The UK’s National Crime Agency (NCA) has lead a coordinated global action against illegal versions of Cobalt Strike used by cyber-criminals to conduct attacks.

Unlicensed versions of the software, a penetration testing tool used to check for vulnerabilities in a company’s network and help improve cybersecurity, have been used by threat-actors for over a decade to infiltrate victim’s IT systems and conduct attacks.

The NCA targeted these illegal versions in a week of action beginning at the end of last month (24 June).

Since the mid 2010’s pirated and unlicensed versions of the software downloaded by criminals from illegal marketplaces and the dark web have gained a reputation as the ‘go-to’ network intrusion tool for those seeking to build a cyber-attack, allowing them to deploy ransomware at speed and at scale.

Due to the range of tools, free training guides and videos that come with legal versions of the software, those adopting it for criminal use require low levels of sophistication and money.

This disruption activity represents more than two-and-a-half years of NCA-led international law enforcement and private industry collaboration to identify, monitor, and denigrate its use.

Action was taken against 690 individual instances of malicious Cobalt Strike software located at 129 internet service providers in 27 countries. By the end of the week, 593 of these addresses had been taken down.

This was achieved through the NCA and law enforcement partners taking down servers and amplified by ‘abuse notifications’ from law enforcement and private industry partners, highlighting to service providers that they may be hosting malware.

Some of the biggest cyber incidents in recent times have used Cobalt Strike, and the software has also been identified in multiple malware and ransomware investigations including those into RYUK, Trickbot, and Conti attacks.

The takedown operation was jointly conducted with Europol, the FBI, Australian Federal Police, Royal Canadian Mounted Police, German Federal Criminal Police Office (Bundeskriminalamt), Netherlands National Police (Politie) and the Polish Central Cybercrime Bureau.

A number of private industry partners, including BAE Systems Digital Intelligence, Trellix, Shadowserver, Spamhaus and Abuse CH also supported law enforcement in identifying malicious instances and use of Cobalt Strike by cybercriminals.

Private sector organisations shared real-time threat intelligence with law enforcement via a platform called the Malware Information Sharing Platform. More than 730 pieces of threat intelligence containing almost 1.2 million indicators of compromise were shared.

Cyber-criminals deploy unlicensed versions of Cobalt Strike via spear phishing or spam emails, which attempt to get a target to click on links or open malicious attachments.

Recommended

• ‘Hostile States’ Using Cybercriminal Groups as Proxies, NCA Warns
• Edinburgh and Glasgow See Online Piracy Police Raids
• Revealed: Bank Customers Facing the Most Fraud

When a victim opens the link or document, a Cobalt Strike ‘Beacon’ is installed giving the threat actor remote access, enabling them to profile the infected host, download malware or ransomware and steal data to then extort the victim.

“Although Cobalt Strike is a legitimate piece of software, sadly cybercriminals have exploited its use for nefarious purposes,” director of threat leadership at the NCA, Paul Foster, said.

“Illegal versions of it have helped lower the barrier of entry into cybercrime, making it easier for online criminals to unleash damaging ransomware and malware attacks with little or no technical expertise.

“Such attacks can cost companies millions in terms of losses and recovery.

“International disruptions like these are the most effective way to degrade the most harmful cyber criminals, by removing the tools and services which underpin their operations.

“I would urge any businesses that may have been a victim of cyber crime to come forward and report such incidents to law enforcement.”