SLEEPWALKER Malware Uses Raw Packets, DNS and VMware VMCI for Covert Communications
A newly analyzed Windows backdoor named SLEEPWALKER uses a passive command-and-control model designed to evade conventional beaconing-based detections. Raw-p...
Cobalt Strike
C2 Framework
Commercial penetration testing tool widely abused by threat actors as a C2 framework for lateral movement and post-exploitation.
Also known as: cobalt strike, cobaltstrike, beacon
AI Intelligence Brief cached
Related YARA Rules View all on YARA Rules page →
90-Day Activity
All Articles (12)
Last 90 Days
All Time
Over 1,000 Charities Hit by Beacon CRM Data Breach
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. The post Ove...
Beacon CRM Data Breach Exposes Customer Data via Compromised AWS Access Key
Beacon CRM has confirmed that a threat actor likely downloaded a complete copy of its customer database after gaining access to its Amazon Web Services (AWS)...
Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities
CRM provider Beacon has revealed that a compromised AWS access key was the likely root cause of the breach of 1500 UK charities’ data
Healthcare and Victim Support Charities Affected by Beacon Cyber Incident
Beacon has informed around 1500 customer charities that its CRM databases were accessed and likely exfiltrated by an unauthorized actor
Beacon CRM confirms cyberattack exposed UK charity data
Beacon CRM confirmed it was the target of a cyberattack that resulted in the exposure of data belonging to a significant number of UK charities.
Fake Open VSX Extensions Harvest Private Repo and CI Data
77 counterfeit Open VSX extensions beaconed to one domain, 19 harvesting git and CI identity
Detonating Beacons to Illuminate Detection Gaps
Learn how Elastic Security leveraged open-source BOFs to achieve detection engineering goals during our most recent ON week.
Identifying beaconing malware using Elastic
In this blog, we walk users through identifying beaconing malware in their environment using our beaconing identification framework.
Cobalt Strike Beacon Extractor
Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beac...
Extracting Cobalt Strike Beacon Configurations
Part 2 - Extracting configurations from Cobalt Strike implant beacons.
Collecting Cobalt Strike Beacons with the Elastic Stack
Part 1 - Processes and technology needed to extract Cobalt Strike implant beacons