Operation Morpheus: Europol coordinates global action against criminal abuse of Cobalt Strike

Europol’s Operation MORPHEUS, led by the UK NCA with global partners and private-sector support (BAE Systems, Trellix, Spamhaus, abuse.ch, Shadowserver), disrupted criminal abuse of cracked Cobalt Strike by flagging 690 IPs across 27 countries (593 taken down) and coordinating real-time intel sharing via MISP—over 730 submissions totaling nearly 1.2 million IOCs. The effort, initiated in 2021 and coordinated by Europol’s EC3, leveraged enhanced scanning and analytics to identify malicious activity tied to unlicensed Cobalt Strike use and will continue monitoring and disruptive actions.