Cobalt Strike

Cobalt Strike is a commercial adversary-simulation platform used by red teams to emulate the tactics of sophisticated attackers during authorized security assessments. Created by security researcher Raphael Mudge, it has become one of the most widely deployed post-exploitation frameworks in both legitimate penetration testing and real-world cybercrime, making it a textbook example of a dual-use security tool.

From Armitage to Cobalt Strike

Mudge originally built Armitage, a free, open-source graphical front end for the Metasploit Framework designed to help students and red teamers visualize targets and launch Metasploit exploits collaboratively. Armitage's last stable release shipped on August 13, 2015. Mudge went on to build Cobalt Strike as a commercially licensed evolution of that work, distributed through his company Strategic Cyber LLC. Cobalt Strike carries forward Armitage's collaborative red-team model but adds a dedicated lightweight agent called Beacon, flexible command-and-control (C2) channels over HTTP, HTTPS, DNS and SMB, and reporting features aimed at professional engagements rather than training exercises.

Corporate Ownership: From Strategic Cyber to Fortra

Cobalt Strike's ownership passed from Strategic Cyber LLC into the HelpSystems group of companies, which had expanded its security portfolio in 2019 by acquiring Core Security. HelpSystems rebranded as Fortra in November 2022, and Fortra remains Cobalt Strike's vendor today, selling it as licensed "adversary simulation software" restricted to vetted security customers.

Legitimate Use: Adversary Simulation

As sold by Fortra, Cobalt Strike is marketed to authorized red teams to "execute targeted attacks and emulate the post-exploitation actions of advanced threat actors," per MITRE ATT&CK's documentation of the tool. Its Beacon payload can run shell commands, PowerShell-equivalent actions, credential-dumping and lateral-movement modules, and integrates with tools like Mimikatz and Metasploit, giving legitimate testers a realistic way to measure an organization's detection and response capability.

Abuse by Ransomware Gangs and APT Groups

The same capabilities that make Cobalt Strike useful to defenders have made it attractive to criminal and state-sponsored operators, usually via cracked, pirated, or improperly obtained licenses rather than legitimate purchase. MITRE ATT&CK documents Cobalt Strike's use by dozens of tracked intrusion sets, including state-linked groups such as APT29, APT32, APT41 and Sandworm Team, and financially motivated groups such as Wizard Spider, FIN7 and LockBit. Leaked internal chat logs from the Conti ransomware gang, reported by security journalist Brian Krebs in March 2022, showed the group spent roughly $60,000 to covertly obtain a licensed Cobalt Strike copy through a front company, since Fortra vets its direct customers.

Industry and Legal Response

On March 31, 2023, the U.S. District Court for the Eastern District of New York issued a court order sought jointly by Microsoft, Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC), authorizing takedown action against malicious infrastructure built on cracked, legacy copies of Cobalt Strike. Microsoft's disclosure of the action, published April 6, 2023, named Conti and LockBit among groups that had abused cracked copies and linked such abuse to the 2021 ransomware attack on Ireland's Health Service Executive. Microsoft reported that within 24 hours, malicious domains named in the case were seized, roughly 153 U.S. domains were sinkholed, and daily detections of cracked Cobalt Strike servers fell substantially in the following months. In July 2024, Fortra and Europol carried out "Operation Morpheus," disrupting roughly 600 IP addresses across 27 countries tied to criminal Cobalt Strike infrastructure. Cobalt Strike's history illustrates the recurring tension around dual-use offensive-security tooling: the same framework that helps organizations find their weaknesses before real attackers do also equips those attackers once a copy escapes authorized distribution.

Timeline

• 2012Raphael Mudge releases Cobalt Strike, a commercially licensed offensive-security platform built on his open-source Armitage GUI for the Metasploit Framework, distributed through his company Strategic Cyber LLC.
• 2015-08-13Armitage, Mudge's original open-source tool, receives its final stable release; Cobalt Strike continues as the actively developed, commercially sold successor.
• 2019HelpSystems acquires Core Security, expanding its offensive-security portfolio; Cobalt Strike's ownership subsequently moves into the HelpSystems corporate family (the precise date Cobalt Strike itself changed hands is inconsistently reported across sources).
• 2022-03Leaked internal chat logs from the Conti ransomware gang, reported by journalist Brian Krebs, reveal the group paid roughly $60,000 to covertly obtain a licensed copy of Cobalt Strike through a front company, since it is sold only to vetted customers.
• 2022-11HelpSystems rebrands as Fortra.
• 2023-03-31The U.S. District Court for the Eastern District of New York issues a court order, sought jointly by Microsoft, Fortra, and Health-ISAC, authorizing takedown action against infrastructure built on cracked, legacy copies of Cobalt Strike.
• 2023-04-06Microsoft publicly details the joint action, naming Conti and LockBit among groups that abused cracked Cobalt Strike copies and linking such abuse to the 2021 ransomware attack on Ireland's Health Service Executive.
• 2024-07Fortra and Europol conduct 'Operation Morpheus,' disrupting roughly 600 IP addresses across 27 countries tied to criminal Cobalt Strike infrastructure.