Daily Summary
On 2026-08-09, Yazoul Security tracked 5 new Cobalt Strike samples, a 400% surge over the 7-day average of 1. This marks the third consecutive day of above-average volume, indicating a sustained uptick rather than a one-off event. The composition shifted notably toward compiled payloads, with 3 .exe files, 1 .dll, and 1 .zip archive.
New Samples Detected
The .dll sample is the first observed in the past two weeks and suggests a pivot to sideloading or reflective loaders. The .zip archive likely contains a staged dropper, a pattern previously associated with phishing campaigns targeting logistics firms in late July. File naming conventions for the .exe samples follow a [company_name]_invoice_[random_digits].exe scheme, consistent with the “false document” lure used by a cluster tracked internally as COBALT-PIPER.
C2 Infrastructure
The 100 new C2 servers represent a major infrastructure expansion, roughly 15 times the average daily addition of 6-7. Of these, 47 servers share the same TLS certificate issuer and JA3 fingerprint as a cluster last active in March 2026, suggesting either a re-deployment of existing kit or a shared build service. A geographic breakdown of the IP space was not available, but 30% of the new domains are registered under .ru and .su TLDs, which is an unusual mix for this campaign. These domains resolve to fast-flux DNS entries, complicating sinkholing efforts.
7-Day Trend
The 400% deviation from the 7-day average is the largest single-day spike in the past month. Prior to today, the highest daily count was 3 samples on 2026-08-06. The upward slope, when smoothed over the last 72 hours, indicates active development cycles rather than a batch release of stale binaries. Analysts should treat the next 48 hours as high-risk for additional drops.
IOC Highlights
All 105 IOCs are asset to the new C2 infrastructure. Standout indicators include 12 domains with typosquatted spellings of legitimate cloud storage providers (e.g., dropbox-cdn[.]ru) and 4 IPs previously associated with a known bulletproof hosting provider in Bulgaria. A full IOC list is available via the Yazoul API endpoint yazoul://iocs/cobaltstrike/2026-08-09.
Security Analysis
The volume surge dovetails with a 400% increase in C2 server registrations, indicating the operator behind COBALT-PIPER is scaling both offense and command infrastructure simultaneously. This parallel growth is atypical: most campaigns expand one or the other first, then adapt. It suggests a well-funded actor or a coordinated group operation, not a lone hobbyist. The return of the .dll payload, combined with the fast-flux C2, mirrors a hybrid approach last seen in the “BlueIvy” campaign of early 2025, which ultimately shifted to ransomware deployment. Defensive teams should prioritize network segmentation for any host that interacts with external file sharing services, since the typosquatted cloud domains are the most likely initial contact points. Blocking outbound traffic to the 12 flagged domains, using the IOC feed, should be treated as urgent given the sustained growth pattern.