S0154 - Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as "adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors". Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.

Author
agomez
Created
2022-12-22 16:52:40
Last updated
2026-02-07 19:18:40
Downloads
3523183
IPv4 indicators
1011
Hostname indicators
6984
URL indicators
101808
Sample indicators
18116

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

https://img2.huorongsec.com/zh3G URL

modified 2026-10-18 07:34:42
Cobalt strike (Maltiverse Threat Observatory)

https://bbs.microsoftsync.net/YSGi URL

modified 2026-10-18 07:15:59
Cobalt strike (Maltiverse Threat Observatory)

http://img2.huorongsec.com/3Axp URL

modified 2026-10-18 07:13:33
Cobalt strike (Maltiverse Threat Observatory)

https://bbs.microsoftsync.net/5Gsm URL

modified 2026-10-18 06:42:59
Cobalt strike (Maltiverse Threat Observatory)

f573029d7eb46347bcb2a7734f718bdd959a49d47468214c4d5f331b31e050da Sample

modified 2026-10-18 06:06:07
Cobaltstrike (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

721b456e41a756d2370bae9da9ca5bd345ef8f732f7a5707c2114a88940d3685 Sample

modified 2026-10-18 06:05:19
CobaltStrike (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

http://img2.huorongsec.com/jiGB URL

modified 2026-10-18 05:33:17
Cobalt strike (Maltiverse Threat Observatory)

2026-10-17_d0f7f5ded2ade1782ddb6e395b43b79d_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar Sample

modified 2026-10-18 05:15:02
Cobalt Strike (Triage)

iplis.ru Hostname

modified 2026-10-18 05:03:39
Phishing (Phishtank) · DangerousSig [Trj] (Hybrid-Analysis) · HEUR:Trojan.Zapchast (Hybrid-Analysis) · Gen:Variant.Fragtor (Hybrid-Analysis) · Trojan.Agent (Hybrid-Analysis)

cs.5seo.co Hostname

modified 2026-10-18 04:54:02
Cobalt Strike (ThreatFox Abuse.ch)

us-central1-workers-373921.cloudfunctions.net Hostname

modified 2026-10-18 04:40:35
Cobalt Strike (ThreatFox Abuse.ch)

www.microsoft-info.org Hostname

modified 2026-10-18 04:40:35
Cobalt Strike (ThreatFox Abuse.ch)

creditcheck.ppdai.com Hostname

modified 2026-10-18 04:40:33
Cobalt Strike (ThreatFox Abuse.ch)

beautyhealthandlifestyle.com Hostname

modified 2026-10-18 04:40:30
Cobalt Strike (ThreatFox Abuse.ch)

update.qzkgpqn.kdns.fr Hostname

modified 2026-10-18 04:40:17
Cobalt Strike (ThreatFox Abuse.ch)

holy-dust-6b6e.siwuxie6.workers.dev Hostname

modified 2026-10-18 04:40:14
Cobalt Strike (ThreatFox Abuse.ch)

independent.vittoriocas137.workers.dev Hostname

modified 2026-10-18 04:40:14
Meterpreter (ThreatFox Abuse.ch) · Cobalt Strike (ThreatFox Abuse.ch)

9mjunw.easypanel.host Hostname

modified 2026-10-18 04:40:10
Cobalt Strike (ThreatFox Abuse.ch)

www.atomscience.cn Hostname

modified 2026-10-18 04:40:09
Cobalt Strike (ThreatFox Abuse.ch)

sck.img.yunphui.com Hostname

modified 2026-10-18 04:40:09
Cobalt Strike (ThreatFox Abuse.ch)

app.massrel.io Hostname

modified 2026-10-18 04:40:06
Cobalt Strike (ThreatFox Abuse.ch)

adldas.top Hostname

modified 2026-10-18 04:40:06
Cobalt Strike (ThreatFox Abuse.ch)

demo.davistravel.org Hostname

modified 2026-10-18 04:40:05
Cobalt strike (Maltiverse Threat Observatory)

