I’m a big fan of the Cobalt Strike threat emulation software. Here at Digital Shadows (now ReliaQuest), it’s a staple of our internal Purple Team assessments and we’re always impressed by its capabilities. However, it appears that we are not the only ones to feel this way and we have seen how Cobalt Strike is used for illegitimate purposes by threat actors. It is therefore important for network defenders to familiarize themselves with the capabilities of this offensive toolset. We would like to stress here that Raphael Mudge, the creator of Cobalt Strike, is firmly against this unauthorized usage of his creation and we applaud his commitment to doing the right thing.
What is Cobalt Strike
Cobalt Strike is a powerful platform for conducting offensive cyber operations. It contains a wide variety of tools for conducting spear phishing and web drive-by attacks to gain initial access. Through the artefact kit, Cobalt Strike also has a flexible obfuscation framework. However, it is in the arena of post-exploitation that Cobalt Strike really shines. It has a custom implant, called Beacon, which can handle command and control (C2) communications via HTTP(S), DNS and even SMB named pipes. Beacon has numerous options for lateral movement, e.g., WMI and psexec as well as the ability to load PowerShell and .Net assemblies for additional modules such as mimikatz.
An Attractive Tool for Threat Actors
All these features mean that Cobalt Strike is also attractive tool of choice for criminal and nation-state actors who use Cobalt Strike illegitimately. One way in which this is achieved is by taking the Trial version of Cobalt Strike and cracking it to remove the copy protection, as well as the deliberate artefacts which are present in the Trial version. For example, the Trial version of the Beacon implant contains the EICAR Anti-Virus Test File!
On the popular messaging platform Telegram, there is a dedicated channel for sharing information about cracked versions of Cobalt Strike for unauthorized uses.
Figure 1 – Telegram channel offering cracked versions of Cobalt Strike
An example posting from the channel can be seen below.
Figure 2 – Example posting of the latest Cobalt Strike with Chinese-language support
Following the links in the channel leads to a Chinese-language posting on Github which contains the instructions on how to crack Cobalt Strike:
Figure 3 – Chinese-language instructions for cracking Cobalt Strike
The above approach also attempts to remove some of the artefacts which are present in the Trial version of Cobalt Strike which can be used by defensive technologies to detect or block Cobalt Strike activity.
The post also links to another Github repository that contains the necessary files:
Figure 4 – Github repository hosting the Cobalt Strike Trial files for crackers
Suspicious Cobalt Strike Team Servers
We have uncovered instances of Cobalt Strike team servers (the server component of Cobalt Strike) being hosted in China, Russia, France and other countries. While some of these may be legitimate purchases of Cobalt Strike, we assess that some are not.
Figure 5 – Example of Cobalt Strike teamserver being run from China
From open source reporting it is clear that there are many threat actors who use Cobalt Strike for their network intrusions. This is an opportunity for network defenders as not only is it possible to legitimately get access to Cobalt Strike itself for testing, but there is also a wealth of documentation and training material online about Cobalt Strike’s capabilities and how to use it as an operator.
Defense is Offense’s Child
A popular maxim in security is “defense is offense’s child”. With such a popular toolset like Cobalt Strike being used by threat actors as well as legitimate Red Teams and Penetration Testers, it is valuable for network defenders to assess how their security controls prevent or detect Cobalt Strike’s behavior. While Cobalt Strike provides threat emulation capabilities in terms of being able to mimic particular malware C2 traffic or in-memory artefacts, it is also important to be able to detect and prevent Cobalt Strike in its default configuration as used by threat actors today. In particular, Cobalt Strike’s built-in privilege escalation, lateral movement and command and control capabilities are worth understanding and assessing how security controls can either prevent or detect this activity. The “Advanced Threat Tactics” online course provided for free by Raphael Mudge is an excellent place to start learning.
When considering network defenses, it is worthwhile to consider that even moderately sophisticated threat actors can easily gain access to advanced offensive tooling and while they may not be as capable as others in terms of their ability to operate Cobalt Strike effectively, the range of functionality which is available and its comparative ease of use mean that it is a force to be reckoned with.
