{"schema":"aeternae-malware-metadata/v1","generated_at":"2026-10-08T07:56:41+00:00","total_matching":1,"page":1,"page_size":200,"records":[{"id":"f0d6c69d353838d9391e3e7f19d0563106ec72cd910b8353ba34482f719328e8","kind":"reference","title":"Cobalt Strike - S0154","family":"Cobalt Strike - S0154","category":"Malware intelligence","summary":"Name of ATT&CK software | [Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, remote access tool that bills itself as \u201cadversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors\u201d. Cobalt Strike\u2019s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed","first_seen":1664360926,"last_seen":1729684263,"created_at":1791430477,"updated_at":1791439814,"source_count":1,"data":{"context":"2024/10/highlighting-ta866-asylum-ambuscade.json","tags":["misp:name=\"Malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\"","misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/09/new-campaign-uses-government-union.json","https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/breaking_the_silence_truebot_activity.json","https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json","https://github.com/Cisco-Talos/IOCs/blob/main/2023/07/malicious-campaigns-target-entities-in-ukraine-poland.json","https://github.com/Cisco-Talos/IOCs/blob/main/2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.json","https://github.com/Cisco-Talos/IOCs/blob/main/2024/10/highlighting-ta866-asylum-ambuscade.json"],"filenames":[],"features":[],"related_cves":[],"labels":["Cobalt Strike - S0154"]},"observations":[{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2024/10/highlighting-ta866-asylum-ambuscade.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1729684263,"fetched_at":1791439814,"data":{"context":"2024/10/highlighting-ta866-asylum-ambuscade.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2024/10/highlighting-ta866-asylum-ambuscade.json"],"family":"Cobalt Strike - S0154"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/breaking_the_silence_truebot_activity.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1670504795,"fetched_at":1791434031,"data":{"context":"2022/12/breaking_the_silence_truebot_activity.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/breaking_the_silence_truebot_activity.json"],"family":"Cobalt Strike - S0154"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2022/09/new-campaign-uses-government-union.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1664360926,"fetched_at":1791430477,"data":{"context":"2022/09/new-campaign-uses-government-union.json","tags":["misp:name=\"Malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/09/new-campaign-uses-government-union.json"],"family":"Cobalt Strike - S0154"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2023/07/malicious-campaigns-target-entities-in-ukraine-poland.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1689246000,"fetched_at":1791438167,"data":{"context":"2023/07/malicious-campaigns-target-entities-in-ukraine-poland.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2023/07/malicious-campaigns-target-entities-in-ukraine-poland.json"],"family":"Cobalt Strike - S0154"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1671535541,"fetched_at":1791434072,"data":{"context":"2022/12/xlling-in-excel-malicious-add-ins.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json"],"family":"Cobalt Strike - S0154"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.json","source_label":"Cobalt Strike - S0154","evidence_class":"provider_reported","confidence":null,"observed_at":1722355016,"fetched_at":1791439684,"data":{"context":"2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"Cobalt Strike - S0154\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.json"],"family":"Cobalt Strike - S0154"}}],"indicators":[]}]}