Recorded Future assessed changes to Cobalt Strike servers in the wild in the aftermath of the public identification of several Cobalt Strike server detection methods. In our analysis, we conducted an evaluation of different methodologies and did a combined analysis based on them to determine if users changed their configurations to avoid detection. Sources include the Recorded Future® Platform, BinaryEdge, Censys, Rapid7 Lab’s OpenData, Shodan, GreyNoise, ReversingLabs, VirusTotal, Farsight DNS, and other open sources. This report will be of greatest interest to organizations seeking to improve the speed of their response times, as well as analysts who deal with Cobalt Strike incidents on a regular basis.​​ 

Executive Summary​​ 

Cobalt Strike es una plataforma de explotación desarrollada para el uso de profesionales de seguridad en la emulación de ataques dirigidos y acciones posteriores a la explotación por parte de adversarios avanzados. La herramienta, desarrollada y licenciada por Strategic Cyber LLC, una compañía con sede en Washington D.C., es monitorizada por la compañía para detectar uso ilícito y está sujeta a controles de exportación. A pesar de ello, el framework Cobalt Strike se convirtió en una opción popular entre los diversos programas de este tipo, que incluyen otras suites de pago como Metasploit Pro, Core Impact y otras. Aunque no es el único entre estas plataformas en ser empleado por usuarios sin licencia y actores criminales, Cobalt Strike fue empleado por diversos grupos de amenaza, incluyendo APT32, que empleó la herramienta para explotaciones iniciales, y el grupo homónimo Cobalt Group, que dependió en gran medida del marco.​​ 

Considering the significant use of the Cobalt Strike platform by security testers — and, more importantly, malicious attackers — the necessity of recognizing Cobalt Strike server connections to corporate network assets is evident.​​ 

Despite the detection methodology being public, Recorded Future has observed that Cobalt Strike servers have been left largely unpatched, allowing fingerprinting and subsequent detection. This methodology, coupled with other detections, allowed Recorded Future to sample Cobalt Strike servers found in the wild, and compare fingerprinting methods to help defenders best track and monitor this framework. The tracking of Cobalt Strike servers can aid blue teams in detecting red team activity and containing activity from adversaries who have not modified their Cobalt Strike Team Server.​​ 

Key Judgments​​ 

• Cobalt Strike servers remain fairly exposed and relatively easy to detect, despite patching to make specific fingerprinting methods more difficult. Many Cobalt Strike servers operating before the patch was released have not updated their systems, while newer deployments have used the upgraded software.​​ 
• Recently deployed Cobalt Strike servers are more likely to deploy an updated Cobalt Strike version (beyond 3.12) while continuing to use the default TLS certificate, which remains a reliable detection mechanism.​​ 
• Recorded Future’s sampling of current Cobalt Strike servers, contrasted with historic threat activity, found that criminal and state-aligned actors alike have used default, unpatched Cobalt Strike configurations, perhaps in an effort to blend in with other Cobalt Strike servers, or possibly simply because the default settings work well without alteration and the operator does not feel the need to alter anything.​​ 
• The detection of Cobalt Strike servers can aid defenders in creating alerts in their enterprise networks, providing a proactive measure to get ahead of their red team, criminal operations, or state-sponsored adversaries.​​ 

Background​​ 

A primary issue for incident response and security operations analysts today is determining which security events or alerts are a priority to review. Fortunately, applying accurate threat intelligence to a SIEM workflow, such as Splunk, can be valuable for identifying credible threats, and can even reveal crucial additional context to enable security teams to take more proactive measures. For example, an alert comes across your SIEM — it’s an IP address, 89.105.198[.]28, that has been contacted by one of your endpoints. Now what?​​ 

Recorded Future browser extension.​​ 

Upon opening the Recorded Future browser extension on the Splunk alerts page, the IP 89.105.198[.]28 jumps to the top with a risk score of 93 (this finding was made on May 6, 2019, and the risk score will decay on May 17, 2019 if no further malicious activity is observed). This investigation reveals that the IP address was previously reported by Sophos as part of the MegaCortex ransomware campaign, using a Cobalt Strike reverse shell.​​ 

