Role
SOC and CTI analyst
Give every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.
Read more
Malware profile
Cobalt Strike
Also known as Cobalt Strike Beacon
Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks.
In short
Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks. CISA, the FBI and the NCSC also report attackers using it after a break-in to control machines, move across the network and take data. Its main payload is called Beacon.
- Names3names in public reportsCobalt Strike · Beacon · Team Server
- Techniques19ATT&CK techniques listedExecution · Stealth · Credential Access
- Infection Steps5in the delivery chainFirst access · Beacon placed
- Linked Groups7groups that use itAPT29 · APT40 threat group profile · APT41
In one minute
- What it is
- A commercial remote access and attack simulation tool that attackers also use after they get into a network.
- What it does
- Lets an operator run commands, steal passwords and tokens, move to other machines, and talk to a control server over HTTP, HTTPS or DNS.
- Who uses it
- Attributed by CISA and the FBI (AA21-116A, 26 April 2021) and by the NCSC (7 May 2021) to Russian SVR cyber actors. CISA and partners also report it in Ghost, Black Basta, LockBit affiliate and Ryuk activity. MITRE lists many more groups.
- How it gets in
- Placed by the attacker after a first break-in, for example through a vulnerable public-facing server and a web shell, as described in AA25-050A.
- What to do first
- Segment the network, watch and limit PowerShell, and investigate unusual admin commands, as CISA and the FBI advise in AA25-050A.
What it does
MITRE says Cobalt Strike bills itself as adversary simulation software and that its interactive post-exploit features cover the full range of ATT&CK tactics inside one system. It also uses the abilities of other well-known tools such as Metasploit and Mimikatz.
CISA calls it a commercially available tool often used to test an organization’s security controls. In the Ghost ransomware advisory, CISA and the FBI say the attackers use an unauthorized version of it and rely on Beacon and Team Servers for command and control.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Cobalt Strike | MITRE ATT&CK software S0154 and the CISA advisories[1, 2] |
| Beacon | Name of the Cobalt Strike payload, in MITRE and in CISA advisory AA25-050A[1, 2] |
| Team Server | Name of the Cobalt Strike command server, in CISA advisory AA25-050A[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Execution
Command and Scripting Interpreter: PowerShell T1059.001
It can run a payload on a remote host with PowerShell without writing data to disk. Attackers in the Ghost case used PowerShell to deploy it.[1, 2]
Windows Management Instrumentation T1047
System Services: Service Execution T1569.002
It can use PsExec or the Service Control Manager to start a payload or new services on a remote host.[1]
Stealth
Process Injection T1055
It can inject a range of payloads into processes the operator picks.[1]
Reflective Code Loading T1620
Its execute-assembly command can run a .NET program inside the memory of a sacrificial process.[1]
Obfuscated Files or Information: Indicator Removal from Tools T1027.005
It can change the Beacon payload to remove known signatures or unpacking methods.[1]
Indicator Removal: Timestomp T1070.006
It can alter file timestamps so files placed on a target blend in.[1]
Credential Access
Privilege Escalation
Lateral Movement
Discovery
Collection
Command and Control
Application Layer Protocol: Web Protocols T1071.001
It can use its own control protocol wrapped in HTTP or HTTPS. Ghost actors relied on this.[1, 2]
Application Layer Protocol: DNS T1071.004
It can use its own control protocol wrapped in DNS.[1]
Proxy: Internal Proxy T1090.001
It can pass commands along a peer-to-peer chain of infected hosts, which limits the number of exit points.[1]
Ingress Tool Transfer T1105
How it spreads
None of the sources used here describes Cobalt Strike spreading by itself. CISA and the FBI describe attackers placing it after a first break-in. In the Ghost ransomware case, attackers exploited public-facing servers, uploaded a web shell, then used PowerShell to download and run Beacon. They later used WMIC to start more Beacon infections on other systems in the same network. In Black Basta cases, CISA says affiliates used Cobalt Strike beacons to help with remote access and lateral movement.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
First access
In the Ghost ransomware advisory, attackers exploit vulnerabilities in public-facing servers, including ColdFusion, SharePoint and Exchange servers and some network appliances.[2]
Beacon placed
They upload a web shell, then use Windows Command Prompt or PowerShell to download and run Cobalt Strike Beacon.[2]
Rights and passwords
They use built-in Cobalt Strike functions to steal SYSTEM process tokens and collect password hashes.[2]
Move sideways
They use WMIC to run PowerShell on other systems, often to start more Beacon infections.[2]
Ransomware
Beacon is used to deliver the ransomware payloads. CISA says some intrusions went from first access to ransomware on the same day.[2]
Timeline
- October 28, 2020
Ryuk advisory
CISA, the FBI and HHS published AA20-302A. It says Ryuk actors commonly use commercial tools such as Cobalt Strike to steal credentials.[6]
- April 26, 2021
SVR advisory
The FBI and DHS, with CISA, published AA21-116A on Russian SVR cyber actors. It says the SVR has used Cobalt Strike.
