Cobalt Strike

Reported Context (4)

Remcos RAT, AsyncRAT, Quasar RAT, Cobalt Strike CYFIRMA Report: Persistent Espionage and Identity Attacks Target India’s Government and Defence Sector
In June 2026, StrikeShark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively Exploited
Over the first two parts of this series, we've looked at Cobalt Strike from different angles. Part 1 walked through how exposed open directories can leak tooling, and Part 2 showed how structured HuntSQL queries help How to Hunt Cobalt Strike C2 Infrastructure with Automated Discovery
"malware_name": "Cobalt Strike", Hunt.io Adds IOC Feed and Threat-Actor Attribution to C2 Data

CVE (56)

Malware (21)

Threat Actors (14)

Vendors (27)

Products (69)

Tools (6)

Industries (4)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.