Loading malware…
Cobalt Strike is a commercial adversary-emulation and red-team framework that is also extensively abused by cybercriminals, initial access brokers, ransomware affiliates, and cyberespionage groups. Its Beacon implant provides command-and-control access to compromised systems through infrastructure managed by a Team Server. Although intended for authorized security testing, leaked and cracked versions have facilitated malicious adoption.
Beacon supports post-exploitation activity including credential dumping, network reconnaissance, reflective DLL injection, deployment of additional payloads, and lateral movement. It can inject a job into Windows Local Security Authority process memory to recover password hashes and use native Windows network-enumeration APIs to discover systems in Active Directory environments. Beacon Object Files extend its functionality with additional in-process modules. HTTP(S) and DNS command-and-control communications, together with customizable Malleable C2 profiles, allow operators to alter network indicators and traffic formatting. Attackers also use Beacon to maintain access after an initial compromise.
Malicious deployments include phishing and malicious-spam campaigns, including messages impersonating Microsoft updates, as well as delivery through existing infections such as QakBot and Brute Ratel. Cobalt Strike has been used by Earth Estries and Earth Preta, and in operations associated with Black Basta and ALPHA SPIDER affiliates. Observed targets include government and technology organizations and corporate networks targeted for ransomware. Windows is a principal implant platform; Linux variants have also been used by ransomware affiliates to reconnoiter VMware ESXi infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
38 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
React patched CVE-2025-55182 on December 3: "a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints". The report documents malicious scanning and compromised servers receiving cryptominers.
Next.js released a security advisory for CVE-2025-66478, rated CVSS 10.0, because it uses the affected React packages. The report identifies affected Next.js versions and documents reconnaissance and remote command execution against a vulnerable Next.js application.
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.
In the incidents we investigated, the threat actor exploited the vulnerability (designated CVE-2019-18935) to deliver a Cobalt Strike beacon (in the form of a DLL payload) to disk.
OPERA1ER executed Invoke-EternalBlue command via Cobalt Strike framework. This command utilizes security issues patched by MS17-010 ... in 2021 these exploits are still relevant and the operator uses that way commonly.
Also known as Log4Shell, the vulnerability is now being used by threat actors linked to governments in China, Iran, North Korea, and Turkey, as well as access brokers used by ransomware gangs.
Запуск файла приводит к эксплуатации уязвимости CVE-2017-11882, которая позволяет злоумышленнику исполнить произвольный код с привилегиями пользователя, открывшего файл.
The Beacon has also been used in combination with exploits like CVE-2021-40444 and CVE-2022-30190 (Follina).
2024년 5월 HFS의 원격 코드 실행 취약점인 CVE-2024-23692가 공개되었으며 이를 활용할 경우 공격자는 HFS에 명령이 포함된 패킷을 전송하여 HFS가 악성 명령을 실행하도록 할 수 있다.
CVE-2023-46604 allows remote attackers with network access to a broker to execute arbitrary shell commands. This is achieved by exploiting serialized class types within the OpenWire protocol, which, in turn, leads to the broker instantiating any class available on the classpath.
The operation is using CVE-2017-8570 as the initial vector. The PPSX file includes a remote relationship to an external OLE object; the “script:” prefix before the HTTPS URL indicates use of this vulnerability.
The Beacon has also been used in combination with exploits like CVE-2021-40444 and CVE-2022-30190 (Follina).
CVE-2023-38831 is a vulnerability that enables malicious actors to execute arbitrary code when a user tries to access a harmless file contained within a ZIP archive.
从远程服务器下载89.0.4389.114版本的chrome浏览器,并且以无沙箱的方式启动chrome访问带有CVE-2021-21220漏洞触发页面……经过分析shellcode为Cobalt Strike远控。
Another similar attack from the InkySquid group (aka APT37, Reaper or ScarCruft) leveraged CVE-2021-26411 to attack Internet Explorer as well as legacy versions of Microsoft Edge, according to Volexity.
“MSTIC has observed activity by the nation-state actor MERCURY using the CVE-2020-1472 exploit (Zerologon) in active campaigns over the last 2 weeks,” according to Microsoft.
The threat actors successfully uploaded a WAR archive that housed a WebShell and various payloads into the webroot of the SysAid Tomcat web service by exploiting the SysAid CVE-2023-47246 Path Traversal vulnerability. | SysAid found supporting evidence indicating the utilization of the following PowerShell command to download and execute CobaltStrike.
An attacker “leveraged an older vulnerability for SharePoint (CVE-2019-0604) to exploit remotely unpatched servers” and implant a web shell, then deployed a Cobalt Strike-based payload and targeted domain controllers using Zerologon.
The script in question was originally invoked as remote code execution (RCE) during suspected CVE-2024-50623 exploitation.
“Cobalt Strike is adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.”
The second, which ran from September 20 to 21, used an exploit for CVE-2017-8759 (patched last September), a code injection/remote code execution vulnerability in Microsoft’s .NET Framework. The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled. | The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled.
The attackers have been leveraging a Cityworks RCE vulnerability (CVE-2025-0994) to get access to the targeted environments and perform the initial reconnaissance.
We observed vulnerability CVE-2022-29464 being exploited in the wild since April, allowing unrestricted file uploads resulting to arbitrary remote code execution (RCE). | “Cobalt Strike beacons were also observed in both Linux and Windows environments. Since there is no official beacon provided for Linux, the compatible one we observed would have been prepared by the threat actor.”
The code, which the attackers camouflage around real content, is consistent with Internet Explorer bug CVE-2020-1380, the report said.
