2025-04-26 –, Seminar Room 7
Cobalt Strike started as a legitimate red team tool for simulating adversarial attacks; however, its powerful capabilities have made it a frequent target for abuse by APT groups, hacktivists, and cybercriminals. This talk outlines an automated, large-scale approach to harvesting Cobalt Strike payloads from VirusTotal and de-obfuscating them to extract key Indicators of Compromise (IOCs). By analysing these beacons at scale, we transform raw malware data into actionable threat intelligence—helping defenders stay one step ahead of adversaries who exploit Cobalt Strike for malicious gain.
Although Cobalt Strike was originally developed for ethical hacking and red teaming, the platform’s robust features have increasingly drawn the attention of malicious actors. From state-sponsored APTs to hacktivists and cybercriminals, adversaries leverage Cobalt Strike for sophisticated and stealthy attacks. In this session, we will demonstrate our end-to-end process for:
- Continuously harvesting Cobalt Strike payloads from VirusTotal
- Automating the de-obfuscation of extracted samples
- Identifying and extracting key IOCs, such as C2 infrastructure and configuration details
We will walk through the custom scripts and tooling that power this pipeline, sharing the challenges and lessons learned in scaling up analysis. Attendees will see how to convert vast quantities of malware data into timely, actionable intelligence to enhance detection, incident response, and overall security posture. By studying these real-world payloads, defenders can better understand how threat actors abuse Cobalt Strike and apply those insights to fortify their defences.
Ben is massive cyber-nerd, with a passion for creative defence-evasion techniques, reverse-engineering malware and fighting adversaries! He currently works full time in a SOC for Accenture/Context Information Security. In his spare time you'll find him dissecting malware captured in his honeypots, pwning boxes and recording his solutions for his YouTube, or enjoying a pint in the pub.