a8tkf5twd0gk0.cfc-execute.bj.baidubce.com Hostname

modified 2026-10-18 04:39:55
Cobalt Strike (ThreatFox Abuse.ch)

bbs.microsoftsync.net Hostname

modified 2026-10-18 04:39:55
Malicious behavior (Maltiverse Threat Observatory) · Cobalt strike (Maltiverse Threat Observatory)

acsdomaindsadas.click Hostname

modified 2026-10-18 04:39:55
Cobalt Strike (ThreatFox Abuse.ch)

ns-2.open.ro Hostname

modified 2026-10-18 04:39:52
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

ecs-139-9-188-51.compute.hwclouds-dns.com Hostname

modified 2026-10-18 04:39:51
Cobalt Strike (ThreatFox Abuse.ch)

ec2-175-41-154-10.ap-southeast-1.compute.amazonaws.com Hostname

modified 2026-10-18 04:39:42
Cobalt Strike (ThreatFox Abuse.ch)

ssl.sociohealth.co.jp Hostname

modified 2026-10-18 04:39:42
Cobalt Strike (ThreatFox Abuse.ch)

msdnupdate.com Hostname

modified 2026-10-18 04:39:40
Cobalt Strike (ThreatFox Abuse.ch)

skullcode.myddns.me Hostname

modified 2026-10-18 04:39:40
Cobalt Strike (ThreatFox Abuse.ch)

ww.hostrocketsupport.net Hostname

modified 2026-10-18 04:39:40
Cobalt Strike (ThreatFox Abuse.ch)

cs.qiaoshen.top Hostname

modified 2026-10-18 04:39:40
Cobalt Strike (ThreatFox Abuse.ch)

service-rchqbzvz-1301033415.sh.tencentapigw.com Hostname

modified 2026-10-18 04:39:39
Cobalt Strike (ThreatFox Abuse.ch)

financialservicesunion.com Hostname

modified 2026-10-18 04:39:34
Cobalt Strike (ThreatFox Abuse.ch)

www.peoplesgroup.com.cn Hostname

modified 2026-10-18 04:39:32
Cobalt Strike (ThreatFox Abuse.ch)

d34auolpreyu24.cloudfront.net Hostname

modified 2026-10-18 04:39:32
Cobalt Strike (ThreatFox Abuse.ch)

xulnai.com Hostname

modified 2026-10-18 04:39:31
Cobalt Strike (ThreatFox Abuse.ch)

37.0.10.31 IPv4

modified 2026-10-18 04:39:29
Cobalt Strike (ThreatFox Abuse.ch) · Malicious Host (Alienvault Ip Reputation Database) · Mail Spammer (Barracuda)

ns1.cryptwechat.com Hostname

modified 2026-10-18 04:39:29
Cobalt Strike (ThreatFox Abuse.ch)

104.244.95.163.16clouds.com Hostname

modified 2026-10-18 04:39:27
Cobalt Strike (ThreatFox Abuse.ch)

lucid-albattani.104-168-102-175.plesk.page Hostname

modified 2026-10-18 04:39:16
Cobalt Strike (ThreatFox Abuse.ch)

service-qzxfb4ay-1318428097.gz.tencentapigw.com.cn Hostname

modified 2026-10-18 04:39:12
Cobalt Strike (ThreatFox Abuse.ch)

www.gzjinyou.cn Hostname

modified 2026-10-18 04:39:11
Cobalt Strike (ThreatFox Abuse.ch)

cloudgooglesdk.publicvm.com Hostname

modified 2026-10-18 04:39:11
Cobalt Strike (ThreatFox Abuse.ch)

dev.msndla.com Hostname

modified 2026-10-18 04:39:01
Cobalt Strike (ThreatFox Abuse.ch)

api.bzmajiang.cn Hostname

modified 2026-10-18 04:38:59
Cobalt Strike (ThreatFox Abuse.ch)

