Remote Access Trojan

Cobalt Strike

First seen: 2012-01 • Status: active

Currently Active Threat

Cobalt Strike is a professional hacking tool meant for security testing, but criminals love it. It's so popular with hackers that if a company finds it on their network (and they weren't testing), it almost always means a serious breach is happening. Ransomware gangs and nation-state hackers all use it because it's reliable and hard to detect.

Overview

Cobalt Strike is a commercial adversary simulation tool designed for penetration testing. Its powerful capabilities have made it the most commonly abused tool by both cybercriminals and nation-state actors. Cracked versions circulate widely, and Cobalt Strike beacons are present in the majority of serious intrusions.

Also Known As

Cobalt Strike Beacon, CS Beacon, CobaltStrike

How It Spreads

  • • Delivered via other malware (loaders, stealers)
  • • Exploited vulnerabilities in public-facing systems
  • • Phishing emails with weaponized documents
  • • Post-exploitation after initial access
  • • Supply chain compromises

What It Does

  • • Provides persistent backdoor access (Beacon)
  • • Enables lateral movement within networks
  • • Facilitates credential harvesting
  • • Allows execution of arbitrary commands
  • • Supports pivoting through compromised systems
  • • Often precedes ransomware deployment

Is your business exposed?

Target Platforms

Windows 7, Windows 10, Windows 11, Linux, macOS

Detection Tips

  • • Monitor for named pipes matching Cobalt Strike patterns
  • • Detect HTTPS beaconing at regular intervals (jitter)
  • • Alert on process injection into legitimate Windows processes
  • • Watch for Mimikatz-like credential dumping
  • • Monitor for malleable C2 traffic patterns

MITRE ATT&CK Techniques

T1071.001, T1055, T1003, T1021, T1059.001

If You're Infected

  1. 1.

    CRITICAL: Finding Cobalt Strike means active intrusion - invoke IR immediately

  2. 2.

    Isolate affected systems but preserve forensic evidence

  3. 3.

    Assume lateral movement - check all connected systems

  4. 4.

    Reset all domain admin and privileged account credentials

  5. 5.

    Hunt for persistence mechanisms across environment

  6. 6.

    Prepare for potential ransomware - verify backups are intact

Related Malware

Brute Ratel, Sliver, Metasploit

Is your business exposed?

Check if your company data is circulating on the dark web

Free scan • No credit card required

Privacy PolicyYour Privacy Choices