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”). Base CVSS score of 8.4, still considered “High Priority”.
The report lists CVE-2011-4085 among the vulnerabilities highly likely exploited through JexBoss and describes it as a regression of CVE-2010-0738.
On April 19, 2023, PaperCut updated its advisory to report exploitation of CVE-2023-27350 in the wild. Sophos observed an affected customer as early as April 13, with Cobalt Strike detected during post-exploitation activity.
CVE-2015-7501 is identified as a deserialization vulnerability affecting Java environments using Apache Commons Collections, including JBoss-based environments, and as highly likely exploited through JexBoss.
In the first attack that Sophos analyzed, the threat actor exploited ProxyShell vulnerabilities in Exchange Server for remote access into a media organization in North America and deployed Cobalt Strike beacons.
ChamelGang used a known chain of vulnerabilities in Microsoft Exchange called ProxyShell—CVE-2021-34473, CVE-2021-34523, CVE-2021-31207—to compromise network nodes and gain a foothold.
CVE-2024-1709 (CWE-288) — Authentication Bypass Using Alternate Path or Channel. Base CVSS score of 10, indicating “Critical”.
Since January 2025, an unidentified threat actor has been targeting organizations in Japan by exploiting CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation on Windows, to gain initial access.
The CSIRT considers it highly probable that JexBoss exploited CVE-2010-0738, an improper-access-control vulnerability affecting the exposed JBoss JMX console through version 5.1.x.
ChamelGang used a known chain of vulnerabilities in Microsoft Exchange called ProxyShell—CVE-2021-34473, CVE-2021-34523, CVE-2021-31207—to compromise network nodes and gain a foothold.
The report identifies CVE-2017-12149 as remote code execution via deserialization involving JMXInvokerServlet and records numerous HTTP GET and POST requests to /invoker/JMXInvokerServlet.
The document provides insight into the usage (misuse) of Cobalt Strike, a legitimate post exploitation tool used by red teams.
“More recently, Earth Lamia also exploited CVE-2025-31324 (SAP NetWeaver Visual Composer unauthenticated file upload vulnerability).” The attribution discussion connects exploitation campaigns to Cobalt Strike infrastructure and a VShell deployment involving the SNOWLIGHT stager.
Три команды внутренней разведки и передачи данных были запущены в результате эксплуатации уязвимости в SharePoint CVE-2021-27076 после загрузки Cobalt Strike; инфраструктурный IP ранее связывался другими исследователями с группировкой Thor. | Hacking Cat used Cobalt Strike before Gorilla RAT. Cobalt Strike C2 infrastructure also appeared alongside Monkey Ransomware, and several associated commands were launched following exploitation of SharePoint CVE-2021-27076.
68 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The actor’s C2 infrastructure hosted commodity Cobalt Strike tooling alongside its bespoke reverse-shell payloads.”
By installing Cobalt Strike on the system, the actors behind Earth Estries were able to deploy more pieces of malware and perform lateral movement.
Observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.
Earth Preta is a cyberespionage group known to develop their own loaders in combination with existing tools like PlugX and Cobalt Strike for compromise.
Observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.
The report lists Cobalt Strike among penetration-testing/red-team frameworks observed in Shedding Zmiy activity.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
SYSTEM cmd.exe /c "powershell -NonInteractive -EncodedCommand <base64_data>"
Used WMIC to invoke PowerShell to download a file named 01.css and 02.css ... Behavioral detections such as Exec_27a (Mitre ATT&CK T1059.001).
%windir%\system32\cmd.exe /c start rundll32.exe mkl2n.dll,kXlNkCKgFC
Defensive Evasion T1027.002 Software Packing Unpacked the Cobalt Beacon using CryptDecrypt
ImagingDevices.exe was launched via WmiPrivse.exe and a Meterpreter agent was injected into the process.
Upon clicking the file, it launches an LNK file by using Mshta.exe utility that leads to the execution of the HTA file.
CL0P actors use Cobalt Strike to expand network access after gaining access to the Active Directory (AD) servers.
The loader attempts to terminate the parent process (anti-debugging), iterating over running processes and looking for itself.
System utilities used for discovery included: ... systeminfo
Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement
Lateral movement was then performed over SMB, to transfer a Cobalt Strike Beacon DLL’s to other workstation’s C$\ProgramData\.
Cyber threat actors use cobalt strike to authenticate valid accounts.
Cyber threat actors use cobalt strike to hijack remote sessions using SSH and RDP hijacking methods.
The attacker uses Chisel (SOCKS5 proxy connection on a secure channel like http/ssh, tunneling traffic through firewall for hidden communication) with Cobalt Strike.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Konni actors start downloading a final payload by contacting its C2 server.
4,129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of a command-and-control implant that red teamers may deploy as shellcode. The article discusses maze-based shellcode concealment but does not demonstrate the technique using Cobalt Strike.
Cobalt Strike Beacons connect to Team Servers for command and control. The article describes a public corpus collected from internet-facing servers between July 2018 and September 2026, including raw payloads and parsed configurations. Observed Team Servers had a median first-to-last-sighting span of 14 days. Collection depends on exposed beacon staging, so it captures only part of the infrastructure landscape. The article does not establish that every observed deployment is malicious and proposes distinguishing red-team from criminal infrastructure.
Offensive security tool observed deployed alongside exploitation attributed to the Qilin and Settra ransomware operations. The content does not specify its particular functions in these attacks.
Offensive tool deployed by QakBot operators to provide interactive network access. The article also recommends hunting for its beacons during investigation of loader infections.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.