web.the-briar-patch.cc Hostname

modified 2026-10-18 04:38:54
Cobalt Strike (ThreatFox Abuse.ch)

cs.dingjie.eu.org Hostname

modified 2026-10-18 04:38:53
Cobalt Strike (ThreatFox Abuse.ch)

ng.623866.xyz Hostname

modified 2026-10-18 04:38:50
Cobalt Strike (ThreatFox Abuse.ch)

www.ajzq.com Hostname

modified 2026-10-18 04:38:49
Cobalt Strike (ThreatFox Abuse.ch)

bfer.yxle.cn Hostname

modified 2026-10-18 04:38:41
Cobalt Strike (ThreatFox Abuse.ch)

denialallowance.com Hostname

modified 2026-10-18 04:38:35
Cobalt Strike (ThreatFox Abuse.ch)

209.lan-za2-1.static.rozabg.com Hostname

modified 2026-10-18 04:38:22
Cobalt Strike (ThreatFox Abuse.ch)

translate.dictionary.com Hostname

modified 2026-10-18 04:38:18
Cobalt Strike (ThreatFox Abuse.ch)

www.ll10010.com Hostname

modified 2026-10-18 04:38:17
Cobalt Strike (ThreatFox Abuse.ch)

reebons.com Hostname

modified 2026-10-18 04:38:17
Cobalt Strike (ThreatFox Abuse.ch)

guoyashuai.top Hostname

modified 2026-10-18 04:38:17
Cobalt Strike (ThreatFox Abuse.ch)

nicefeide.top Hostname

modified 2026-10-18 04:38:17
Cobalt Strike (ThreatFox Abuse.ch)

pctor.link Hostname

modified 2026-10-18 04:38:15
Cobalt Strike (ThreatFox Abuse.ch)

liuerlife.online Hostname

modified 2026-10-18 04:38:10
Cobalt strike (Maltiverse Threat Observatory) · Cobalt Strike (ThreatFox Abuse.ch)

service-o1dc3wx3-1311799005.bj.tencentapigw.com.cn Hostname

modified 2026-10-18 04:38:06
Cobalt Strike (ThreatFox Abuse.ch)

www.vigilant-kare.104-168-102-175.plesk.page Hostname

modified 2026-10-18 04:38:04
Cobalt Strike (ThreatFox Abuse.ch)

defender.us.org Hostname

modified 2026-10-18 04:38:02
Cobalt Strike (ThreatFox Abuse.ch)

www.louangelwolf.com Hostname

modified 2026-10-18 04:37:58
Cobalt Strike (ThreatFox Abuse.ch)

4.tcp.ngrok.io Hostname

modified 2026-10-18 04:37:47
Nanocore RAT (ThreatFox Abuse.ch) · Backdoor.Poison (Hybrid-Analysis) · Backdoor.MSIL.BLADABINDI (Hybrid-Analysis) · Backdoor.Bladabindi (Hybrid-Analysis) · Trojan.CobaltStrike (Hybrid-Analysis)

aualadin.com Hostname

modified 2026-10-18 04:37:46
Cobalt Strike (ThreatFox Abuse.ch)

realsecuritystore.com Hostname

modified 2026-10-18 04:37:45
Cobalt Strike (ThreatFox Abuse.ch)

time.api.chinabm.cn Hostname

modified 2026-10-18 04:37:44
Meterpreter (ThreatFox Abuse.ch) · Cobalt Strike (ThreatFox Abuse.ch)

urpwnd.site Hostname

modified 2026-10-18 04:37:38
Cobalt Strike (ThreatFox Abuse.ch)

hcdnv.baidu.gslb.c.cdnhwc2.com Hostname

modified 2026-10-18 04:37:38
Cobalt Strike (ThreatFox Abuse.ch)

appweb-fbbafboydh.cn-hangzhou.fcapp.run Hostname

modified 2026-10-18 04:37:36
Cobalt Strike (ThreatFox Abuse.ch)