Cobalt Strike es una plataforma de simulación de adversarios desarrollada para probadores de penetración por Raphael Mudge, fundador de Strategic Cyber LLC. Diseñado para la interoperabilidad con otras plataformas como Metasploit, NMAP y Powershell Empire, puede ejecutar usando Armitage, una interfaz gráfica de usuario (GUI) desarrollada por Mudge, inicialmente para Metasploit. Armitage y Cobalt Strike están diseñados en torno a un servidor de equipo que permite compartir información y la capacidad de dirigir y ejecutar acciones bien coordinadas.​​ 

Conocido por su avanzada funcionalidad, Cobalt Strike fue adoptado por numerosos profesionales de la seguridad y también empleado ilegalmente por entidades criminales y estatales . Como ha declarado MITRE , "Las capacidades interactivas post-exploit de Cobalt Strike cubren toda la gama de tácticas ATT&CK, todas ejecutadas dentro de un único sistema integrado." El marco fue un pilar en el panorama de amenazas en los últimos tres años, empleado frecuentemente por grupos criminales, actores patrocinados por el Estado y, por supuesto, equipos de pruebas de penetración.​​ 

(Cobalt Strike use over time. (Source: Recorded Future))​​ 

Cobalt Strike is professionally maintained and available under license currently for a $3,500 USD fee with annual renewals. In addition to export controls set by the United States, Strategic Cyber LLC attempts to strictly control its licensing and use to legitimate security professionals and keep the software out of the hands of malicious actors, making it difficult for both criminals and entities outside the United States to acquire it.​​ 

Strategic Cyber LLC regularly updates and patches licensed versions of the software. Recent changes to Cobalt Strike’s server configurations attempt to help the framework evade detection. Pirated versions of the software, however, will not receive official updates and patches.​​ 

Although the software licensing has been strictly controlled, there are confirmed instances of pirated versions of Cobalt Strike in the wild, often cracked trial versions, and a variety of actors in the criminal underground have been observed attempting to acquire or trade them. The cracked versions, however, may come with their own added “features” such as backdoors, or be lacking in some way. One member on Raid Forums posted a link to a cracked copy of Cobalt Strike 3.13 (the latest version) on April 5, 2019, but other members pointed out that it was missing some features, and parts of the software which should have been removed, such as EICAR, remained. Legitimate versions of Cobalt Strike are therefore valuable; for example, one Maza forum member was observed last year offering $25,000 USD for a purchaser within the U.S. to obtain a licensed copy of Cobalt Strike and illegally transfer it to this forum member.​​ 

Volviendo a nuestra investigación del 89.105.198[.]28, esta dirección IP se empleó como servidor de comandos y control para un shell inverso de Cobalt Strike en un controlador de dominio víctima durante un incidente MegaCortex. El ransomware se distribuyó entonces por el entorno a través de PSExec. La campaña de ransomware MegaCortex estaba activa en el momento de este análisis. Una investigación más profunda de la dirección IP revela que emplea el certificado de seguridad predeterminado del servidor Cobalt Strike para cifrar el tráfico.​​ 

Este caso involucra al 89.105.198[.]28 lo que llevó a Recorded Future a investigar esta actividad específica de Cobalt Strike. Esto fomentó aún más la investigación a gran escala sobre Cobalt Strike, tras los hallazgos de la compañía de seguridad Fox-IT sobre el espacio anómalo incluido en las respuestas HTTP de Cobalt Strike y otras detecciones públicas, incluyendo el uso común del certificado SSL/TLS estándar, preconfigurado y autofirmado en servidores Cobalt Strike. Los servidores que despliegan este certificado pueden detectar mediante Shodan o Censys mediante el hash SHA256 o el número de serial del certificado.​​ 

Default Cobalt Strike SSL/TLS certificate.​​ 

Public Methodologies for Identifying Cobalt Strike Team Servers​​ 

On February 19, 2019, Strategic Cyber LLC (the producer of Cobalt Strike) released the results of a “Cobalt Strike Team Server Population Study.” The study was undertaken in part to discover the license status of discovered Cobalt Strike software, as well as identify and analyze any significant alterations made to versions of the software currently in use.​​ 

This study identified multiple methods that could be used to identify Cobalt Strike servers in the wild:​​ 

