Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Attackers Exploiting Public Cobalt Strike Profiles

Summary: Unit 42 researchers found three malicious Cobalt Strike Beacon samples whose Malleable C2 profiles were copied from a single public repository example, ocsp.profile, with only small edits such as changing /oscp/ to /ocsp/ or /download/ and updating the User-Agent string from Microsoft-CryptoAPI/6.1 to versions 7.0 and 8.1. One stageless 64-bit Windows sample used a C2 domain, www.consumershop.lenovo.com.cn.d4e97cc6.cdnhwcggk22[.]com, whose leading subdomain mimics a well-known technology company while the actual parent domain is cdnhwcggk22[.]com.

What you should know: Because attackers can copy a public profile and change a few characters to defeat header-pattern detections, the detection arms race imposes its cost more heavily on the defender than the attacker, and false positives from heuristic detections are skewed against the defender as well.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026