Hacking groups and ransomware operations are transitioning from Cobalt Strike to the newer Brute Ratel post-exploitation toolkit to avoid detection by EDR (Endpoint Detection and Response) and antivirus solutions.
While Cobalt Strike is a legitimate software, hackers have been proliferating cracked versions online. It is thereby one of the most prominent tools used by hackers and ransomware operations to spread laterally through infected corporate networks.
Similar to Cobalt Strike, Brute Ratel is an oppositional attack simulation tool that enables red teamers to deploy ‘Badgers’ (similar to beacons in Cobalt Strike) on remote hosts. These badgers connect back to the attacker’s Command and Control server to receive commands to execute or transmit the output of previously run commands.
In the latest report by Palo Alto Unit 42, researchers have detected hackers shifting from Cobalt Strike to using Brute Ratel as their preferred post-exploitation toolkit.
This shift in strategies is vital as BRc4 is made to evade detection by EDR and antivirus solutions, with virtually every security software not being able to detect it as malicious when first seen in the wild.
In attacks allegedly traced to the Russian state-sponsored hacking group APT29 (aka CozyBear and Dukes), threat actors distribute malicious ISOs (In that were said to contain a submitted résumé (CV).
Once the Brute Ratel badger loads, the hackers can remotely access the compromised device to execute commands and proliferate further in the now-breached network.
Brute Ratel presently costs US$2,500 per user for an annual license, with users asked to provide a business email address which they will need to verify before a license is issued.
Nevertheless, AdvIntel CEO (Chief Executive Officer) Vitali Kremez says that former Conti ransomware members have also begun to obtain licenses through the creation of fake US companies to pass the licensing verification system.
“The criminals behind the former Conti ransomware operations explored multiple penetration testing kits beyond usage of Cobalt Strike,” Kremez added.
For more information, read the original story in Bleeping Computer.