BokuLoader

BokuLoader : Cobalt Strike リフレクティブローダー Cobalt Strikeのエイベージョン機能を再現、統合、強化することを目的とした、概念実証（PoC）のユーザー定義リフレクティブローダー（UDRL）です。 貢献者:...

CoffeeLdr

CoffeeLdr CoffeeLdr は、いわゆる Beacon Object Files 用のローダーです。 このプロジェクトは、Cobalt Strike フレームワークを使わずに Beacon Object Files をテストするために使用できるほか、 Cobalt Strike 向けに設計された BOF を実行する手段をカスタムインプラントに提供するためにも使用できます。 ただし、Beacon API の関数（fork&run およびインジェクション）のほとんどは、カスタム実装用に空になっています。 やること x86 オブジェクトファイルのサポート クレジット...

cs-get-last-error

cs-get-last-error 直接通过 GetLastError 错误码在 Cobalt Strike 客户端内获取错误消息，无需借助 Google 搜索、net helpmsg 或 Microsoft Error Lookup Tool。错误消息内置于 aggressor 脚本中，无需与 beacon 进行交互。 该 aggressor 脚本由 windows-lasterror-json 文件自动生成并更新。 用法示例 root@kitploit: beacon ls //does-not-exists/c$ Tasked beacon to list files in...

cs-token-vault

Cobalt Strike 用 Token Vault BOF この Beacon Object File BOF は、窃取・複製した Windows アクセストークンをインメモリ上に保存する機能を提供します。これにより、以下のことが可能になります。 窃取済みトークンを再複製せずにホットスワップ/再利用する。 ユーザーがログアウトした場合に備えて、トークンを後で使えるよう保存しておく。 インストール 1. 最新リリースの build をダウンロードするか、make all でビルドします。 2. token-vault.cna アグレッサスクリプトを Cobalt Strike...

Burp2Malleable

Burp2Malleable Burp SuiteのHTTPリクエストをCobalt StrikeのMalleable C2プロファイルに変換するために書いた、手軽なPythonユーティリティです。 トラフィックをどのように見せたいか/溶け込ませたいかに応じて、BurpSuite（またはZAP、POSTMANなど）でキャプチャ/作成したリクエストを取得し、CobaltStrikeのMalleable C2プロファイルに変換します。オペレーターはデータの保存場所と形式を選択できるため、トラフィックを可能な限りクリーンに見せることができます。...

CVE-2026-1801C

CVE-2026-1801C QUANTUM-SHIFT / CVE-2026-180A7 BAL-JUMP: Analisi Statica delle Euristiche di Input di Movimento in Source 2 server.dll Abstract Questo documento presenta un'analisi statica di reverse-engineering di due routine di verifica del movimento lato client implementate nel motore di...

cobaltstrike-headless

Headless Strike Script Aggressor che trasforma il client aggressor headless in un client Cobalt Strike per lo più funzionante. Utilizzo connettiti al tuo teamserver tramite l'utility headless aggressor integrata ./agscript root@kitploit: ./agscript host port user password carica il file .cna...

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark , said the...

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

Introduction During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader. What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional...

Fake verification pages are stealing Steam accounts from players

Online gamers should watch out for a convincing scam that aims to steal your Steam account. The scam uses fake FACEIT verification pages that look legitimate, complete with official branding, working links, and what appears to be a real Steam login window. By the time it asks for your password,...

DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets

The U.S. Department of Justice DoJ on Wednesday announced the results of a sweeping action undertaken by government authorities and private sector companies to combat cyber-enabled and cryptocurrency fraud targeting Americans. The "Disruption Week" operation began May 18, 2026, leading to the...

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System LMS popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon. The vulnerability, tracked as...

MS16-032-Cobalt-Strike-LPE-BOF

MS16-032 Beacon Object File BOF A Cobalt Strike Beacon Obje...

CVE-2018-25344

10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration key input field that allows local attackers to execute arbitrary code by triggering a structured exception handler overwrite. Attackers can craft a malicious registration key string...

CVE-2018-25345 10-Strike Network Scanner 3.0 Local Buffer Overflow SEH

10-Strike Network Scanner 3.0 contains a local buffer overflow vulnerability in the host name field that allows attackers to bypass SafeSEH protections and execute arbitrary code. Attackers can craft a malicious payload in the host name or address field and trigger the vulnerability through the...

Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware

The Belarus-aligned threat actor known as Ghostwriter aka UAC-0057 and UNC1151 has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country. The activity, per the Computer Emergency Response Team of Ukraine CERT-UA,...

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particular...

10-Strike LANState 缓冲区错误漏洞

10-Strike LANState is a Windows network tool developed by the American company 10-Strike. It is used for network topology scanning, device visualization, and management. Version 8.8 of 10-Strike LANState contains a buffer error vulnerability. This vulnerability stems from improper handling of...

APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2

Cybersecurity researchers have disclosed details of an advanced persistent threat APT group dubbed Silver Dragon that has been linked to cyber attacks targeting entities in Europe and Southeast Asia since at least mid-2024. "Silver Dragon gains its initial access by exploiting public-facing...

CVE-2020-37142 10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)

10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigg...