Google Identifies 34 Cracked Versions of Popular Cobalt Strike Hacking Toolkit in the Wild

Google Cloud last week disclosed that it identified 34 different
hacked release versions of the Cobalt Strike tool in the wild, the
earliest of which shipped^[1]
in November 2012.

The versions, spanning 1.44 to 4.7, add up to a total of 275
unique JAR files, according to findings from the Google Cloud
Threat Intelligence (GCTI) team. The latest version^[2]
of Cobalt Strike is version 4.7.2.

Cobalt Strike, developed by Fortra^[3]
(née HelpSystems), is a popular adversarial framework used by red
teams to simulate attack scenarios and test the resilience of their
cyber defenses.

It comprises a Team Server that acts as the command-and-control
(C2) hub to remotely commandeer infected devices and a stager
that’s designed to deliver a next-stage payload called the Beacon,
a fully-featured implant that reports back to the C2 server.

Given its wide-ranging suite of features, unauthorized versions
of the software have been increasingly^[4]
weaponized^[5]
by many^[6]
a threat^[7]
actor^[8]
to advance^[9]
their post-exploitation^[10] activities^[11].

“While the intention of Cobalt Strike is to emulate a real cyber
threat, malicious actors have latched on to its capabilities, and
use it as a robust tool for lateral movement in their victim’s
network as part of their second-stage attack payload,” Greg
Sinclair, a reverse engineer at Google’s Chronicle subsidiary,
said^[12].

In a bid to tackle this abuse, GCTI has released a set of
open source YARA Rules^[13] to flag different
variants of the software used by malicious hacking groups.

The idea is to “excise the bad versions while leaving the
legitimate ones untouched,” Sinclair said, adding “our intention is
to move the tool back to the domain of legitimate red teams and
make it harder for bad guys to abuse.”