CTA Type: Blog

Playing in the (Tradecraft) Garden of Beacon: Finding Eden

Posted on

We have previously blogged about using BeaconGate to dynamically instrument Beacon at run time. However, one of BeaconGate’s limitations is that it is not applied throughout Beacon’s entire lifecycle. Specifically, it does not impact the reflective loading process. Hence, if an EDR is monitoring for unbacked VirtualAlloc or LoadLibrary calls, we cannot use BeaconGate to bypass it. To solve this problem, we must get our hands dirty with UDRL development. However, to […]

Read More… from Playing in the (Tradecraft) Garden of Beacon: Finding Eden

Me, Myself and AI: Internal Experiments with the CS REST API

Posted on

This blog is all about experimenting and having fun with the new CS REST API and the generative AI ecosystem. We’ll demonstrate how we used Claude Desktop and its Model Context Protocol (MCP) integration to automate and orchestrate attacks through the CS REST API. We will also share the following internal (vibe-coded) experiments, intended to […]

Read More… from Me, Myself and AI: Internal Experiments with the CS REST API

Get to Know Cobalt Strike: New Introductory Training

Posted on

We’re excited to announce the launch of a brand-new Cobalt Strike training course, created in collaboration between Fortra and Zero-Point Security. This unique partnership brings together the expertise of Cobalt Strike’s team with the field-tested training experience of Zero-Point Security to deliver an unmatched learning opportunity. Through this course users can learn how to use […]

Read More… from Get to Know Cobalt Strike: New Introductory Training

Artificial Intelligence for Post-Exploitation

Posted on

Post-exploitation tasks frequently require manual analysis, such as relying on an operators’ expertise to scan a target environment for sensitive information that could support in the pursuit of an objective. For example, searching file shares and internal applications for sensitive information of credentials. These tasks are often time consuming, but can be dramatically improved with […]

Read More… from Artificial Intelligence for Post-Exploitation

Dynamically Instrumenting Beacon With BeaconGate – For All Your Call Stack Spoofing Needs!

Posted on

TL;DR: In this blog we’ll demonstrate how to instrument Beacon via BeaconGate and walk through our implementations of return address spoofing, indirect syscalls, and a call stack spoofing technique, Draugr, that are now available in Sleepmask-VS. Furthermore, we’ll provide tips and tricks for developers in getting set up with Sleepmask-VS so they can write their […]

Read More… from Dynamically Instrumenting Beacon With BeaconGate – For All Your Call Stack Spoofing Needs!

Cobalt Strike 4.11: Shhhhhh, Beacon is Sleeping….

Posted on

Cobalt Strike 4.11 is now available. This release introduces a novel Sleepmask, a novel process injection technique, new out-of-the-box obfuscation options for Beacon, asynchronous BOFs, and a DNS over HTTPS (DoH) Beacon. Additionally, we have overhauled Beacon’s reflective loader and there are numerous QoL updates. Out-of-the-Box Evasion Overhaul The focus of this release (and the […]

Read More… from Cobalt Strike 4.11: Shhhhhh, Beacon is Sleeping….

Update: Stopping Cybercriminals from Abusing Cobalt Strike

Posted on

Since 2023, Microsoft’s Digital Crimes Unit (DCU), Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC) have been working together to combat the use of unauthorized, legacy copies of Cobalt Strike and compromised Microsoft software, which have been weaponized by cybercriminals to deploy ransomware  and other malware, causing significant harm to critical sectors like […]

Read More… from Update: Stopping Cybercriminals from Abusing Cobalt Strike