iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Operation MORPHEUS disrupted older, unlicensed Cobalt Strike instances linked to criminal activity—not legitimate security testing. In its 3 July 2024 announcement, Europol said authorities flagged 690 IP addresses to service providers in 27 countries and that 593 had been taken down by the end of the action week, held from 24 to 28 June 2024.
What is Cobalt Strike?
Cobalt Strike is commercial security software made by Fortra. Europol describes it as a tool intended to help IT security experts simulate attacks and find weaknesses in security operations and incident response. The software has legitimate uses; the operation focused on criminal abuse of older, unlicensed copies.
Europol said criminals stole older versions and made cracked copies that could provide backdoor access to machines and enable malware deployment. The National Crime Agency (NCA) described a common abuse pattern involving spear-phishing or spam, installation of a Cobalt Strike Beacon, remote access, malware or ransomware delivery, and data theft for extortion. That is the NCA’s description of a route used by criminals, not a sequence established for every incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
Europol connected unlicensed copies to investigations involving RYUK, Trickbot and Conti. That reported association does not establish that every campaign or group identified by those names used Cobalt Strike.
#1 Best Overall
Why did authorities target some Cobalt Strike instances?
Authorities acted against older, unlicensed instances associated with criminal activity. The agencies described a coordinated infrastructure disruption: law enforcement identified known IP addresses and domains used by criminal groups, then notified online service providers so they could disable unlicensed versions of the tool.
The operation’s reported outcomes center on provider notifications and takedowns, not arrests. Europol and the NCA did not report arrests as an outcome of this action. The figures also do not show that all criminal use stopped; they describe the infrastructure identified and disrupted during the operation.
Who led Operation MORPHEUS?
The NCA led the investigation, which began in 2021. Europol coordinated the international activity and liaised with private-sector partners. The operational week ran from 24 to 28 June 2024, and Europol published its announcement on 3 July 2024.
Participating authorities
Europol named law-enforcement authorities from Australia, Canada, Germany, the Netherlands, Poland, the United Kingdom and the United States as participants. It separately listed Bulgaria, Estonia, Finland, Lithuania, Japan and South Korea as supporting the disruption. These are distinct roles in Europol’s account.
Rank #3
Private-sector contribution
Europol named BAE Systems Digital Intelligence, Trellix, Spamhaus, abuse.ch and The Shadowserver Foundation as industry partners. Europol said they contributed enhanced scanning, telemetry and analytical capabilities. The NCA also described real-time threat intelligence shared through the Malware Information Sharing Platform (MISP).
How many addresses were taken down?
Europol reported that 690 IP addresses were flagged to providers in 27 countries and 593 had been taken down by the end of the action week. These are reported IP-address figures—not counts of unique criminal operators, victims or prosecutions.
The NCA described the same 690 count as individual malicious instances located at 129 internet service providers in 27 countries. It also noted server takedowns and abuse notifications from law-enforcement and industry partners. The different wording matters: Europol reports IP addresses flagged, while the NCA characterizes the count as individual instances.
Recommended Free Tools
What else did agencies report?
Europol said that over the course of the investigation—not just during the June 2024 action week—more than 730 pieces of threat intelligence containing almost 1.2 million indicators of compromise were shared. Europol also reported that its European Cybercrime Centre (EC3) organized more than 40 coordination meetings.
Best Value
In a later follow-up, Fortra reported that the number of unauthorized Cobalt Strike copies it observed in the wild had fallen by 80% over two years. Fortra also said it had seized and sinkholed more than 200 malicious domains, and that average observed dwell time had fallen below one week in the United States and below two weeks worldwide. Those are Fortra’s company-reported observations and should not be read as Europol’s measurements or as totals from the June action week.
Does the crackdown affect licensed security testing?
Operation MORPHEUS targeted criminal abuse of unlicensed copies, not licensed use for legitimate security testing. NCA Director of Threat Leadership Paul Foster said: “Although Cobalt Strike is a legitimate piece of software, sadly cybercriminals have exploited its use for nefarious purposes.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
