Tracking Cobalt Strike Servers Used in Cyberattacks on Ukraine

One of the ways Cobalt Strike operators obfuscate communications between a beacon planted on a victim system and the C2 server is through the use of a malleable profile, that allows masquerading the beacon communication as benign network traffic.