• Cobalt Strike servers are shipped with a default security certificate which can be used to fingerprint them unless the administrator changes it.​​ 
• SHA256: 87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c​​ 
• Serial Number: 146473198​​ 
• When enabled, the Cobalt Strike DNS server responds to any DNS request received with a bogon (fake) IP: 0.0.0.0 (this is not unique to Cobalt Strike servers).​​ 
• The default controller port for Cobalt Strike Team Server is 50050/TCP, a port unlikely to be found open on other servers.​​ 
• The “404 Not Found” HTTP response for Cobalt Strike is unique to NanoHTTPD web servers and can be detected.​​ 

Taken as a whole, the surest method in the list above is fingerprinting Cobalt Strike servers using the default security certificate. The remaining detection methods are less certain and all will be of higher confidence when corroborated with other methodologies. For example, any server using port 50050 that also provides an HTTP response unique to NanoHTTPD web servers is more likely a Cobalt Strike server than one found to only exhibit an HTTP response signature.​​ 

NanoHTTPD is an open source web server framework. NanoHTTPD servers and Cobalt Strike servers running version 3.12 and earlier could be identified via a null space in the HTTP response where “HTTP/1.1” is followed by a blank space (0x20) not found in other web server responses. Any HTTP response from a pre-3.13 Cobalt Strike server will contain this null space, and a scanner that can retrieve HTTP server responses may be used to search for them. A simple manual method of identifying the aforementioned null space may be done with a packet capture of a browser HTTP connection to a Cobalt Strike server, in which the extra space can be easily seen.​​ 

As Cobalt Strike instances running cracked versions are not updated or patched, this method provides the added potential of discovering Cobalt Strike servers operated by criminals.​​ 

Not specifically mentioned in the Strategic Cyber LLC blog post is another method of identifying Cobalt Strike servers. On January 2, 2019, Cobalt Strike version 3.13 was released. The Cobalt Strike release notes state that one of the changes from previous versions was the removal of an “extraneous space from HTTP status responses.” An extra null byte in the HTTP server response of NanoHTTPD servers (an open source, Java-based web server) affected the Cobalt Strike Team Server, which was first released in 2012 and is based upon NanoHTTPD.​​ 

The research on Cobalt Strike servers published by security firm Fox-IT on February 26, 2019, provided not only details on how to identify the servers prior to version 3.13 (which respond with the additional null space in the HTTP response), but also a list of over seven thousand IPs hosting Cobalt Strike servers observed from 2015 to 2019 using this detection method found in publicly available data from Rapid7.​​ 

Packet capture showing extra null space in the HTTP header from a Cobalt Strike server.​​ 

Similarly, on February 27, 2019, the Chinese Knownsec security research team published a blog detailing their use of the NanoHTTPD 404 Not Found response anomaly reported by Strategic Cyber LLC, as well as the null space anomaly, to identify Cobalt Strike servers. They found fewer numbers of servers in the data within their associated ZoomEye search engine platform, but still found over three thousand. Knownsec reported that the open source NanoHPPTD code that Cobalt Strike is built on responds in the following manner, precisely:​​ 

HTTP/1.1 404 No encontrado
Content-Type: text/plain
Date: Day, DD Mmm YYYY HH:​MM​:SS GMT
Content-Length: 0​​ 

Knownsec based their detection logic on this finding. However, Knownsec also subsequently observed that the order within the HTTP response may in fact differ, after finding “content-type” presented after “date” in the response from some Cobalt Strike systems.​​ 

Un método fiable para descubrir servidores de cobalto está disponible para quienes tienen acceso a datos detallados de tráfico de red. El proyecto JA3 de código abierto, desarrollado por tres investigadores de Salesforce, permite detectar tráfico HTTPS sospechoso mediante la huella digital de la negociación TLS entre servidores y clientes. La versión TLS/SSL, los conjuntos de cifrado aceptados y los detalles de curvas elípticas (como los formatos de puntos de curva elíptica) pueden ser identificados de forma similar a como un navegador puede ser identificado por su versión, complementos y otras características específicas de ese navegador.​​ 

Las firmas JA3 son para el lado del cliente y las JA3S para servidores. En el caso de Cobalt Strike, se crearon huellas digitales para la negociación TLS mediante la baliza cliente (que emplea el socket de Windows para iniciar la comunicación) y los servidores Cobalt Strike que se ejecutan en el sistema operativo Kali Linux. Estas huellas dactilares tendrían que usar juntas para descubrir de forma fiable un servidor Cobalt Strike. Aunque este método de detección puede mitigar parcialmente por el operador de Cobalt Strike usando un "redirector", muchos servidores de Cobalt Strike no emplean dicho proxy.​​ 

