Cobalt Strike

Cobalt Strike is a commercial adversary simulation platform created by Raphael Mudge in 2012 and acquired by Fortra (formerly HelpSystems) in 2020. Licensed at roughly $5,900/year per operator, it's designed for red team engagements. Cracked copies have circulated since at least 2015, and by 2021 commodity crimeware operators were using it more than APT groups -- Proofpoint documented a 161% increase in malicious use between 2019 and 2020.

The platform deploys an implant called Beacon that communicates with a Linux-based Team Server. Beacon supports C2 over HTTP, HTTPS, DNS, SMB named pipes, and raw TCP, with configurable sleep intervals and jitter. Malleable C2 profiles let operators reshape all network indicators to mimic legitimate traffic like jQuery CDN requests or cloud API calls. Encryption uses RSA for initial key exchange and AES-256 for session traffic.

Post-exploitation capabilities cover most of the ATT&CK lifecycle: shellcode injection, built-in Mimikatz for credential dumping, Kerberos ticket manipulation, lateral movement via PsExec/WMI/WinRM, port scanning, and Beacon Object Files (BOFs) for in-process extension without spawning new processes. The sleep mask feature encrypts Beacon in memory between callbacks.

Cobalt Strike is used across the full range of threat actors. APT29 deployed custom Beacon loaders in the SolarWinds campaign. APT41 uses it as a first-stage payload in mixed espionage and financial operations. FIN7 and ransomware groups including Conti, LockBit, and BlackBasta rely on it for post-exploitation and lateral movement before encryption.

Law enforcement has pushed back hard. In 2023, Microsoft, Fortra, and Health-ISAC obtained a court order to seize infrastructure hosting cracked copies. Operation Morpheus in June 2024, led by the UK NCA and Europol across 7 countries, took down 593 servers in one week. Fortra reports an 80% reduction in unauthorized copies as of 2024.