Cobaltstrike

CobaltStrike is a type of malware, or malicious software, that infiltrates systems to exploit and damage them. It can gain access via suspicious downloads, emails, or websites and then steal personal information, disrupt operations, or hold data for ransom. CobaltStrike has been observed in conjunction with various other malware such as IcedID, Qakbot, BazarLoader, Conti, Gozi, Trickbot, Quantum, Emotet, and Royal Ransomware. It operates by launching backdoor components, providing unauthorized remote access to the infected system. In recent years, there have been significant developments involving CobaltStrike. The threat group Earth Baku added two new loaders, CobaltStrike and SneakCross (also known as MoonWalk), to its arsenal. These loaders were used to launch backdoor components, further enhancing the group's cyber-attack capabilities. Additionally, infected versions of text editors VNote and Notepad were discovered containing a CobaltStrike agent loader, demonstrating the malware's ability to infiltrate and compromise commonly used applications. The CobaltStrike malware has also been linked to Linux and macOS-targeted apps carrying backdoors for unauthorized remote access, resembling the Geacon project. This similarity suggests that CobaltStrike may share common features or origins with the open-source implementation of the Geacon agent written in Go. In a notable incident involving the banking Trojan IcedID, a variant infection was identified with BackConnect, Anubis VNC, CobaltStrike, and ConnectWise ScreenConnect. After initial infection, "hands on the keyboard" activity was detected approximately 95 minutes later, indicating rapid escalation and exploitation following infiltration.