Cobalt Strike

First seen

2012-06-04 00:00:00

Malware type

rat

Family

Malware family

Operating systems

linux, macos, windows

Related IoCs

162751 (127602 malicious)

Last IoC activity

2026-10-17 04:29:11

Profile updated

2026-07-07 15:46:33

Targeted industries: defense-and-aerospace financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications

Context

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system. In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.

Recent IoC activity

127,874 malicious indicators in Maltiverse are attributed to Cobalt Strike (S0154). The 20 most recently updated:

Detection coverage

• 144 YARA rules
• 856 Sigma rules

Malware & tools used

• JavaScript (attack-pattern)
• Remote Desktop Protocol (attack-pattern)
• Native API (attack-pattern)
• Pass the Hash (attack-pattern)
• Domain Accounts (attack-pattern)
• Indicator Removal from Tools (attack-pattern)
• Bypass User Account Control (attack-pattern)
• System Network Configuration Discovery (attack-pattern)
• Service Execution (attack-pattern)
• Data from Local System (attack-pattern)
• Dynamic-link Library Injection (attack-pattern)
• Keylogging (attack-pattern)
• BITS Jobs (attack-pattern)
• Process Hollowing (attack-pattern)
• Software Discovery (attack-pattern)
• Local Accounts (attack-pattern)
• Internal Proxy (attack-pattern)
• Exploitation for Privilege Escalation (attack-pattern)
• Screen Capture (attack-pattern)
• Process Argument Spoofing (attack-pattern)
• Modify Registry (attack-pattern)
• Domain Groups (attack-pattern)
• System Network Connections Discovery (attack-pattern)
• Protocol or Service Impersonation (attack-pattern)
• Parent PID Spoofing (attack-pattern)

Used by threat actors

• APT41 DUST (campaign)
• C0017 (campaign)
• C0021 (campaign)
• C0018 (campaign)
• SolarWinds Compromise (campaign)
• May 2023 Exfiltration & Wiper Activity (Truebot + FlawedGrace + MBR Killer) (campaign)
• PaperCut Vulnerability Exploitation (campaign)
• Pikabot Distribution Campaigns 2023 (campaign)
• Quantum Ransomware Compromise (campaign)
• Water Curupira Pikabot Distribution (campaign)
• TA577 (threat-actor)
• Chamelgang (threat-actor)
• Karakurt (threat-actor)
• RedGolf (threat-actor)
• Threat Group-3390 (threat-actor)
• Cobalt Group (threat-actor)
• Mustard Tempest (threat-actor)
• Wizard Spider (threat-actor)
• Sandworm Team (threat-actor)
• Cinnamon Tempest (threat-actor)
• Indrik Spider (threat-actor)
• Mustang Panda (threat-actor)
• Aquatic Panda (threat-actor)
• Storm-0501 (threat-actor)
• Storm-1811 (threat-actor)

Exploited vulnerabilities

• CVE-2020-10189 (vulnerability)
• CVE-2021-40444 (vulnerability)
• CVE-2022-47966 (vulnerability)
• CVE-2024-30051 (vulnerability)

Detection rules

• GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Dnsstager_Bin_V1_47_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Command_Ps1_V2_5_To_V3_7_And_Resources_Compress_Ps1_V3_8_To_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Elevate_X64_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_X64_Dll_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Bypassuactoken_X64_Dll_V3_11_To_V3_14 (yara-rule)
• GCTI_Cobaltstrike_Resources__Template_Vbs_V3_3_To_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Reverse_Bin_V2_5_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Browserpivot_X64_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_X64_Dll_V4_0_To_V4_X (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X86_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X86_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X86_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_X86_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X64_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X64_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X64_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Sleeve_Beaconloader_X64_O_V4_3_V4_4_V4_5_And_V4_6 (yara-rule)
• GCTI_Cobaltstrike_Resources_Elevate_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_Dll_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Httpstager_Bin_V2_5_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Httpsstager64_Bin_V3_2_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Artifact32Svc_Exe_V3_1_V3_2_V3_14_And_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Smbstager_Bin_V2_5_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Httpstager64_Bin_V3_2_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Reverse64_Bin_V2_5_Through_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Xor_Bin_V2_X_To_V4_X (yara-rule)
• GCTI_Cobaltstrike_Resources_Bind_Bin_V2_5_Through_V4_X (yara-rule)

Reports & references

• secureworks.com — Tin Woodlawn (report)
• volexity.com — Oceanlotus Extending Cyber Espionage Operations Through Fake Websites (report)
• Microsoft — Threat Actor Leverages Coin Miner Techniques To Stay Under The Radar Heres How To Spot Them (report)
• secureworks.com — Gold Niagara (report)
• secureworks.com — Gold Kingswood (report)
• secureworks.com — Bronze Mohawk (report)
• Palo Alto Unit 42 — Obscureserpens (report)
• pwc.com — Yir Cyber Threats Annex Download (report)
• secureworks.com — Bronze President (report)
• pwc.co.uk — Cyber Threats 2019 Retrospect (report)
• trellix.com — Growling Bears Make Thunderous Noise (report)
• research.checkpoint.com — Sharp Dragon Expands Towards Africa And The Caribbean (report)
• Trend Micro — Earth Zhulong Familiar Patterns Target Southeast Asian Firms (report)
• socradar.io — New Gootloader Variant Gootbot Changes The Game In Malware Tactics (report)
• Trend Micro — Hack The Real Box Apt41 New Subgroup Earth Longzhi (report)
• Trend Micro — Earth Estries Targets Government Tech For Cyberespionage (report)
• ESET — Sidewalk May Be As Dangerous As Crosswalk (report)
• group-ib.com — Shadowsilk (report)
• Broadcom/Symantec — Bluebottle Banks Targeted Africa (report)
• asec.ahnlab.com — 47455 (report)
• Trend Micro — Water Labbu Abuses Malicious Dapps To Steal Cryptocurrency (report)
• nsfocusglobal.com — The New Apt Group Darkcasino And The Global Surge In Winrar 0 Day Exploits (report)
• Trend Micro — Lodeinfo Campaign Of Earth Kasha (report)
• jsac.jpcert.or.jp — Jsac2025 1 5 Leon Chang Theo Chen En (report)
• medium.com — Man1 Moskal Hancitor And A Side Of Ransomware D77B4D991618 (report)

External references

• mitre-attack — S0154
• cobaltstrike manual
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy