Ransomware, Hacking Groups Transition To Brute Ratel From Cobalt Strike

Share post:

Hacking groups and ransomware operations are transitioning from Cobalt Strike to the newer Brute Ratel post-exploitation toolkit to avoid detection by EDR and antivirus solutions.

While Cobalt Strike is a legitimate software, hackers have been proliferating cracked versions online. It is thereby one of the most prominent tools used by hackers and ransomware operations to spread laterally through infected corporate networks.

Similar to Cobalt Strike, Brute Ratel is an oppositional attack simulation tool that enables red teamers to deploy ‘Badgers’ (similar to beacons in Cobalt Strike) on remote hosts. These badgers connect back to the attacker’s Command and Control server to receive commands to execute or transmit the output of previously run commands.

In the latest report by Palo Alto Unit 42, researchers have detected hackers shifting from Cobalt Strike to using Brute Ratel as their preferred post-exploitation toolkit.

This shift in strategies is vital as BRc4 is made to evade detection by EDR and antivirus solutions, with virtually every security software not being able to detect it as malicious when first seen in the wild.

In attacks allegedly traced to the Russian state-sponsored hacking group APT29 (aka CozyBear and Dukes), threat actors distribute malicious ISOs that were said to contain a submitted résumé (CV).

Once the Brute Ratel badger loads, the hackers can remotely access the compromised device to execute commands and proliferate further in the now-breached network.

Brute Ratel presently costs $2,500 per user for an annual license, with users asked to provide a business email address which they will need to verify before a license is issued.

Nevertheless, AdvIntel CEO Vitali Kremez says that former Conti ransomware members have also begun to obtain licenses through the creation of fake US companies to pass the licensing verification system.

“The criminals behind the former Conti ransomware operations explored multiple penetration testing kits beyond usage of Cobalt Strike,” Kremez added.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs


Related articles

Cyber Security Today, April 24, 2024 – Good news/bad news in Mandiant report, UnitedHealth admits paying a ransomware gang, and more

This episode reports on the danger of using expired open-source packages, a tool used by a Russian hacking group and passw

Google Play introduces new biometric verification with a user warning

Google has recently announced updates to the biometric verification process for Google Play purchases, aiming to bolster security...

Cyber Security Today, Week in Review for week ending Friday April 19, 2024

On this episode Jen Ellis, co-chair of the Ransomware Task Force, talks about ways of fighting one of the biggest cyber threats to IT d

Cyber Security Today, April 19, 2024 – Police bust phishing rental platform, a nine-year old virus found on Ukrainian computers, and more

This episode reports on a threat actor targeting governments in the Middle East with a novel way of hiding malware is going international

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways