Cobalt Strike: International law enforcement operation tackles illegal uses of ‘Swiss army knife’ pentesting tool

An international law enforcement operation coordinated by the UK NCA and partners targeted 690 IP addresses hosting illegal or pirated instances of Cobalt Strike across 27 countries; the report highlights how pirated versions of the legitimate penetration-testing tool have become a go-to intrusion framework for cybercriminals and nation-state actors to deploy beacons, backdoors, and ransomware, and describes actions taken (server takedowns, ISP abuse notifications) while noting the persistent and evolving threat.