Cobalt Strike

Reported Context (10)

Over the first two parts of this series, we've looked at Cobalt Strike from different angles. Part 1 walked through how exposed open directories can leak tooling, and Part 2 showed how structured HuntSQL queries help How to Hunt Cobalt Strike C2 Infrastructure with Automated Discovery
In Part 1, we showed how open directories and repeated certificates can reveal real Cobalt Strike infrastructure. In this second part, we're focusing on how to take those findings further with HuntSQLâ¢. HuntSQL Recipes Help Analysts Find and Track Cobalt Strike Infrastructure
reported that Emperor Dragonfly (Bronze Starlight) deployed a modified version of IOX alongside Cobalt Strike and a keylogger. Separately, Securonix documented IOX being used by Slow Tempest on compromised How to Detect IOX, FRP, and Rakshasa Proxy Infrastructure
The server, accessible for less than 24 hours, hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat (CS Cat). Rust Loaders Deliver Cobalt Strike Cat in Intrusions Targeting South Korean Organizations
The attacker utilizes plugins of the publicly available Cobalt Strike kit "TaoWu" for-post exploitation activities. Attackers Exploit PHP-CGI Flaw to Target Organizations in Japan

CVE (3)

Malware (10)

People (5)

Threat Actors (10)

MITRE ATT&CK (28)

Vendors (10)

Products (28)

Tools (30)

Industries (7)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.