- 7 May 2021
NCSC report on SVR
The NCSC published its joint report on further SVR tactics. It says SVR actors used Cobalt Strike after initial exploitation, including after the SolarWinds compromise.
- July 19, 2021
APT40 advisory
CISA and the FBI published AA21-200A on indicted APT40 actors. Cobalt Strike is in its list of malware.
- March 2, 2023
Royal ransomware advisory
CISA and the FBI first published AA23-061A. A later update says BlackSuit actors used legitimate penetration testing tools such as Cobalt Strike to move data out.[5]
- June 14, 2023
LockBit advisory
CISA and partners published AA23-165A. It says Cobalt Strike artifacts were seen and that LockBit affiliates may use it.[4]
- May 10, 2024
Black Basta advisory
CISA, the FBI, HHS and MS-ISAC published AA24-131A. A November 8, 2024 update added new tactics and indicators, including suspected Cobalt Strike domains.[3]
- February 19, 2025
Ghost ransomware advisory
The FBI, CISA and MS-ISAC published AA25-050A. It says Ghost actors rely heavily on Cobalt Strike Beacon and Team Servers.[2]
Who uses it
- Ransomware group 8Base 8Base is the name of a ransomware affiliate group that used the Phobos ransomware. Disrupted · Since 2019 · Ransomware affiliate group using Phobos (Phobos itself is a ransomware as a service)
- Ransomware group ALPHV / BlackCat ALPHV Blackcat is a ransomware as a service operation. Disrupted · Since 2021 · Ransomware as a service
- Threat group APT29 The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). Russia · Since 2008
- Threat group APT40 threat group profile APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. China · Since 2009
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Everest Everest is a financially motivated ransomware and data extortion group. Active · Since 2020 · Extortion group with ransomware and initial access broker activity
- Ransomware group Interlock Interlock is a ransomware group first observed in late September 2024. Active · Since 2024 · Not stated in the advisory (opportunistic and financially motivated, per the FBI)
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Threat group menuPass Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers. China · Since 2006
- Threat group Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. China · Since 2012
- Ransomware group Play Play, also called Playcrypt, is a ransomware group active since June 2022. Active · Since 2022 · Closed group (presumed, per the advisory)
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group Royal Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit. Rebranded · Since 2022 · Not stated as ransomware as a service in the sources; operated by the group itself
- Threat group Sandworm Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016 power grid attacks in Ukraine, the 2017 NotPetya attack and the 2018 Winter Olympics attack. Russia · Since 2009
- Ransomware group Vice Society Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). Since 2021 · Not stated in the advisory
Seen in
- Incident Ghostwriter (UNC1151) campaigns against Poland, 2024 to 2026 Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021. 2021 to June 2026 · Government and public sector
- Incident HSE Conti ransomware attack In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service. May 2021 · Healthcare
Detection and defense
Questions
What is Cobalt Strike?
A commercial remote access tool that MITRE says bills itself as adversary simulation software. Attackers also use it after they break in.
Is Cobalt Strike legal software?
Sources differ in wording. MITRE calls it a commercial tool and CISA calls it commercially available penetration testing software. In AA25-050A, CISA and the FBI say Ghost ransomware actors use an unauthorized version.
Which attackers use Cobalt Strike?
CISA and the FBI attribute its use to Russian SVR actors (AA21-116A) and report it in Ghost, Black Basta, Ryuk and LockBit affiliate activity. MITRE lists many more groups.
What does Beacon do?
Beacon is the Cobalt Strike payload. MITRE says it can run commands, take screenshots and talk to a control server over HTTP, HTTPS or DNS.
How do defenders respond?
CISA and the FBI advise segmenting networks, watching PowerShell, allowlisting applications and investigating unusual admin activity.
In our research
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- Agentic AI in Cybersecurity: How Autonomous Agents Are Transforming the SOC April 2026
- GC01 (Golden Chickens): Inside the Arsenal of a Premier E-Crime MaaS Provider April 2026
- What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio April 2026
- LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
- WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
Sources
- Cobalt Strike, Software S0154 MITRE ATT&CKSupports: Description, platforms, techniques and groups MITRE lists for Cobalt Strike.
- Understanding Ransomware Threat Actors: LockBit, AA23-165A CISA, FBI and partnersSupports: Cobalt Strike artifacts seen and possible use for SMB lateral movement.
- Ransomware Activity Targeting the Healthcare and Public Health Sector, AA20-302A CISA, FBI and HHSSupports: Ryuk actors commonly use Cobalt Strike to steal credentials.
- Russian Foreign Intelligence Service (SVR) Cyber Operations, AA21-116A CISA, FBI and DHSSupports: SVR cyber actors have used Cobalt Strike.
- Further TTPs associated with SVR cyber actors (PDF) NCSC UKSupports: SVR actors used Cobalt Strike after initial exploitation, 7 May 2021.
- Tactics, Techniques, and Procedures of Indicted APT40 Actors, AA21-200A CISA and FBISupports: Cobalt Strike in the APT40 malware list, July 2021.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.