Research | Our Q3 report details what's new in the world of ransomware.
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest threat research report from ReliaQuest Threat Research research team.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
November 30, 2023
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
I’m a big fan of the Cobalt Strike threat emulation software. Here at Digital Shadows (now ReliaQuest), it’s a staple of our internal Purple Team assessments and we’re always impressed by its capabilities. However, it appears that we are not the only ones to feel this way and we have seen how Cobalt Strike is used for illegitimate purposes by threat actors. It is therefore important for network defenders to familiarize themselves with the capabilities of this offensive toolset. We would like to stress here that Raphael Mudge, the creator of Cobalt Strike, is firmly against this unauthorized usage of his creation and we applaud his commitment to doing the right thing.
Cobalt Strike is a powerful platform for conducting offensive cyber operations. It contains a wide variety of tools for conducting spear phishing and web drive-by attacks to gain initial access. Through the artefact kit, Cobalt Strike also has a flexible obfuscation framework. However, it is in the arena of post-exploitation that Cobalt Strike really shines. It has a custom implant, called Beacon, which can handle command and control (C2) communications via HTTP(S), DNS and even SMB named pipes. Beacon has numerous options for lateral movement, e.g., WMI and psexec as well as the ability to load PowerShell and .Net assemblies for additional modules such as mimikatz.
All these features mean that Cobalt Strike is also attractive tool of choice for criminal and nation-state actors who use Cobalt Strike illegitimately. One way in which this is achieved is by taking the Trial version of Cobalt Strike and cracking it to remove the copy protection, as well as the deliberate artefacts which are present in the Trial version. For example, the Trial version of the Beacon implant contains the EICAR Anti-Virus Test File!
On the popular messaging platform Telegram, there is a dedicated channel for sharing information about cracked versions of Cobalt Strike for unauthorized uses.
Figure 1 – Telegram channel offering cracked versions of Cobalt Strike
An example posting from the channel can be seen below.
Figure 2 – Example posting of the latest Cobalt Strike with Chinese-language support
Following the links in the channel leads to a Chinese-language posting on Github which contains the instructions on how to crack Cobalt Strike:
Figure 3 – Chinese-language instructions for cracking Cobalt Strike
The above approach also attempts to remove some of the artefacts which are present in the Trial version of Cobalt Strike which can be used by defensive technologies to detect or block Cobalt Strike activity.
The post also links to another Github repository that contains the necessary files:
Figure 4 – Github repository hosting the Cobalt Strike Trial files for crackers
We have uncovered instances of Cobalt Strike team servers (the server component of Cobalt Strike) being hosted in China, Russia, France and other countries. While some of these may be legitimate purchases of Cobalt Strike, we assess that some are not.
Figure 5 – Example of Cobalt Strike teamserver being run from China
From open source reporting it is clear that there are many threat actors who use Cobalt Strike for their network intrusions. This is an opportunity for network defenders as not only is it possible to legitimately get access to Cobalt Strike itself for testing, but there is also a wealth of documentation and training material online about Cobalt Strike’s capabilities and how to use it as an operator.
A popular maxim in security is “defense is offense’s child”. With such a popular toolset like Cobalt Strike being used by threat actors as well as legitimate Red Teams and Penetration Testers, it is valuable for network defenders to assess how their security controls prevent or detect Cobalt Strike’s behavior. While Cobalt Strike provides threat emulation capabilities in terms of being able to mimic particular malware C2 traffic or in-memory artefacts, it is also important to be able to detect and prevent Cobalt Strike in its default configuration as used by threat actors today. In particular, Cobalt Strike’s built-in privilege escalation, lateral movement and command and control capabilities are worth understanding and assessing how security controls can either prevent or detect this activity. The “Advanced Threat Tactics” online course provided for free by Raphael Mudge is an excellent place to start learning.
When considering network defenses, it is worthwhile to consider that even moderately sophisticated threat actors can easily gain access to advanced offensive tooling and while they may not be as capable as others in terms of their ability to operate Cobalt Strike effectively, the range of functionality which is available and its comparative ease of use mean that it is a force to be reckoned with.