Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCA leads op to degrade illegal versions of Cobalt Strike

Security

NCA leads op to degrade illegal versions of Cobalt Strike

The National Crime Agency (NCA) has coordinated international action against illicit software which has been used by cybercriminals for over a decade to infiltrate victims’ IT systems and conduct attacks.

Image courtesy NCA

Unlicensed versions of Cobalt Strike, a penetration testing tool used to check for vulnerabilities in a company’s network and help improve cyber security, were targeted during a week of action last week.

Since the mid 2010s, pirated and unlicensed versions of the software downloaded by criminals from illegal marketplaces and the dark web have gained a reputation as the ‘go-to’ network intrusion tool for those seeking to build a cyber attack, allowing them to deploy ransomware at speed and at scale.

Advertisement
ODU RT 2

Due to the range of tools, free training guides and videos that come with legal versions of the software, those adopting it for criminal use require low levels of sophistication and money.

This disruption activity represents more than two-and-a-half years of NCA-led international law enforcement and private industry collaboration to identify, monitor and denigrate its use.

Action was taken against 690 individual instances of malicious Cobalt Strike software located at 129 internet service providers in 27 countries. By the end of the week, 593 of these addresses had been taken down.

This was achieved through the NCA and law enforcement partners taking down servers and amplified by ‘abuse notifications’ from law enforcement and private industry partners, highlighting to service providers that they may be hosting malware.

Illicit versions of Cobalt Strike have been identified as being used in some of the biggest cyber incidents in recent times. Its use has also been identified in multiple malware and ransomware investigations including those into RYUK, Trickbot and Conti attacks.

The operation was jointly conducted with Europol, who assisted with international coordination, the FBI, Australian Federal Police, Royal Canadian Mounted Police, German Federal Criminal Police Office (Bundeskriminalamt), Netherlands National Police (Politie) and the Polish Central Cybercrime Bureau.

A number of private industry partners, including BAE Systems Digital Intelligence, Trellix, Shadowserver, Spamhaus and Abuse CH also supported law enforcement in identifying malicious instances and use of Cobalt Strike by cybercriminals.

Using a platform known as the Malware Information Sharing Platform, private sector organisations shared real time threat intelligence with law enforcement. More than 730 pieces of threat intelligence containing almost 1.2 million indicators of compromise were shared.

Advertisement
ODU RT

Cyber criminals deploy unlicensed versions of Cobalt Strike via spear phishing or spam emails, which attempt to get a target to click on links or open malicious attachments. When a victim opens the link or document, a Cobalt Strike ‘Beacon’ is installed giving the threat actor remote access, enabling them to profile the infected host, download malware or ransomware and steal data to then extort the victim.

Paul Foster, Director of Threat Leadership at the National Crime Agency, said: “Although Cobalt Strike is a legitimate piece of software, sadly cybercriminals have exploited its use for nefarious purposes.

“Illegal versions of it have helped lower the barrier of entry into cybercrime, making it easier for online criminals to unleash damaging ransomware and malware attacks with little or no technical expertise.

“Such attacks can cost companies millions in terms of losses and recovery.

“International disruptions like these are the most effective way to degrade the most harmful cyber criminals, by removing the tools and services which underpin their operations.

“I would urge any businesses that may have been a victim of cyber crime to come forward and report such incidents to law enforcement.”

Cobalt Strike owners Fortra will continue to work with law enforcement to identify and remove older and malicious versions of the programme from the internet.

Advertisement
Babcock LB
Jonathan Powell appointed as UK PM

Defence Security

Jonathan Powell appointed as UK PM's National Security Adviser

8 November 2024

The Prime Minister has today announced the appointment of Jonathan Powell as the Prime Minister’s National Security Adviser based in No10 Downing Street.

SIA leads blitz across England to disrupt criminal activity

Security

SIA leads blitz across England to disrupt criminal activity

8 November 2024

The SIA has mounted a series of coordinated, surprise operations across England to tackle suspected licence fraud, labour exploitation and immigration offences.

Fourth Republic of Korea-UK Cyber Dialogue held in London

Security Events

Fourth Republic of Korea-UK Cyber Dialogue held in London

8 November 2024

The Fourth Republic of Korea (ROK)-United Kingdom (UK) Cyber Dialogue was held in London this week (6th November 2024) co-chaired by Andrew Whittaker, Cyber Director in the UK Foreign, Commonwealth and Development Office (FCDO) and Rhee Dong-yeol, Ambassador for International Cyber Affairs in the ROK Ministry of Foreign Affairs (MOFA).

Cyber Essentials marks decade of boosting cyber defences

Security

Cyber Essentials marks decade of boosting cyber defences

7 November 2024

Businesses and other organisations have been urged to boost their defences as the National Cyber Security Centre’s Cyber Essentials programme celebrates its 10th year.

Advertisement
ODU RT
IATA and ASA World enhance partnership

Aerospace Security

IATA and ASA World enhance partnership

7 November 2024

The recent MoU signed between the Airport Services Association World (ASA World) and the International Air Transport Association (IATA) reinforces a commitment to advancing safety, efficiency and innovation within the air transport industry.

Bristow and Leonardo agree support for AW139s and AW189s

Aerospace Security

Bristow and Leonardo agree support for AW139s and AW189s

6 November 2024

Bristow and Leonardo have finalised a series of long-term agreements that will enhance global fleet support and training for the AW139 and AW189 helicopters, extending into the next decade.

Advertisement
ADS S &P RT