Rare Cobalt Strike Watermark Links Seven Servers to Suspicious Infrastructure
Summary
Researchers linked seven Cobalt Strike 4.10 team servers through a rare watermark and shared configuration, finding brand-impersonating domains and extracted beacon samples. They also observed a separate, unexplained cluster using watermark 1.
Key points
- Seven servers running Cobalt Strike 4.10 shared watermark 688983459, a public key, and configuration similarities.
- The servers used port 80 and were hosted primarily on Amazon infrastructure, with one on Microsoft’s network.
- Associated domains impersonated brands and organizations, potentially to blend into traffic or deceive users.
- Researchers extracted beacon samples and published their SHA-256 hashes for further analysis.
- A separate cluster used watermark 1, historically associated with cracked or leaked Cobalt Strike; researchers could not establish its intent or a link to FinSpy.
Article Details
- Attack Vectors
- The article reports Cobalt Strike 4.10 team servers with beacon configurations and payloads, describing the infrastructure as suspicious.
- Domains associated with the team servers impersonate well-known brands and may be intended for phishing or to blend in with network traffic; the article presents this as a possibility.
- Defensive Notes
- Monitor for Cobalt Strike team servers using rare or commonly used watermarks, including watermark 688983459 and watermark 1.
- Use shared configurations, ports, SSH keys, certificates, and other associations to identify related infrastructure.
- Analyze extracted beacon samples to develop detection signatures and investigate possible related infrastructure; the article cautions that team servers may serve benign files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]toptechmanagementgroup[.]com | Resolving domain associated with a team server in the suspicious cluster. |
| DOMAIN | dev-monitor[.]upsideapp[.]com | Resolving domain associated with a team server in the suspicious cluster. |
| DOMAIN | downloads[.]abyanfinancial[.]com | Domain listed in a beacon configuration for a team server in the suspicious cluster. |
| DOMAIN | downloads[.]helpsdeskmicrosoft[.]com | Domain listed in a beacon configuration for the suspicious cluster and described as impersonating a legitimate organization. |
| DOMAIN | downloads[.]my-icecream[.]com | Domain listed in a beacon configuration for a team server in the suspicious cluster. |
| DOMAIN | downloads[.]toptechmanagementgroup[.]com | Domain resolving to, and configured for, a team server in the suspicious cluster. |
| DOMAIN | downloads[.]uscga[.]co | Domain resolving to, and configured for, a team server in the suspicious cluster. |
| DOMAIN | public[.]open-dns[.]uk | Domain resolving to a team server in the suspicious cluster and described as impersonating a legitimate organization. |
| DOMAIN | yourcoupons[.]net | Domain used in a beacon endpoint configured for the suspicious team server cluster. |
| IPV4 | 184[.]72[.]118[.]160 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 184[.]73[.]81[.]49 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 34[.]238[.]135[.]169 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 44[.]203[.]181[.]185 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 52[.]205[.]213[.]5 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 52[.]91[.]17[.]36 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| IPV4 | 74[.]235[.]246[.]236 | Team server in the suspicious infrastructure cluster using watermark 688983459. |
| SHA256 | 889e4f388ac6fd9d5f1025ed32276eb0fef2717c8d387fb82d5a8438bbe6025e | Hash of a payload extracted from a team server in the suspicious cluster; the article notes that served files may be benign. |
| SHA256 | a2ed422d92f5963468c9e3c615754dc7e31acd51b7372386d7694747bc2d9897 | Hash of a payload extracted from a team server in the suspicious cluster; the article notes that served files may be benign. |
| SHA256 | ae352f86b470dfa999f3d50394876209d19bc06af2e246758f150f55eaa2a787 | Hash of a payload extracted from a team server in the suspicious cluster; the article notes that served files may be benign. |
| SHA256 | d884ccc9aa3b1d1a018d7cb4a1d80da7142e934178ef0fc6faff7b1f1f7fa6c1 | Hash of a payload extracted from a team server in the suspicious cluster; the article notes that served files may be benign. |
| SHA256 | e2a82f971d011675ad387beb2ef943824b2e62e3aab5f9ef79516c11693a6636 | Hash of a payload extracted from a team server in the suspicious cluster; the article notes that served files may be benign. |
| URL | hxxp[:]//downloads[.]yourcoupons[.]net/jquery-3.3.1.min.js | Beacon endpoint configured for the suspicious team server cluster. |