Technology and tools
What is Cobalt Strike?
A commercial red team tool for simulating attackers. Cracked copies are widely abused by real criminals and state groups for command and control.
Cobalt Strike is a commercial adversary simulation tool used by penetration testers and red teams. Its implant, called Beacon, provides command and control, lateral movement, credential theft and more, all highly configurable.
Cracked and leaked versions have been widely used by ransomware affiliates and state groups. Because so many attackers use it, defenders have built extensive detections for its default settings, network patterns and in-memory artefacts.