Wednesday, April 17, 2024

Hotcobalt – Cobalt Strike DoS Vulnerability Allows Blocking C2 Communication

Recently, a Cobalt Strike DoS vulnerability has been detected by the security analysts at SentinelOne. Cobalt Strike is a legitimate attack frame that is quite popular and is build for Red Team Operations.

According to the report of security analysts, Cobalt Strike denial of service (DoS) vulnerabilities generally enables blocking beacon command-and-control (C2) communication channels and some new deployments.

Apart from this, the security experts of SentinelOne also witnessed various attacks that concern Cobalt Strike Beacons. 

Researchers also discovered the Cobalt Strike Beacon and they responded that they are continuing their investigation so that they can detect all-new methods, modifications, and some ways that will load the Beacon in memory.

Beacon Communications

Since the researchers have found the Beacon communication in the attack, they claimed that the Cobal Strike creates randomly RSA keys, individual and public, that are collected in a file entitled “.Cobalt Strike.beacon_keys.”

Not only this, once the Beacon gets registered with the server, the threat actors can communicate with the Beacon, once the registration is done it starts its works by accepting and replying to “tasks.”

All the tasks are being received over HTTP GET requests, and after that, the Beacon responds with the task data over HTTP POST requests.

Targets on the infrastructure of attackers 

After investigating the attack, the experts of SentinelLabs asserted that the DoS vulnerabilities named CVE-2021-36798 and it has affected the most advanced versions of Cobalt Strike.

Even they have also found that in this attack one can register fake beacons along with the server of Cobalt Strike and it also consists of a particular Cobalt Strike installation. 

However, by sending fake tasks to the server, one can easily crash the server by exhausting usable memory. Apart from this, the researchers affirmed that the Cobalt Strike has been used by several hackers for different kinds of motives.

While law enforcement and security researchers can also employ the Hotcobalt vulnerabilities to take down malicious infrastructure.

Source Code Leak & the RCE

In 2016, the Cobalt Strike has been attacked along with HelpSystems and it has been patched in a directory traversal attack vulnerability, and this attack has been lead to remote code execution attacks. 

Apart from this, one of the source codes for the Cobalt Strike toolkit has been leaked in November 2020, and the report pronounced that this leak was re-compiled source code of the 2019 Cobalt Strike 4.0 version.

Since the Cobalt Strike is one of the legitimate attack frameworks, that’s why the experts are trying their best to find all the possible research and tools that with help the users bypass such vulnerabilities.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles