Open Directory Exposes Cobalt Strike, Phishing and Browser Credential Tools
Summary
Researchers found an open directory containing Cobalt Strike 4.2, exploit payloads, Goblin phishing-tool configuration, and browser password-stealing utilities. The intended targets and malicious use of the tools remain unconfirmed.
Key points
- The directory was hosted at 199.187.25[.]57:8899 and contained Cobalt Strike 4.2, command logs, Meterpreter, web shells, and payloads targeting older vulnerabilities.
- The Cobalt Strike beacon watermark was associated with 15 other servers; a related TLS certificate was also observed on one other IP.
- Goblin configuration proxied traffic through yunxiao[.]com and laoshanedu.cn, but researchers found no injected JavaScript or identifiable phishing targets.
- The directory contained BrowserGhost and HackBrowserData, tools capable of extracting browser-stored passwords and other sensitive information.
- Researchers said the tools could support legitimate red-team exercises or malicious activity; the operator's purpose and any actual victims were not established.
Article Details
- Attack Vectors
- An open directory exposed Cobalt Strike 4.2, exploit code targeting CVE-2014-4113 and CVE-2020-0796, Meterpreter, and web shell payloads.
- The Goblin configuration proxied traffic through yunxiao[.]com and laoshanedu[.]cn; the article says the purpose was unclear and found no injected JavaScript or identifiable phishing targets.
- BrowserGhost and HackBrowserData were present in the directory and are described as tools for extracting stored browser passwords or other sensitive browser information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | blog[.]kjdfklha[.]top | Domain listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| DOMAIN | cbshscs[.]comtom[.]cn | Domain listed for an IP sharing the Cobalt Strike TLS certificate. |
| DOMAIN | dn2ufncur4f3f[.]shop | Domain listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| DOMAIN | file[.]cbshscs[.]comtom[.]cn | Domain listed for an IP sharing the Cobalt Strike TLS certificate. |
| DOMAIN | kjdfklha[.]top | Domain listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| DOMAIN | laoshanedu[.]cn | Domain configured as a Goblin traffic proxy; the article says it may be a plausible cover but its purpose was unclear. |
| DOMAIN | ns1[.]kjdfklha[.]top | Domain listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| DOMAIN | ns2[.]kjdfklha[.]top | Domain listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| DOMAIN | tbc[.]cbshscs[.]comtom[.]cn | Domain listed for an IP sharing the Cobalt Strike TLS certificate. |
| HOSTNAME | src[.]idvfecx[.]qiniudns[.]com | Hostname listed in the threat-infrastructure table for an IP sharing the Cobalt Strike watermark. |
| IPV4 | 1[.]117[.]72[.]154 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 1[.]15[.]247[.]249 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 101[.]132[.]182[.]180 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 101[.]43[.]157[.]20 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 106[.]15[.]40[.]123 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 106[.]52[.]236[.]88 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 111[.]231[.]140[.]197 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 117[.]72[.]10[.]22 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 119[.]3[.]153[.]81 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 124[.]221[.]167[.]192 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 199[.]187[.]25[.]57 | IP hosting the exposed open directory containing the described security tools and payloads. |
| IPV4 | 27[.]102[.]118[.]70 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 39[.]98[.]196[.]145 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 43[.]134[.]183[.]43 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| IPV4 | 47[.]108[.]74[.]30 | IP reported to have shared the Cobalt Strike TLS certificate with the open-directory server. |
| IPV4 | 94[.]74[.]105[.]131 | IP listed as sharing the Cobalt Strike watermark 1359593325. |
| SHA256 | dfa9b3e8b5e0f229ecb2fb479544650d0b87eb8494ce176714cf4e53dbafd687 | SHA-256 hash of the Cobalt Strike TLS certificate observed on the open-directory server and a second IP. |
MITRE ATT&CK
CVE
CVE-2014-4113Nested within the cs4.2 folder were additional payloads targeting historical vulnerabilities like CVE-2014-4113 and CVE-2020-0796, Meterpreter, and web shell payloads-evidence of a comprehensive toolkit geared towardsCVE-2020-0796the cs4.2 folder were additional payloads targeting historical vulnerabilities like CVE-2014-4113 and CVE-2020-0796, Meterpreter, and web shell payloads-evidence of a comprehensive toolkit geared towards exploitation
Tools
BrowserGhosta recent open directory discovery offers a curious combination of tools-Cobalt Strike, Goblin, and BrowserGhost. These names may evoke a playful twist, but each represents serious capabilities often leveraged byCobalt StrikeIn the spirit of Halloween, a recent open directory discovery offers a curious combination of tools-Cobalt Strike, Goblin, and BrowserGhost. These names may evoke a playful twist, but each represents seriousGoblinof Halloween, a recent open directory discovery offers a curious combination of tools-Cobalt Strike, Goblin, and BrowserGhost. These names may evoke a playful twist, but each represents serious capabilities oftenHackBrowserDataScreenshot of the BrowserGhost README in GitHubAlongside BrowserGhost, the directory also contained HackBrowserData, a tool specifically built to extract and decrypt sensitive browser information. This combination ofMeterpreterwere additional payloads targeting historical vulnerabilities like CVE-2014-4113 and CVE-2020-0796, Meterpreter, and web shell payloads-evidence of a comprehensive toolkit geared towards exploitation and persistence.