Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption
Summary: Unit 42 detailed how Cobalt Strike's Beacon encrypts system metadata with an RSA public key and sends it to the TeamServer, which decrypts it with the private key and extracts an AES key for further command-and-control traffic. The analysis used a wild sample (SHA256: 50ea11254f184450a7351d407fbb53c54686ce1e62e99c0a41ee7ee3e505d60c) generated by a Cobalt Strike version with leaked RSA private keys, and showed the AES key sits at the eighth byte of the decrypted payload, with a hard-coded IV of abcdefghijklmnop.
Key Takeaway: The sample's Beacon was built from a Cobalt Strike release whose RSA private keys have leaked, which means defenders and attackers alike can decrypt its metadata and recover the AES key protecting the rest of the channel. A single security appliance is not well-suited to stop this, per the source, and the encrypted C2 traffic leaves little fingerprint to detect.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026