Wednesday, April 23, 2025
HomeCyber Security NewsHotcobalt - Cobalt Strike DoS Vulnerability Allows Blocking C2 Communication

Hotcobalt – Cobalt Strike DoS Vulnerability Allows Blocking C2 Communication

Published on

SIEM as a Service

Follow Us on Google News

Recently, a Cobalt Strike DoS vulnerability has been detected by the security analysts at SentinelOne. Cobalt Strike is a legitimate attack frame that is quite popular and is build for Red Team Operations.

According to the report of security analysts, Cobalt Strike denial of service (DoS) vulnerabilities generally enables blocking beacon command-and-control (C2) communication channels and some new deployments.

Apart from this, the security experts of SentinelOne also witnessed various attacks that concern Cobalt Strike Beacons. 

- Advertisement - Google News

Researchers also discovered the Cobalt Strike Beacon and they responded that they are continuing their investigation so that they can detect all-new methods, modifications, and some ways that will load the Beacon in memory.

Beacon Communications

Since the researchers have found the Beacon communication in the attack, they claimed that the Cobal Strike creates randomly RSA keys, individual and public, that are collected in a file entitled “.Cobalt Strike.beacon_keys.”

Not only this, once the Beacon gets registered with the server, the threat actors can communicate with the Beacon, once the registration is done it starts its works by accepting and replying to “tasks.”

All the tasks are being received over HTTP GET requests, and after that, the Beacon responds with the task data over HTTP POST requests.

Targets on the infrastructure of attackers 

After investigating the attack, the experts of SentinelLabs asserted that the DoS vulnerabilities named CVE-2021-36798 and it has affected the most advanced versions of Cobalt Strike.

Even they have also found that in this attack one can register fake beacons along with the server of Cobalt Strike and it also consists of a particular Cobalt Strike installation. 

However, by sending fake tasks to the server, one can easily crash the server by exhausting usable memory. Apart from this, the researchers affirmed that the Cobalt Strike has been used by several hackers for different kinds of motives.

While law enforcement and security researchers can also employ the Hotcobalt vulnerabilities to take down malicious infrastructure.

Source Code Leak & the RCE

In 2016, the Cobalt Strike has been attacked along with HelpSystems and it has been patched in a directory traversal attack vulnerability, and this attack has been lead to remote code execution attacks. 

Apart from this, one of the source codes for the Cobalt Strike toolkit has been leaked in November 2020, and the report pronounced that this leak was re-compiled source code of the 2019 Cobalt Strike 4.0 version.

Since the Cobalt Strike is one of the legitimate attack frameworks, that’s why the experts are trying their best to find all the possible research and tools that with help the users bypass such vulnerabilities.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit NFC Technology to Steal Money from ATMs and POS Terminals

In a disturbing trend, cybercriminals, predominantly from Chinese underground networks, are exploiting Near Field...

Threat Actors Leverage TAG-124 Infrastructure to Deliver Malicious Payloads

In a concerning trend for cybersecurity, multiple threat actors, including ransomware groups and state-sponsored...

Ransomware Actors Ramp Up Attacks Organizations with Emerging Extortion Trends

Unit 42’s 2025 Global Incident Response Report, ransomware actors are intensifying their cyberattacks, with...

New SMS Phishing Attack Weaponizes Google AMP Links to Evade Detection

Group-IB’s High-Tech Crime Trends Report 2025 reveals a sharp 22% surge in phishing websites,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Exploit NFC Technology to Steal Money from ATMs and POS Terminals

In a disturbing trend, cybercriminals, predominantly from Chinese underground networks, are exploiting Near Field...

Threat Actors Leverage TAG-124 Infrastructure to Deliver Malicious Payloads

In a concerning trend for cybersecurity, multiple threat actors, including ransomware groups and state-sponsored...

Ransomware Actors Ramp Up Attacks Organizations with Emerging Extortion Trends

Unit 42’s 2025 Global Incident Response Report, ransomware actors are intensifying their cyberattacks, with...