In any case, note that the presence of Cobalt Strike can cause various issues.

This tool allows cyber criminals to perform various malicious actions remotely (e.g., upload/download files, record keystrokes, etc.) You can find the full list of features below. These commands essentially connect to a remote server and, after performing a number of actions, ultimately download and install Cobalt Strike into the system. In any case, the opened attachment encourages users to 'Enable Editing' (or to enable macro commands).įurthermore, once the attachment is opened, it immediately runs a number of PowerShell commands in the system background. For instance, one spam campaign that targets Vietnam delivers an attachment called 'Danh Sach Nhan Vien Bien Thu Tien Cong Ty.docx', which roughly translates to 'List of Marine Employee Employees.docx'.Īnother spam campaign, which targets Russian users, delivers an attachment called 'Изменения в системе безопасности.doc Visa payWave.doc', which roughly translates to 'Security Changes Visa payWave.doc'. Spam campaigns differ and often depend on recipients' locations. Research shows that these people send hundreds of thousands of spam emails that contain malicious Microsoft Word attachments designed to inject Cobalt Strike into systems. The tool itself is supposedly used for software testing to find bugs and flaws, however, cyber criminals often take advantage of such tools, and Cobalt Strike is no exception. The Cobalt Strike tool is used to detect system penetration vulnerabilities.

How to install cobalt strike