Cobalt Strike

What it is

Cobalt Strike is a commercial adversary-simulation and red-team platform, made by Fortra (acquired 2020; originally created by Raphael Mudge in 2012), that emulates a long-term embedded attacker using the Beacon post-exploitation agent, malleable command-and-control, and a multi-operator team server.

What it helps with

- Emulate advanced threat-actor tactics during authorised red-team and adversary-simulation engagements.
- Operate Beacon with asynchronous “low and slow” callbacks and malleable C2 profiles that reshape network indicators.
- Collaborate on a shared team server with session sharing, event logs and joint reporting.
- Generate payloads, run post-exploitation workflows and produce reports aimed at blue-team training.
- Interoperate with other Fortra offensive products (for example Core Impact and Outflank Security Tooling) where licensed.

Who it's for

Professional red teams, consultancies and in-house offensive security units running authorised adversary simulations — not general hobby use.

Worth knowing

Licensing is commercial and subject to vendor vetting; pricing is quoted per user. The team server is supported on Debian, Ubuntu and Kali Linux; GUI clients run on Windows, macOS and GUI-based Linux (per Cobalt Strike datasheet). Java 17 is required. Use only with explicit authorisation on in-scope systems. Cracked copies are widely abused in the wild, so defenders often detect Beacon patterns — that misuse does not change the legitimate product purpose. Attribution: ownership and history from cobaltstrike.com; platforms from the official datasheet.