Hotcobalt – Cobalt Strike DoS Vulnerability Allows Blocking C2 Communication

Recently, a Cobalt Strike DoS vulnerability has been detected by the security analysts at SentinelOne. Cobalt Strike is a legitimate attack frame that is quite popular and is build for Red Team Operations.

According to the report of security analysts, Cobalt Strike denial of service (DoS) vulnerabilities generally enables blocking beacon command-and-control (C2) communication channels and some new deployments.

Apart from this, the security experts of SentinelOne also witnessed various attacks that concern Cobalt Strike Beacons. 

Researchers also discovered the Cobalt Strike Beacon and they responded that they are continuing their investigation so that they can detect all-new methods, modifications, and some ways that will load the Beacon in memory.

Beacon Communications

Since the researchers have found the Beacon communication in the attack, they claimed that the Cobal Strike creates randomly RSA keys, individual and public, that are collected in a file entitled “.Cobalt Strike.beacon_keys.”

Not only this, once the Beacon gets registered with the server, the threat actors can communicate with the Beacon, once the registration is done it starts its works by accepting and replying to “tasks.”

All the tasks are being received over HTTP GET requests, and after that, the Beacon responds with the task data over HTTP POST requests.

Targets on the infrastructure of attackers

After investigating the attack, the experts of SentinelLabs asserted that the DoS vulnerabilities named CVE-2021-36798 and it has affected the most advanced versions of Cobalt Strike.

Even they have also found that in this attack one can register fake beacons along with the server of Cobalt Strike and it also consists of a particular Cobalt Strike installation. 

However, by sending fake tasks to the server, one can easily crash the server by exhausting usable memory. Apart from this, the researchers affirmed that the Cobalt Strike has been used by several hackers for different kinds of motives.

While law enforcement and security researchers can also employ the Hotcobalt vulnerabilities to take down malicious infrastructure.

Source Code Leak & the RCE

In 2016, the Cobalt Strike has been attacked along with HelpSystems and it has been patched in a directory traversal attack vulnerability, and this attack has been lead to remote code execution attacks. 

Apart from this, one of the source codes for the Cobalt Strike toolkit has been leaked in November 2020, and the report pronounced that this leak was re-compiled source code of the 2019 Cobalt Strike 4.0 version.

Since the Cobalt Strike is one of the legitimate attack frameworks, that’s why the experts are trying their best to find all the possible research and tools that with help the users bypass such vulnerabilities.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.