CobaltStrike: The Penetration Testing Framework & Our Adversaries

This report catalogs numerous sightings and analyses of CobaltStrike being used by red teams, cybercriminal groups (including ransomware affiliates such as those deploying WastedLocker, Maze, Sodinokibi/REvil), and state-sponsored APTs for access, lateral movement, and persistence. It highlights maldocs, PowerShell and shellcode delivery, living-off-the-land techniques, and CobaltStrike beaconing masquerading as benign traffic, and recommends monitoring beacon indicators and endpoint infection vectors.