European law enforcement agency Europol on Wednesday announced a global crackdown against the use of legitimate security tools by cybercriminals, including the takedown of nearly 600 Cobalt Strike servers linked to criminal activity.
The agency said it teamed up with multiple private sector companies to flag known Cobalt Strike servers used by criminal groups and passed that information to online service providers to disable unlicensed versions of the tool.
“A total of 690 IP addresses were flagged to online service providers in 27 countries. By the end of the week, 593 of these addresses had been taken down,” Europol said.
The cross-border investigation, codenamed Operation Morpheus, was led by the UK National Crime Agency and involved law enforcement authorities from Australia, Canada, Germany, the Netherlands, Poland and the United States.
Europol said it coordinated the international activity, and liaised with the private partners in a complex investigation initiated since 2021.
Cobalt Strike, a commercial tool provided by software vendor Fortra, is used legitimately to help IT security staff perform attack simulations that identify weaknesses in security operations and incident responses.
However, in the wrong hands, Europol said unlicensed copies of Cobalt Strike provide a malicious actor with a wide range of attack capabilities.
The agency said Fortra has worked to prevent the abuse of its software and partnered with law enforcement to protect the legitimate use of its tools. However, in some cases, Europol said cybercriminals have stolen older versions of Cobalt Strike, creating cracked copies to gain backdoor access to machines and deploy malware.
These unlicensed versions of the tool have been connected to multiple malware and ransomware investigations, including those into RYUK, Trickbot and Conti, the agency said.
Related: Technical, Legal Action Taken to Prevent Abuse of Cobalt Strike
Related: Google Making Cobalt Strike Pentesting Tool Harder to Abuse
Related:Threat Actors Abuse MSBuild for Cobalt Strike Beacon Execution
