S0154 · malware · ATT&CK software
Cobalt Strike
30 actors on record using it
Every mark is an actor ATT&CK records using this software. Red ones also exploit a CVE in CISA KEV.
Open S0154 on attack.mitre.orgCobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.
Read the rest
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.
Source: MITRE ATT&CK, S0154. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Every one of the 30 is a mark on the map. Named now: 1 to 26, most on record first.
- APT41
- APT29
- Sandworm
- Mustang Panda
- Wizard Spider
- Threat Group-3390
- OceanLotus
- menuPass
- FIN7
- Leviathan
- FishMonger
- Graceful Spider
- Chimera
- MirrorFace
- BlackByte
- FIN6
- Storm-0501
- APT37
- ToddyCat
- Cobalt Group
- Aquatic Panda
- Evil Corp
- Play
- Storm-1811
- LuminousMoth
- Cinnamon Tempest
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.