Skip to content
Threat Feed
Subscribe

Tag

Cobalt-Strike

3 briefs RSS
high threat

Cobalt Strike Command and Control Beacon Detection

Adversaries, notably FIN7, deploy Cobalt Strike beacons on compromised systems to establish command and control (C2) channels, utilizing specific network activity algorithms and domain naming conventions for communication over protocols like HTTP or TLS, posing a critical risk of further compromise and data exfiltration.

Cobalt Strike FIN7 +2 command-and-control malware network-traffic cobalt-strike threat-detection
1r 2t
critical advisory

KnowledgeDeliver ViewState Deserialization Vulnerability Exploitation

An unauthenticated remote code execution vulnerability, CVE-2026-5426, in Digital Knowledge's KnowledgeDeliver LMS platform due to shared ASP.NET machine keys allows attackers to inject malicious code, ultimately leading to Cobalt Strike infection of user workstations.

KnowledgeDeliver viewstate-deserialization rce web-shell cobalt-strike cve-2026-5426
2r 4t 1c
high threat

Cobalt Strike Command and Control Beacon Detected

This brief documents the detection of Cobalt Strike command and control activity through identifying specific domain naming conventions used by its implant beacons, indicative of network attack and exploitation campaigns.

packetbeat +2 FIN7 +2 command-and-control cobalt-strike domain-generation-algorithm
2r 2t