Thursday, March 28, 2024

Hotcobalt – Cobalt Strike DoS Vulnerability Allows Blocking C2 Communication

Recently, a Cobalt Strike DoS vulnerability has been detected by the security analysts at SentinelOne. Cobalt Strike is a legitimate attack frame that is quite popular and is build for Red Team Operations.

According to the report of security analysts, Cobalt Strike denial of service (DoS) vulnerabilities generally enables blocking beacon command-and-control (C2) communication channels and some new deployments.

Apart from this, the security experts of SentinelOne also witnessed various attacks that concern Cobalt Strike Beacons. 

Researchers also discovered the Cobalt Strike Beacon and they responded that they are continuing their investigation so that they can detect all-new methods, modifications, and some ways that will load the Beacon in memory.

Beacon Communications

Since the researchers have found the Beacon communication in the attack, they claimed that the Cobal Strike creates randomly RSA keys, individual and public, that are collected in a file entitled “.Cobalt Strike.beacon_keys.”

Not only this, once the Beacon gets registered with the server, the threat actors can communicate with the Beacon, once the registration is done it starts its works by accepting and replying to “tasks.”

All the tasks are being received over HTTP GET requests, and after that, the Beacon responds with the task data over HTTP POST requests.

Targets on the infrastructure of attackers 

After investigating the attack, the experts of SentinelLabs asserted that the DoS vulnerabilities named CVE-2021-36798 and it has affected the most advanced versions of Cobalt Strike.

Even they have also found that in this attack one can register fake beacons along with the server of Cobalt Strike and it also consists of a particular Cobalt Strike installation. 

However, by sending fake tasks to the server, one can easily crash the server by exhausting usable memory. Apart from this, the researchers affirmed that the Cobalt Strike has been used by several hackers for different kinds of motives.

While law enforcement and security researchers can also employ the Hotcobalt vulnerabilities to take down malicious infrastructure.

Source Code Leak & the RCE

In 2016, the Cobalt Strike has been attacked along with HelpSystems and it has been patched in a directory traversal attack vulnerability, and this attack has been lead to remote code execution attacks. 

Apart from this, one of the source codes for the Cobalt Strike toolkit has been leaked in November 2020, and the report pronounced that this leak was re-compiled source code of the 2019 Cobalt Strike 4.0 version.

Since the Cobalt Strike is one of the legitimate attack frameworks, that’s why the experts are trying their best to find all the possible research and tools that with help the users bypass such vulnerabilities.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles