Cybersecurity Victory: Cracked Cobalt Strike Versions Slashed by 80%

At a glance

Cracked copies down 80%

Fortra, the company that makes Cobalt Strike, said in March 2025 that unauthorized, cracked copies of the tool seen in the wild had dropped by 80% over roughly two years. Cobalt Strike is a legitimate tool for penetration testing and red-team work. Criminals have long used pirated versions of it to break into networks and stage ransomware attacks.

Who ran the takedowns

Fortra worked with Microsoft’s Digital Crimes Unit and the Health Information Sharing and Analysis Center (Health-ISAC), along with law enforcement. Together they seized and sinkholed more than 200 malicious domains and took down servers running cracked copies. Fortra said the time it takes to get such servers removed has fallen to under a week in the U.S. and under two weeks elsewhere.

The work also fed into Operation MORPHEUS, a 2024 law enforcement action led by the UK’s National Crime Agency, which flagged hundreds of IP addresses used by criminals for takedown. The partners said they would keep up the pressure on criminals who abuse legitimate security tools.

What fewer cracked copies means

Fewer cracked copies should mean fewer attacks that rely on them. That’s the hope.

The effort has also drawn attention to software piracy as a security problem. Taking pirated tools away from criminals makes defenders’ jobs easier.

Disrupting access to tools like this won’t stop attacks on its own, since criminals will look for other tools. It does raise their costs.

The next targets

The takedown model could be used against other abused tools. Tech companies, government agencies and security researchers will need to keep working together, with common procedures and better detection, to stay ahead.

Use only licensed, verified security tools. Pirated copies of red-team software have a long history of shipping with their own backdoors, so whoever runs one could end up giving a stranger the same access they planned to test.

A model for future takedowns

Cutting cracked Cobalt Strike copies by 80% is a real win against cybercrime. It took years of coordinated work by a vendor, a tech company, an industry group and police, and it shows what that kind of cooperation can do. Keeping the numbers down will take the same persistence.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.