Cobalt Strike Team Servers: The Great Ransomware Enabler

ReliaQuest analyzes heavy weaponization of the legitimate pen‑testing tool Cobalt Strike in Q1 2023, documenting thousands of active team servers (by country and ASN), common C2 ports and registrars, typical spawn-to processes, and the use of CDNs/domain fronting to hide C2; the report emphasizes this infrastructure’s central role in double‑extortion ransomware and provides indicators and defensive guidance for detection and blocking.