It is a classic movie theme: a weapon of great power or mass destruction falls into the wrong hands. Many a James Bond film has used that script and it has proved to be a winning one. Unfortunately, it has also become a common script when it comes to cybersecurity in which hackers and financially backed cybercriminal organizations are using white hacker tools to perform their own malicious deeds. Unlike the movies however, in this case, the bad guys often win.

What is Cobalt Strike?

Cobalt Strike is a commercial penetration testing and threat emulation software tool intended for white hackers, red teams, and cybersecurity professionals. It is designed to simulate advanced threat strategies to help organizations assess their own defenses. First released in 2012, it is available from Fortra, who continues to release new versions with expanded feature sets and updates that allow it to adapt to new tactics, techniques, and procedures (TTPs) observed in real-world threats.

There are two components of the Cobalt Strike framework. One is the main software that offers user-facing functionalities to manage and execute red team operations. This is installed on the operator’s primary machine. The other component is the Cobalt Strike Team Server which functions as the command-and-control center for Cobalt Strike’s operations. This server is set up on a remote machine, usually in the cloud so that it is reachable by all targeted networks. The server performs things such as payload generation, communication management, and logging functions.

The Beacon

The primary goal for threat actors is not just breaching a network or gaining access to a host. It’s setting up a long-term foothold. They aim to create a command-and-control center (C2) within the infiltrated system to perform reconnaissance and launch subsequent attacks. Cobalt Strike’s hallmark payload, “The Beacon,” facilitates this by establishing an evasive backdoor. This allows both ethical hackers and malicious actors to retain access and conduct prolonged operations. Because the Beacon operates primarily within system memory it is hard to detect. Through asynchronous communication over HTTPS and other C2 protocols, it enables remote attackers to deliver malware, execute commands and upload files.

The Simplicity of Cobalt Strike

Cobalt Strike is licensed on a per-user basis, and it is not cheap. Despite its steep price point, it also delivers a lot of value which is why it has proven so popular in the security community. One of its appreciated features is that despite its sophistication and extensive feature set, it is designed to be user-friendly and simple to operate. Other appreciated qualities include:

• Unlike other tools that are command-line-only, Cobalt Strike offers a graphical interface that also provides a comprehensive view of the compromised environment.

• It allows multiple operators to access the same compromised host which allows for collaborative penetration testing for red teams.

• The software includes a comprehensive set of post-exploitation tools that enables users to perform lateral movements and elevate privileges after the initial host breach.

• There is a lot of available documentation, training, and community support for Cobalt Strike to help new users get started and veteran users to attain deeper knowledge.

Works for Friend or Foe

Cobalt Strike embodies the age-old adage: “A double-edged sword.” Of course, Cobalt Strike is one amongst a long list of tools and applications of good intentions that have been adapted for nefarious reasons. For instance, Windows RDP emerged as a ‘go-to’ tool for businesses transitioning to remote work during the onset of the coronavirus pandemic, only to become a lucrative avenue for hackers to exploit to seek remote access.

Like RDP, COVID catapulted the use of Cobalt amongst the black hat community and its use in cyberattacks shot up 161% in 2020. Cobalt Strike, it turns out, is equally well suited for both friend and foe and underscores the recurring theme of legitimate tools and platforms being repurposed for malicious intent. According to a 2022 report, Cobalt Strike team servers were the most widely used form of command and control (C2) infrastructure in 2021. Another threat report concerning the 4^th quarter of 2022, shows that Cobalt Strike was the most prevalent malicious tool used by ransomware groups during that time window. It was also the second most popular tool used in reported nation-state attack campaigns during that time as well, with one-half of the detected servers hosted in China.

Purchase Restrictions

The widespread use of Cobalt Strike among malicious hackers isn’t directly Fortra’s fault. The company does have restrictions in place to limit the distribution of its attack emulation software to security professionals only. So how do malicious actors obtain it? In many cases, the same way they get access to the personally identifiable information of millions of people every year. They steal it. Malicious parties post cash rewards on the dark web for copies of the newest releases. Notably, many Cobalt Strike servers run on outdated versions with cracked licenses, a hallmark sign of ill-intended use.

Why Cobalt Strike is Hard to Stop

The thing to remember is that these threat actors aren’t using Cobalt Strike to infiltrate your organization to satisfy their curiosity. For them, it is a business, and it is all about the money. They don’t care about your business and the damage they will cause to it by their attack. For them, it is just another day at the office. Because of its ease of use and user-friendly interface, even less technically advanced criminals can make quick use of it and put it to work and make a buck.

This means that you need a way to stop Cobalt Strike attacks. As mentioned previously, the Beacon operates mostly within memory, making this stealthy tool difficult to detect. Because of its ease of adaptability, it can be modified to suit specific needs and evade detection from conventional security solutions. Cobalt Strike can also be integrated with other popular hacking tools, thus increasing its capabilities, and making it a central component of many cyber-attack toolkits.

For businesses that lack the skillsets to stop elaborate Cobalt Strike attacks, a security operations center (SOC) can be a great option. Backed by their own processes and tools, SOC teams consist of highly trained and experienced cybersecurity professionals who often have firsthand experience working with tools such as Cobalt Strike. This gives them the innate ability to recognize these types of attacks and properly mitigate them.

Conclusion

Ironically, some of the same organizations that employ Cobalt Strike for legitimate defenses sometimes find themselves fending off malicious actors using the same tool. While it is easy to scorn Cobalt Strike’s existence, the software performs a valuable service to those who legitimately purchase it. Perhaps the adage, “There are two sides to every coin” can be applied in this situation as one needs to consider all aspects before making a judgment or decision.