Connect with us

Hi, what are you looking for?


Malware & Threats

Europol Announces Crackdown on Cobalt Strike Servers Used by Cybercriminals

European law enforcement agency announces the takedown of nearly 600 Cobalt Strike servers linked to criminal activity.

European law enforcement agency Europol on Wednesday announced a global crackdown against the use of legitimate security tools by cybercriminals, including the takedown of nearly 600 Cobalt Strike servers linked to criminal activity.

The agency said it teamed up with multiple private sector companies to flag known Cobalt Strike servers used by criminal groups and passed that information to online service providers to disable unlicensed versions of the tool. 

“A total of 690 IP addresses were flagged to online service providers in 27 countries. By the end of the week, 593 of these addresses had been taken down,” Europol said.

The cross-border investigation, codenamed Operation Morpheus, was led by the UK National Crime Agency and involved law enforcement authorities from Australia, Canada, Germany, the Netherlands, Poland and the United States. 

Europol said it coordinated the international activity, and liaised with the private partners in a  complex investigation initiated since 2021.

Cobalt Strike, a commercial tool provided by software vendor Fortra, is used legitimately to help IT security staff perform attack simulations that identify weaknesses in security operations and incident responses. 

However, in the wrong hands, Europol said unlicensed copies of Cobalt Strike provide a malicious actor with a wide range of attack capabilities.

The agency said Fortra has worked to prevent the abuse of its software and partnered with law enforcement to protect the legitimate use of its tools. However, in some cases, Europol said cybercriminals have stolen older versions of Cobalt Strike, creating cracked copies to gain backdoor access to machines and deploy malware. 

Advertisement. Scroll to continue reading.

These unlicensed versions of the tool have been connected to multiple malware and ransomware investigations, including those into RYUK, Trickbot and Conti, the agency said.  

Related: Technical, Legal Action Taken to Prevent Abuse of Cobalt Strike

Related: Google Making Cobalt Strike Pentesting Tool Harder to Abuse

Related:Threat Actors Abuse MSBuild for Cobalt Strike Beacon Execution

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

Check Point Software has appointed Nadav Zafrir as Chief Executive Officer

BlackFog has named Brenda Robb as President, John Sarantakes as CRO, and Mark Griffith as VP of Strategic Sales

Former NSA cybersecurity chief Rob Joyce has joined Sandfly Security's Advisory Board.

More People On The Move

Expert Insights