Fortra doing a victory lap claiming they've cut illicit Cobalt Strike usage by 80% is one thing.
CTI analysts uncritically parroting this ridiculous claim is quite another. Cobalt Strike usage is down because EDRs got better at identifying it specifically. Fortra is AT BEST a minor contributor here.
Jake Williams
npub1td…3m87v
2025-03-10 13:58:40 UTC
Author Public Key
npub1tdhytknt93um3pympngl3jqkd8k9ma7meuj6n4p3clz3amztxyes23m87vSeen on
wss://relay.momostr.pinkPublished at
2025-03-10 13:58:40 UTCEvent JSON
{
"id": "db1bc10abbcb846e72e8c267bbf26b4da4c9a84408d086b5ce6f200421e5a1d6",
"pubkey": "5b6e45da6b2c79b8849b0cd1f8c81669ec5df7dbcf25a9d431c7c51eec4b3133",
"created_at": 1741615120,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@malwarejake/114138488544055311",
"web"
],
[
"proxy",
"https://infosec.exchange/users/malwarejake/statuses/114138488544055311",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/malwarejake/statuses/114138488544055311",
"pink.momostr"
],
[
"-"
]
],
"content": "Fortra doing a victory lap claiming they've cut illicit Cobalt Strike usage by 80% is one thing.\n\nCTI analysts uncritically parroting this ridiculous claim is quite another. Cobalt Strike usage is down because EDRs got better at identifying it specifically. Fortra is AT BEST a minor contributor here.",
"sig": "27003362754a089b81b418e7cac6ed790b13530500c9d1b74c3f63c044c713a056809f49d149bda43fa0ebf1d255ae8a943764ab3c1adde32a782dc5f42417cd"
}