cloudflare.12aim.com Hostname

modified 2026-10-18 04:37:36
Cobalt Strike (ThreatFox Abuse.ch)

www.0xqtt57e.sched.vip-dk.tdnsvod1.cn Hostname

modified 2026-10-18 04:37:34
Cobalt Strike (ThreatFox Abuse.ch)

content.microsoft.com.w.kunlunca.com Hostname

modified 2026-10-18 04:37:30
Malicious URL (Hybrid-Analysis) · Cobalt Strike (ThreatFox Abuse.ch)

service-1bsjckga-1252578700.gz.tencentapigw.com.cn Hostname

modified 2026-10-18 04:37:26
Cobalt Strike (ThreatFox Abuse.ch)

hw.yideng.co Hostname

modified 2026-10-18 04:37:24
Cobalt Strike (ThreatFox Abuse.ch)

msdnsservice.com Hostname

modified 2026-10-18 04:37:24
Cobalt Strike (ThreatFox Abuse.ch)

autodiscover.it Hostname

modified 2026-10-18 04:37:22
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

service-1cao6cjs-1312654103.gz.apigw.tencentcs.com Hostname

modified 2026-10-18 04:37:18
Cobalt Strike (ThreatFox Abuse.ch)

service-qke82nt8-1301348154.gz.apigw.tencentcs.com Hostname

modified 2026-10-18 04:37:18
Cobalt Strike (ThreatFox Abuse.ch)

update07.microsoft-essentials.com Hostname

modified 2026-10-18 04:37:16
Cobalt Strike (ThreatFox Abuse.ch)

webdisk.cn Hostname

modified 2026-10-18 04:37:15
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

ec2-107-23-38-171.compute-1.amazonaws.com Hostname

modified 2026-10-18 04:37:15
Cobalt Strike (ThreatFox Abuse.ch)

dev.useimage.sbs Hostname

modified 2026-10-18 04:37:14
Cobalt Strike (ThreatFox Abuse.ch)

ns2.ig-pay.com Hostname

modified 2026-10-18 04:37:14
Cobalt Strike (ThreatFox Abuse.ch)

healthnet.azurefd.net Hostname

modified 2026-10-18 04:37:12
Cobalt Strike (ThreatFox Abuse.ch)

ressage.ca Hostname

modified 2026-10-18 04:37:06
Cobalt Strike (ThreatFox Abuse.ch)

index.searchchinas.top Hostname

modified 2026-10-18 04:37:06
Cobalt Strike (ThreatFox Abuse.ch)

a.laclac.ml Hostname

modified 2026-10-18 04:37:06
Cobalt Strike (ThreatFox Abuse.ch)

unknown.serveblog.net Hostname

modified 2026-10-18 04:36:58
Cobalt Strike (ThreatFox Abuse.ch)

meetol.sbs Hostname

modified 2026-10-18 04:36:58
Cobalt Strike (ThreatFox Abuse.ch)

mcp.infinitum.space Hostname

modified 2026-10-18 04:36:57
Cobalt Strike (ThreatFox Abuse.ch)

hello-world-steep-glade-9514.ddosploit.workers.dev Hostname

modified 2026-10-18 04:36:56
Cobalt Strike (ThreatFox Abuse.ch)

192-46-232-181.ip.linodeusercontent.com Hostname

modified 2026-10-18 04:36:55
Cobalt Strike (ThreatFox Abuse.ch)

jacollans.com Hostname

modified 2026-10-18 04:36:55
Cobalt Strike (ThreatFox Abuse.ch)

cdn.spark.re Hostname

modified 2026-10-18 04:36:49
Top Popularity Site (Cisco Umbrella) · Cobalt Strike (ThreatFox Abuse.ch)

sx.adminer.eu.org Hostname

modified 2026-10-18 04:36:45
Cobalt Strike (ThreatFox Abuse.ch)

newsmach.com Hostname

modified 2026-10-18 04:36:44
Cobalt Strike (ThreatFox Abuse.ch)