Covert Delivery of Cobalt Strike Beacon via Sophos Phishing Website
Tags
cmtmf-attack-pattern: Command And Scripting Interpreter Masquerading
maec-delivery-vectors: Watering Hole
attack-pattern: Data Command And Scripting Interpreter - T1623 Javascript - T1059.007 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Command-Line Interface - T1059 Deobfuscate/Decode Files Or Information - T1140 Indirect Command Execution - T1202 Masquerading - T1036 Standard Non-Application Layer Protocol - T1095 Powershell - T1086 User Execution - T1204 Masquerading User Execution
Show in Graph
Common Information
Type Value
UUID 3f77efd8-dd23-4ce2-bb6a-cbd305820dcf
Fingerprint 88c3a7a229391b48
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 15, 2023, midnight
Added to db Oct. 23, 2023, 7:24 a.m.
Last updated Nov. 18, 2024, 1:38 a.m.
Headline Covert Delivery of Cobalt Strike Beacon via Sophos Phishing Website
Title Covert Delivery of Cobalt Strike Beacon via Sophos Phishing Website
Detected Hints/Tags/Attributes 61/3/13
Source URLs
Redirection Url
Details Source https://cyble.com/blog/covert-delivery-of-cobalt-strike-beacon-via-sophos-phishing-website/
URL Provider
Details Provider Source level domain
Details cyble.com cyble.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
sopbos.com
Details File 1209 
powershell.exe
Details md5 1 
c974ffe23d57ec909ef26b55f202047e
Details sha1 1 
ec6da5616d6b3b3269fababe104bfe04f2828717
Details sha256 1 
067c95ad074afd8993281b02f74d0f257fb312943da0887355da652afb54c0ab
Details IPv4 1 
98.71.232.223
Details MITRE ATT&CK Techniques 409 
T1566
Details MITRE ATT&CK Techniques 420 
T1204
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 60 
T1202
Details MITRE ATT&CK Techniques 348 
T1036
Details MITRE ATT&CK Techniques 504 
T1140
Details MITRE ATT&CK Techniques 159 
T1095