Las firmas JA3 y JA3S se pueden emplear con herramientas como Zeek/Bro y Suricata. Los datos obtenidos con estas herramientas de detección de red pueden posteriormente introducir en un SIEM como Splunk. Las firmas JA3 y JA3S están disponibles en la cuenta de Github de Salesforce y en otras fuentes.​​ 

As with detections of other tools such as Metasploit, Powershell, or PsExec that may be used by a security team or administrators, network defenders should exercise due diligence if they find evidence indicating connections from within their network to a Cobalt Strike server, as the detection itself will not identify the intentions of the user. Identifying a Cobalt Strike server as that of an authorized red team or a true adversary may be impossible based on detected traffic alone.​​ 

Changes Since Fox-IT and Knownsec Reports Publicizing Anomalous HTTP Responses​​ 

We expected the number of Cobalt Strike servers identified by these methods to decrease after the publication of information by Strategic Cyber LLC, Fox-IT, and Knownsec in late February 2019 concerning the detection of Cobalt Strike servers. Additionally, Cobalt Strike operators were encouraged by Strategic Cyber LLC in their February study to make use of an Apache or Nginx web server as a “redirector” to proxy their traffic; this precludes simple detections of Cobalt Strike servers by removing the anomalous HTTP responses, default security certificates, and other such identifiers from the equation. Updating legitimate, licensed servers to version 3.13 would decrease the number found using the extraneous null space method, but Cobalt Strike operators being aware of the well-publicized detection methods would also be expected to decrease the number of detectable servers.​​ 

By duplicating Fox-IT’s methodology of detecting the anomalous null space in HTTP responses, Insikt Group confirmed a noticeable decrease in identified servers. 388 Cobalt Strike servers were observed for the first time in February 2019 using Rapid7’s data. The number of first-seen Cobalt Strike servers using this method was only 90 in April 2019. However, this is only part of the story; older Cobalt Strike servers visible using this method have decreased in number but far less significantly. 441 of the servers observed in Rapid7’s data were still observed to be up in April 2019, which is more than the 387 last observed in January 2019.​​ 

By analyzing the Knownsec research to identify Cobalt Strike with a different HTTP detection methodology, Insikt Group replicated their research in the same ZoomEye search engine data. Insikt Group identified 1,580 servers that were up in 2018, and only 1,053 through May 2019.​​ 

Recent metrics of individual Cobalt Strike detection parameters. (January 2019 to May 2019)​​ 

As previously noted, both of these HTTP detection methods are based upon anomalies within NanoHTTPD, not Cobalt Strike systems in particular. Not all of those detected using these methods had corroborative data, such as open port 50050. Other variables are also involved in the change to the number of servers. Cobalt Strike servers may change IPs and do not always remain up for long periods of time. Although there has been a reduction in newly sighted Cobalt Strike servers since January 2019, the data indicates that there are still a large number of servers in operation that are detected by the HTTP null-space anomaly method.​​ 

Cobalt Strike identification using combined detection methods. (January 2019 to May 2019)​​ 

The combination of the three detections made for high confidence assessments for the servers to be hosting Cobalt Strike — in fact, all six of the servers identified in this manner were previously reported to host Cobalt Strike and communicate with various Cobalt Strike beacons. The use of the default Cobalt Strike proves to be the best detection methodology; however, monitoring the combined usage of NanoHTTPD and open port 50050 can narrow the field of IPs to monitor greatly.​​ 

Threat Analysis​​ 

By using Fox-IT’s methodology and looking for use of the standard-issue Cobalt Strike TLS certificate on accessible IPs, Recorded Future attempted to profile Cobalt Strike usage in the wake of Strategic Cyber LLC patching a major detection mechanism. It should be noted that the forthcoming methodology and study tracks visible Cobalt Strike servers, and cannot account for Cobalt Strike servers that evade detection even by simple changes.​​ 

