Collaborate Disseminate
Cobalt Strike 3.13 is now available. This release adds a TCP Beacon, process argument spoofing, and extends the Obfuscate and Sleep capability to the SMB and TCP Beacons. TCP Beacon Cobalt Strike has long had the ability to pivot over named pipes. Cobalt Strike 3.13 expands this peer-to-peer pivoting model with the TCP Beacon. Now, […] Continue reading Cobalt Strike 3.13 – Why do we argue?
The group is best-known for hacking the DNC ahead of the 2016 presidential election. Continue reading APT29 Re-Emerges After 2 Years with Widespread Espionage Campaign
Cobalt Strike 3.12 is now available. This release adds an “obfuscate and sleep” in-memory evasion feature, gives operators [some] control over process injection, and introduces hooks to shape how Beacon launches PowerShell. Obfuscate and Sleep One method to find adversary presence in an environment is to sweep all running processes for common strings that indicate […] Continue reading Cobalt Strike 3.12 – Blink and you’ll miss it
Three members of one of the world’s largest cybercrime organizations that stole over a billion euros from banks across the world over the last five years have been indicted and charged with 26 felony counts, the Justice Department announced on Wednesda… Continue reading 3 Carbanak (FIN7) Hackers Charged With Stealing 15 Million Credit Cards
Cobalt Strike’s process to inject shellcode, via PowerShell, does not work with the latest Windows 10 update (v1803). While it’s possible to work without this capability, a lot of CS automation uses PowerShell. I’ve pushed an out-of-band update to Cobalt Strike 3.11 with a fix for this issue. What happened? The PowerShell shellcode injection scripts […] Continue reading PowerShell Shellcode Injection on Win 10 (v1803)
Cobalt Strike 3.11 is now available. This release adds to Cobalt Strike’s in-memory threat emulation and evasion capabilities, adds a means to run .NET executable assemblies without touching disk, and implements the Token Duplication UAC bypass attack. In-Memory Threat Emulation One of the things that makes Cobalt Strike different is its ability to emulate multiple […] Continue reading Cobalt Strike 3.11 – The snake that eats its tail
Spanish Police has arrested the alleged leader of an organised Russian cybercrime gang behind the Carbanak and Cobalt malware attacks, which stole over a billion euros from banks worldwide since 2013.
In a coordinated operation with law enforcement ag… Continue reading Leader of Hacking Group Who Stole $1 Billion From Banks Arrested In Spain
I often receive emails that ask about slow file downloads with the Beacon payload. Here are the symptoms: It takes multiple hours to grab a few megabytes The sleep time makes no difference File uploads are fast and not affected by this “slowness” When I get these emails, I usually ask the user about their […] Continue reading Beware of Slow Downloads
Cobalt Strike 3.10 is now available. This release adds Unicode support to the Beacon payload, introduces a built-in report based on MITRE’s ATT&CK matrix, and performs endodontics on the Beacon payload. A Strategy for Unicode One of Cobalt Strike’s limitations is its ham-fisted handling of text. Cobalt Strike treats everything sent to and received from […]
Continue reading Cobalt Strike 3.10 – Хакер vs. 肉雞
A recently disclosed severe 17-year-old vulnerability in Microsoft Office that lets hackers install malware on targeted computers without user interaction is now being exploited in the wild to distribute a backdoor malware.
First spotted by researcher… Continue reading Hackers Exploit Recently Disclosed Microsoft Office Bug to Backdoor PCs