Detecting Popular Cobalt Strike Malleable C2 Profile Techniques
Summary: Unit 42 researchers identified two internet-hosted Cobalt Strike Team Server instances, at 23.95.44[.]80:80 and 35.224.140[.]15:443, and extracted previously unpublished Malleable C2 profiles from the Beacon binaries they hosted. The operators disguised command-and-control traffic by modifying HTTP URLs, header parameters and host headers to mimic well-known domains, and in one case hosted the Team Server on a prominent public cloud provider.
Key Takeaway: Detection logic that trusts ranked popular domains in Host headers or allow-listed cloud provider IPs is exactly what these profiles are built to exploit, and the ASN record for the destination IP is what exposed the deception in one sample.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026