{
  "family": "cobaltstrike",
  "sample_count": 3500,
  "category": "hacktool",
  "description": "Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Originally authored by Raphael Mudge and developed by HelpSystems (now Fortra) for legitimate red-team penetration testing, cracked and leaked versions (notably versions 4.0 through 4.9) have been comprehensively adopted by sophisticated cybercrime syndicates, initial access brokers, and advanced persistent threat (APT) groups. The core implant, Beacon, operates in-memory using reflective DLL loading and process hollowing to evade traditional endpoint detection and response (EDR) agents. It communicates over encrypted HTTP, HTTPS, DNS, or SMB named pipes using Malleable C2 profiles that emulate benign web traffic. Beacon features modular post-exploitation capabilities including token manipulation, Mimikatz integration for credential dumping, port scanning, lateral movement via WMI and PsExec, and sleep obfuscation techniques (such as Ekko, Foliage, and timer-based memory protection swapping) that protect the payload's memory space between check-ins. It is documented in multiple CISA alerts (including AA21-209A) and actively exploited in combination with edge appliance CVEs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Cobalt Strike Beacon",
    "CobaltStrike",
    "Beacon",
    "HackTool:Win32/CobaltStrike",
    "Trojan.CobaltStrike"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Cobalt Strike Beacon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cobalt Strike Beacon is an advanced post-exploitation agent designed for adversary simulation that provides threat actors with in-memory stealth execution, command-and-control communication, and lateral movement tools."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Cobalt Strike so widely used by threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors weaponize leaked and cracked versions because it provides robust, reliable enterprise-grade C2 features, malleable network traffic profiles, and in-memory execution that bypasses traditional signature-based antivirus."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cobalt Strike Beacon evade EDR detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Beacon leverages reflective DLL injection, process injection, sleep obfuscation (encrypting heap and stack during sleep), and user-mode API unhooking to conceal its presence in memory."
      }
    },
    {
      "@type": "Question",
      "name": "What network protocols does Cobalt Strike use for C2?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Beacon communicates using customizable Malleable C2 profiles over HTTP/HTTPS, DNS TXT queries, and SMB named pipes for internal peer-to-peer lateral movement across air-gapped subnets."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect Cobalt Strike in an enterprise environment?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders detect Beacon via behavioral EDR telemetry flagging unbacked executable memory, anomalous named pipe creation, memory-scanning YARA signatures, and network traffic inspecting standard Beacon jitter and default certificate artifacts."
      }
    },
    {
      "@type": "Question",
      "name": "What are Cobalt Strike Malleable C2 profiles and how do they alter network signatures?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malleable C2 is a specialized domain-specific language (DSL) within Cobalt Strike that allows operators to completely reshape Beacon's network traffic indicators. By defining custom HTTP headers, URI paths, client/server transaction formats, and data transformation routines (such as base64, netbios, or XOR encoding), Malleable C2 profiles allow operators to masquerade command-and-control beacons as legitimate web traffic, mimicking services such as Amazon CloudFront, Microsoft Update, or Gmail."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams correlate Cobalt Strike Beacon memory artifacts with YARA hunting rules?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security analysts hunt for Cobalt Strike in endpoint memory by deploying YARA rules targeting unbacked executable memory regions (PAGE_EXECUTE_READWRITE) lacking a corresponding on-disk file module. Key in-memory indicators include reflective DLL loader stubs, the default Beacon configuration block (which stores C2 server URLs, sleep timers, jitter percentages, and watermarks), and distinct sleep obfuscation artifacts (such as Sleep Mask or Ekko timers) used to bypass in-memory scanners."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1059.003",
    "T1055.001",
    "T1055.012",
    "T1573.002",
    "T1021.002",
    "T1003.001",
    "T1105",
    "T1082"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1055.001",
      "name": "Dynamic-link Library Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1055.012",
      "name": "Process Hollowing",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1573.002",
      "name": "Asymmetric Cryptography",
      "tactic": "command-and-control"
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1003.001",
      "name": "LSASS Memory",
      "tactic": "credential-access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "command-and-control"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "discovery"
    }
  ],
  "cisa_advisory": "AA21-209A",
  "last_updated": "2026-10-16",
  "first_seen": 2012,
  "lineage": {
    "derived_from": [
      "armitage"
    ],
    "variants": [
      "cobalt strike 3.x",
      "cobalt strike 4.0-4.9",
      "cobalt strike cracked bofs"
    ]
  },
  "attribution": [
    {
      "actor": "Universal Red Teams, APT29, APT41, FIN7, Wizard Spider, LockBit Affiliates",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2022-42948"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP",
      "DNS",
      "SMB Named Pipes"
    ],
    "ports": [
      443,
      80,
      53,
      445
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b",
      "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761"
    ],
    "delivery": [
      "phishing_attachments",
      "initial_access_brokers",
      "vulnerability_exploitation"
    ],
    "persistence": [
      "Scheduled Tasks",
      "Service Creation",
      "WMI Event Subscriptions"
    ]
  },
  "sources": [
    {
      "name": "CISA Advisory AA21-209A: APT Actors Exploiting Cobalt Strike",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a"
    },
    {
      "name": "Fortra Cobalt Strike Official Technical Documentation",
      "url": "https://www.cobaltstrike.com"
    },
    {
      "name": "MITRE ATT&CK Software Profile: Cobalt Strike (S0154)",
      "url": "https://attack.mitre.org/software/S0154/"
    }
  ],
  "containment_steps": [
    "Isolate compromised hosts from network segments immediately to prevent lateral SMB propagation.",
    "Inspect memory allocations for RWX permissions unbacked by disk binaries using Volatility or Process Hacker.",
    "Terminate spawned child processes and investigate parent-child anomalies (e.g. wmiprvse.exe spawning cmd.exe/powershell.exe).",
    "Block known C2 IP addresses and DNS domains across edge firewalls and secure web gateways."
  ],
  "what_to_avoid": [
    "Do not assume Cobalt Strike usage implies a single actor; it is widely weaponized by diverse crimeware and state-sponsored groups.",
    "Avoid relying solely on static hash detection, as Beacon loaders are re-compiled and obfuscated dynamically with unique shellcode stubs.",
    "Do not neglect internal network segmentation; unsegmented SMB ports (445) allow Beacon named pipes to bridge air-gapped systems."
  ],
  "target_industries": [
    "government",
    "defense",
    "financial_services",
    "healthcare",
    "technology",
    "energy"
  ],
  "motivation": "Adversary Simulation, Cyber Espionage, Corporate Reconnaissance & Ransomware Staging",
  "threat_actors": [
    "APT29",
    "APT41",
    "FIN7",
    "LockBit Syndicate",
    "BlackCat Syndicate"
  ],
  "target_geographies": [
    "GLOBAL",
    "US",
    "EU",
    "APAC"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "privilege-escalation",
    "defense-evasion",
    "credential-access",
    "discovery",
    "lateral-movement",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "linux"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}