Github repository that contains the necessary files:

 

Figure 4 – Github repository hosting the Cobalt Strike Trial files for crackers

 

Suspicious Cobalt Strike Team Servers

We have uncovered instances of Cobalt Strike team servers (the server component of Cobalt Strike) being hosted in China, Russia, France and other countries. While some of these may be legitimate purchases of Cobalt Strike, we assess that some are not.

 

Figure 5 – Example of Cobalt Strike teamserver being run from China

From open source reporting it is clear that there are many threat actors who use Cobalt Strike for their network intrusions. This is an opportunity for network defenders as not only is it possible to legitimately get access to Cobalt Strike itself for testing, but there is also a wealth of documentation and training material online about Cobalt Strike’s capabilities and how to use it as an operator.

 

Defense is Offense’s Child

A popular maxim in security is “defense is offense’s child”. With such a popular toolset like Cobalt Strike being used by threat actors as well as legitimate Red Teams and Penetration Testers, it is valuable for network defenders to assess how their security controls prevent or detect Cobalt Strike’s behavior. While Cobalt Strike provides threat emulation capabilities in terms of being able to mimic particular malware C2 traffic or in-memory artefacts, it is also important to be able to detect and prevent Cobalt Strike in its default configuration as used by threat actors today. In particular, Cobalt Strike’s built-in privilege escalation, lateral movement and command and control capabilities are worth understanding and assessing how security controls can either prevent or detect this activity. The “Advanced Threat Tactics” online course provided for free by Raphael Mudge is an excellent place to start learning.

When considering network defenses, it is worthwhile to consider that even moderately sophisticated threat actors can easily gain access to advanced offensive tooling and while they may not be as capable as others in terms of their ability to operate Cobalt Strike effectively, the range of functionality which is available and its comparative ease of use mean that it is a force to be reckoned with.

Share this post and earn Cybytes
Facebook Twitter Google+ LinkedIn Email
Follow
3 Followers
About Digital Shadows
Digital Shadows monitors and manages an organization’s digital risk, providing relevant threat intelligence across the widest range of data sources within the open, deep, and dark web to protect their brand, and reputation. The Digital Shadows SearchLight™ service combines scalable data analytics with human data analysts to manage and mitigate risks of an organization’s brand exposure, VIP exposure, cyber threat, data exposure, infrastructure exposure, physical threat, and third party risk, and create an up-to-the minute view of an organization’s digital risk with tailored threat intelligence.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel