Identifying Cobalt Strike team servers in the wild

Fox-IT describes how an unintended extraneous whitespace in NanoHTTPD-based Cobalt Strike team server HTTP responses allowed reliable fingerprinting of public Cobalt Strike C2 servers; the post details historical scan results (7,718 hosts observed between 2015–2019), provides example IPs tied to known actors, and offers a Snort detection rule and investigative guidance to retroactively identify potential compromises.