Cobalt Strike

In April 2023, Microsoft, Fortra and Health-ISAC obtained an order from a federal court in New York against cracked copies of Cobalt Strike and the infrastructure that runs them. In late June 2024, Operation Morpheus, coordinated by Europol, flagged 690 IP addresses and got 593 of them taken offline. Cobalt Strike is a commercial adversary simulation tool, created in 2012 by Raphael Mudge for red teams and acquired in 2020 by HelpSystems, now Fortra. Its agent, the beacon, sits on a compromised machine and takes orders from a command-and-control server over configurable channels that mimic ordinary web traffic. Cracked versions have circulated for years, and the tool became the C2 of choice for ransomware crews: stable, documented, familiar to affiliates, ready to use. For an insurer, its value is chronological. When the forensic team finds a Cobalt Strike beacon, its artifacts often date the intrusion well before encryption, by days or weeks, and give the attacker's dwell time. That date weighs on coverage: the policy period and retroactive date, an application signed while the network was already compromised, and sometimes whether several incidents count as a single claim. Its presence alone does not prove an attack, since authorized penetration tests use it legitimately, and the expert checks who deployed it before drawing conclusions. Not to be confused with the ransomware itself: the beacon watches, stages and moves the attacker through the network, and the encryptor arrives at the end, often dropped by the beacon.