Disrupting Cracked Cobalt Strike

Published: Aug. 14, 2024, 7:10 a.m.

On this week's episode of The Microsoft Threat Intelligence Podcast, we discuss the collaborative effort between Microsoft and Fortra to combat the illegal use of cracked Cobalt Strike software, which is commonly employed in ransomware attacks. \xa0To break down the situation, our host, Sherrod DeGrippo, is joined by Richard Boscovich, Assistant General Counsel at Microsoft, Jason Lyons, Principal Investigator with the DCU, and Bob Erdman, Associate VP Research and Development at Fortra. The discussion covers the creative use of DMCA notifications tailored by geographic region to combat cybercrime globally. The group express their optimism about applying these successful techniques to other areas, such as phishing kits, and highlight ongoing efforts to make Cobalt Strike harder to abuse. \xa0\xa0\n\xa0\n\nIn this episode you\u2019ll learn:\xa0\xa0\xa0\xa0\xa0\xa0\n\xa0\xa0\n\nThe impact on detection engineers due to the crackdown on cracked Cobalt Strike\xa0\n\nExtensive automation used to detect and dismantle large-scale threats\xa0\n\nHow the team used the DMCA creatively to combat cybercrime\xa0\n\n\xa0\n\nSome questions we ask:\xa0\xa0\xa0\xa0\xa0\n\xa0\xa0\n\n\xa0Do you encounter any pushback when issuing DMCA notifications?\xa0\n\n\xa0How do you plan to proceed following the success of this operation?\xa0\n\n\xa0Can you explain the legal mechanisms behind this take-down?\xa0\n\n\xa0\n\nResources:\xa0\xa0\nView Jason Lyons on LinkedIn\xa0\nView Bob Erdman on LinkedIn\xa0\xa0\xa0\nView Richard Boscovich on LinkedIn\xa0\xa0\nView Sherrod DeGrippo on LinkedIn\xa0\xa0\n\n\xa0\n\nRelated Microsoft Podcasts:\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\xa0\n\n\nAfternoon Cyber Tea with Ann Johnson\xa0\n\n\nThe BlueHat Podcast\xa0\n\n\nUncovering Hidden Risks\xa0\xa0\xa0\xa0\xa0\n\n\xa0\nDiscover and follow other Microsoft podcasts at microsoft.com/podcasts\xa0\xa0\n\xa0\nGet the latest threat intelligence insights and guidance at Microsoft Security Insider\xa0\n\xa0\n\xa0\nThe Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.