Europol nukes nearly 600 IP addresses in Cobalt Strike crackdown

Europol coordinated Operation Morpheus, a week-long international disruption that flagged and disabled hundreds of IP addresses hosting cracked copies of Cobalt Strike, a legitimate red‑teaming tool extensively abused by cybercriminals (including groups linked to ransomware) and nation-state actors; private partners shared more than 730 threat intelligence items and nearly 1.2 million IOCs, while telemetry shows a large share of Cobalt Strike infrastructure is hosted in China and the U.S., underscoring continued risk despite the takedowns.