#CobaltStrike

Cobalt Strike is a commercial adversary simulation and red-team framework developed by Fortra (formerly Strategic Cyber LLC). It pairs a Team Server with a Beacon implant that runs on a target machine, supporting HTTP, HTTPS, DNS and named-pipe C2. It is licensed for legitimate red-team engagements, but pirated and cracked copies dominate the wild and are routinely deployed by APTs, ransomware affiliates and initial access brokers as the second stage after phishing or exploit landing pages.

Possessing and operating an officially licensed Cobalt Strike copy for authorised red-team work is legal. Distributing, possessing or running cracked Cobalt Strike copies is not. The IOCs on this page are extracted from public threat-research tweets and tag servers that researchers have observed in real-world intrusions; vendor licensing status is not asserted for any specific IP, domain or hash.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Cobalt Strike-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this Cobalt Strike subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.