En esta investigación, Recorded Future anticipó que los hallazgos de Fox-IT trasladarían la adopción de Cobalt Strike a versiones más recientes, lo cual ocurrió en cierta medida. A pesar de que Strategic Cyber LLC proporcionó un parche para abordar esta detección y la publicación de direcciones IP con el espacio adicional en la respuesta HTTP, los despliegues de Cobalt Strike anteriores a la actualización no parecen haber actualizado. El mes siguiente a la actualización del framework se produjo el mayor aumento en los servidores Cobalt Strike recién observados basados en la metodología de detección de Fox-IT, aplicada a los conjuntos de datos de Rapid7. Estos servidores pasaban una media de 70 días conectados.​​ 

However, this detection proved unreliable, as the method found 248 devices on consecutive CIDR ranges on AS 132839, using NanoHTTPD on port 1443, solely active on February 1, 2019. After removing this anomaly, the data indicates a stark drop in the detection of new Cobalt Strike hosts using NanoHTTPD. This may be due to fewer Cobalt Strike new deployments overall, but may also reflect the updated software being used.​​ 

The last-seen data from April 2019 largely indicate that previously deployed Cobalt Strike instances have not been removed or updated. Additionally, the amount of time the servers have stayed online, based on that same data set, shows no noticeable shift in servers that have continued to be detected, hovering around the data set’s average of 70 days. However, there was a decline in new Cobalt Strike servers found with the null space in the HTTP header.​​ 

The continued identification of Cobalt Strike servers using an outdated version of the framework (via the null space in the HTTP header) and the default configurations may indicate that a large population of Cobalt Strike servers are cracked or stolen versions. It may also be an instance of operators not reading security publications, but the answer may be more simple than that — most targets are not likely searching for Cobalt Strike servers, and the payloads remain effective, so why change their behavior?​​ 

Sampling of Cobalt Strike Servers​​ 

Recorded Future took a sampling of the IP addresses from which we had seen activity in April 2019 to look at both noted activity and detection overlaps. These servers fit into a number of categories: confirmed Cobalt Strike activity, Cobalt Strike servers associated with other malware, Cobalt Strike servers with links to known threat groups, and unreported Cobalt Strike servers that have yet to be named in threat lists or reporting.​​ 

The research methods used were unable to help determine if the systems analyzed were licensed or not, and similarly, could not identify if the servers were conducting authorized security testing or illicit attacks.​​ 

Varias direcciones IP encontradas coinciden en señales relacionadas con Cobalt Strike. Los tres empleaban el certificado por defecto, tenían abierto el puerto controlador 50050 de Cobalt Strike y previamente fueron identificados por alojar balizas Cobalt Strike o proxies inversos Meterpreter. Cabe destacar nuevamente que se realizan detecciones de mayor fidelidad cuando se emplean métodos de detección corroborativa.​​ 

• The IP address 89.105.202.58 made use of the standard Cobalt Strike certificate. Previous URLscan.io results show an HTTP 404 Not Found response, with no content and plain text Content-Type, and Shodan scanning indicates that port 50050 was open, which can host the Cobalt Strike controller. Twitter user @Scumbots has previously identified the server as hosting a Meterpreter reverse proxy, which was contacted via Powershell script that has been hosted on PasteBin since February 2019.​​ 
• 199.189.108.71 también empleaba el certificado predeterminado de Cobalt Strike, tenía abierto el puerto 50050 y fue identificado previamente por el usuario de Twitter @Scumbots para alojar un proxy inverso Meterpreter, que también empleaba Powershell codificado en base64 para ofuscar la ejecución.​​ 

La IP 31.220.43.11 se identificó usando el certificado base de Cobalt Strike, corroborado por el puerto 50050 abierto en el servidor. Se observó una muestra de Meterepreter enviando tráfico HTTP a la IP en capacidad de comando y control. Según los datos de Shodan, la IP tiene varios puertos abiertos y es vulnerable a varios exploits, lo que puede indicar que el host está comprometido para servir a otros malwares. La IP aloja un único dominio en el momento del análisis: cob.ozersk[.]hoy.​​ 

Varias IPs usaban el certificado estándar de Cobalt Strike, y anteriormente se asociaron con la actividad de FIN6, tanto para la entrega de ransomware como para el vector de ataque inicial para distribuir malware en punto de venta. En el momento de este análisis, ambos servidores de Cobalt Strike Team estaban activos, a pesar de que la campaña fue quemada públicamente. Esto demuestra la falta de necesidad de limpieza de FIN6 tras sus operaciones, así como la rapidez con la que se abandonó la operación.​​ 

Interestingly, while one of the servers was detectable by all three methods, one of the servers had been patched for the NanoHTTPD extra space, implying that either the standard web server was reconfigured, or the actors had an updated version of Cobalt Strike. The diversity of the Cobalt Strike servers deployed in the same incident show that FIN6 uses the standard Cobalt Strike framework with little modification.​​ 

• The server at 185.80.233.166 uses the default Cobalt Strike security certificate. This system also has the default Cobalt Strike Team Server port 50050/TCP open. The system had an MX record of mail.sexlove24[.]com, and Talos telemetry data indicates that no mail has been observed to or from this system in the month of April 2019. This IP was identified by Morphisec in February 2019 as part of a coordinated attack on point-of-sale systems using FrameworkPOS. The activity made use of TTPs used by the FIN6 group, specifically the use of WMI/PowerShell for lateral movement and privilege escalation.​​ 
• El IP 176.126.85.207 fue detectado tanto por el espacio anómalo de Fox-IT como por el uso del certificado predeterminado de Cobalt Strike, con datos corroborados al tener abierto el puerto 50050. Se observó que el IP entrega una carga útil inversa HTTP de Metasploit Meterpreter junto con la entrega de LockerGoga y Ryuk desde FIN6.​​ 

Dos IP emplearon el certificado estándar de Cobalt Strike e hicieron uso de cargadores reflectantes de Cobalt Strike. La carga reflectiva de DLL (biblioteca de carga dinámica) es un método para inyectar una DLL en la memoria de un proceso, omitiendo el cargador de DLL de Windows y evitando almacenar la DLL en un disco. Una DLL inyectada de esta manera puede ser difícil de detectar, ya que solo reside en la memoria. La carga reflectiva de DLL, empleada de forma notoria por APT40 (también conocido como TEMP.Periscope) y en la campaña Wilted Tulip , no es exclusiva de Cobalt Strike y la llevan a cabo varios actores a través de diversos medios. El uso de un cargador reflectivo no es prueba de que estos grupos estuvieran activos en estos servidores. Ninguna de las direcciones IP alojaba dominios en el momento de este análisis.​​ 

• The IP 89.105.198.18 made use of the default Cobalt Strike certificate as well. The IP previously was identified as a command-and-control server, receiving Meterpreter data over HTTP, according to @Scumbots. Previous scan data from Shodan corroborated the Cobalt Strike server existing on the IP address by having the Cobalt Strike controller port 50050 open. Recorded Future’s collections identified two files which contacted the IP address 89.105.198.18, first observed in March 2019. The payloads had inconsistent detections on VirusTotal, likely due to at least the first file being UPX-packed. An inspection of the memory dumps from executing the files found that both were Cobalt Strike reflective loaders.​​ 
• 3a143d038aae9e4253ed6656beaaae298795a3df20e874544c0122435ef79bc0​​ 
• 9668c17504a0d9471668dac64b3c5c2abfb3b186c25dc28d91afbe95ed341002​​ 
• Another IP address on the same CIDR range also made use of the default Cobalt Strike certificate:89.105.198.21. The IP address did not host domains at the time of this analysis, but previous scan data corroborated the presence of a Cobalt Strike server.​​ 
• El IP 106.12.204.25 fue detectado tanto por el espacio anómalo de Fox-IT como por el uso del certificado predeterminado de Cobalt Strike. La IP también tenía abierto el puerto 50050 y tenía una respuesta 404 No Encontrada en texto plano, como se mencionó antes. Se informó que la IP entrega con una baliza Cobalt Strike, que también fue detectada por un usuario de VirusTotal como un cargador reflectante Cobalt Strike relacionado con APT40. Recorded Future no observó que la propiedad intelectual operara en relación con APT40.​​ 

Another general category of IPs that was identified as hosting Cobalt Strike had uncorrelated threat activity involving other malware or suspicious activity, but largely produced inconclusive results.​​ 

