Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Hunt.io tracks a Cobalt Strike team server whose Golang beacon relayed C2 through Visual Studio Code dev tunnels—an uncommon tactic—via a TLS cert shared across 50+ IPs and the 100000 watermark.

Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.

Part 3 of the Cobalt Strike series: the C2 dashboard automates discovery—certificate matching, header analysis and protocol inspection track 800–1,000 active servers with 90% validation confidence.

Part 2 of the Cobalt Strike series: ten-plus HuntSQL recipes for detecting, grouping and tracking C2 infrastructure by certificate reuse, beacon traits and enrichment—from real hunting scenarios.