Microsoft, the Health Information Sharing and Analysis Center (Health-ISAC) and Fortra, which bought Cobalt Strike in 2020, have worked since 2023 to address the longstanding issue of pirated and unlicensed versions of the software being downloaded by criminals from illegal marketplaces and used in cyberattacks. Fortra explained in a blog post Friday that a three-year operation named “Morpheus” culminated in July 2024 with the coordinated global takedown of known IP addresses and domain names associated with criminal activity related to unauthorized versions of Cobalt Strike. Developed in 2012, Cobalt Strike is an adversary simulator and penetration testing software used by red teams to detect vulnerabilities and plan response, but older versions of the program have been widely exploited by cybercriminals, ransomware gangs and nation-state attackers. The number of unauthorized copies of the testing tool Cobalt Strike used in the wild is down 80% over the last two years following the launch of a global crackdown, the security firm Fortra said Friday. “Every unauthorized Cobalt Strike system taken down or domain name that is seized interrupts potential attacks across the globe,” he said. Microsoft previously said they found evidence of nation-state groups from Russia, China, Vietnam and Iran using cracked copies of Cobalt Strike. Experts have seen Cobalt Strike used in dozens of ransomware attacks on healthcare institutions and was deployed in the ransomware attack that impacted the government of Costa Rica in 2022. Fortra associate vice president Bob Erdman told Recorded Future News that collaborating with Microsoft and other partners allowed them to expand the speed and scale of their actions. In March 2023, the U.S. District Court for the Eastern District of New York issued an order allowing Microsoft, Fortra and Health-ISAC to go after the “malicious infrastructure” used in attacks, such as command-and-control servers. The order allowed the three entities to notify relevant internet service providers and computer emergency readiness teams (CERTs) who assist in taking the infrastructure offline — severing the connection between criminal operators and infected victim computers. Unlicensed versions of Cobalt Strike are typically used in spearphishing emails that aim to install a beacon on the target’s device.
This Cyber News was published on therecord.media. Publication date: Fri, 07 Mar 2025 19:10:05 +0000