• The IP address 91.152.8.14 made use of the standard Cobalt Strike certificate in mid-April 2019. A generic trojan was found to communicate with the IP address via HTTP methods over port 433. The IP hosted no domains at the time of analysis, but shared a certificate with forum.happyhippos[.]org. The certificate issuer claimed to be from Espoo, Uusimaa, Finland, the same relative geolocation of the IP address. Another IP address on the same CIDR range was detected via the anomalous HTTP header space, on 91.152.8.173. While this IP made use of a different certificate, previous Shodan scans over port 443 show a 404 Not Found response with no content and plain text Content-Type, which is a low-confidence signal of a Cobalt Strike server. Without further data, Recorded Future could not come to a conclusion about these IPs.​​ 
• The IP 99.81.122.12 was identified in late April 2019, from the anomalous spacing, use of the Cobalt Strike certificate, and having the controller port 50050 open. The server is now inactive, but previously served as a Cobalt Strike beacon, accessed via HTTP. The server did not host domains at the time of analysis.​​ 
• The IP 72.14.184.90 also made use of the generic Cobalt Strike certificate. The IP address is contacted by a malicious file, reaching out over HTTP to the URL hxxps://72.14.184[.]90/search/news/. The file is detected as a Cobalt Strike beacon. The IP address was also implicated for being involved in a spearphishing campaign in late January 2019. Shodan scan data indicates the server has a number of vulnerabilities, which points to the server potentially being compromised to host the Cobalt Strike server, rather than the server being rented for a pen-testing engagement.​​ 
• 06f8004835c5851529403f73ad23168b1127315d02c68e0153e362a73f915c72​​ 

Finally, a number of IPs had limited reports of threat activity, but bore indications of potential malicious activity coming in the near term:​​ 

• La IP 172.96.250.199 empleó el certificado base de Cobalt Strike, pero no tuvo ninguna actividad amenazante asociada, según Recorded Future Telemetry. Desde entonces, la dirección IP intercambió certificados para usar un par de certificados LetsEncrypt, incluyendo uno vinculado al dominio haqiu[.]cf. El dominio no estaba activo ni alojado en esta IP en el momento de este análisis. La IP estuvo asociada con el alojamiento de un dominio sospechoso, ssss.ppwu[.]xyz, que empleó certificados LetsEncrypt duales. Estos certificados son válidos solo durante 90 días y desde entonces se han rotado a servidores de Cloudflare. Esto puede indicar un próximo enfrentamiento con equipos rojos o una futura actividad amenazante usando Cobalt Strike.​​ 
• The IP 139.162.18.83 was identified from the use of the default Cobalt Strike SSL certificate, but no threat activity or other oddities, have been observed on the IP address. However, on the same CIDR range, 139.162.18.179 was identified from the anomalous space included in the HTTP response, and it was found to be using the default Cobalt Strike SSL certificate. There is no threat activity currently associated with the server, but a number of suspicious domains are hosted on the IP.​​ 
• The IP 124.156.106.98 also made use of the default Cobalt Strike certificate, and had port 50050 open which can be used for the Cobalt Strike controller panel. The IP has been observed as the command and control for a Cobalt Strike beacon, observed in March 2019. However, an odd domain was registered and hosted on the IP as of May 2, 2019, kongbu.koubaogangjiao[.]xyz, while the Cobalt Strike signals were still live. The domain may be used going forward for penetration testing or malicious infections.​​ 

Outlook​​ 

Recorded Future finds it important to cluster together signals from known threats to help baseline threat activity and to make it easier to identify more unique threats. The continued sightings of standard Cobalt Strike certificates, along with the anomalous space in HTTP responses from versions earlier than 3.13, indicates that the collaborative use of multiple signatures will prove to be the best method for identifying active Cobalt Strike servers.​​ 

While espionage-oriented actors often have large amounts of development time and resources at their disposal, they also have a vested interest to blend in with the crowd. Obstacles other than intentional tradecraft may prevent the patching of Cobalt Strike servers, including lack of knowledge of the update due to a language barrier, operational comfort with currently installed versions, or other modifications that prevent the installation of the update. The use of cracked versions of Cobalt Strike or deployment of standard Cobalt Strike instances causes a blending together of threats, making attribution difficult. Additionally, by running cracked versions of the framework, actors can blend in with older versions of Cobalt Strike.​​ 

Detection of these servers on a rolling basis can provide rules for SOC and IR teams to develop alerting or blocking capabilities, and can prompt investigations into hosts communicating with these servers.​​