Cobalt Strike

The Beacon is Cobalt Strike's proprietary payload that calls back to a central team server to simulate advanced threat actor behavior. It is heavily favored by red teamers because it allows operators to easily execute commands, transfer files, and pivot through networks asynchronously.

Because Cobalt Strike is a highly effective, industry-standard red teaming tool, malicious hackers frequently use leaked or cracked versions to emulate legitimate corporate network traffic. Ransomware operators utilize the Beacon payload during the lateral movement phase of an attack to deploy their malicious payloads across hundreds of machines at once.

Cobalt Strike was originally created by Raphael Mudge, but the software is currently owned and developed by Fortra (formerly HelpSystems). Fortra tightly controls the sale of the software, heavily vetting buyers to prevent licenses from falling into the hands of cybercriminals.

Malleable Command and Control (C2) is a unique feature that allows red team operators to completely customize how Beacon network traffic appears. By editing a single configuration profile file, operators can disguise their malicious data payloads inside legitimate-looking HTTP requests for platforms like Amazon, Google, or Reddit.