Cobalt Strike attribution: what it means for ransomware defenders

TL;DR: Infrastructure attribution linked a single ransomware affiliate across LockBit, Black Basta, Qilin and The Gentlemen, using CountLoader, two Cobalt Strike watermarks and a 76-day lead on a known C2 IP, according to Silent Push research. The real control problem is not brand tracking but consistent infrastructure and credential hunting before affiliates switch labels again.

Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “What Recent Reporting Gets Right About The Gentlemen RaaS and What Silent Push Learned Months Earlier”.

By the numbers:

• Silent Push flagged 91.107.247[.]163 as a Cobalt Strike C2 on February 8, 2026, 76 days before Check Point identified it in a The Gentlemen intrusion.
• Silent Push identified two Cobalt Strike watermarks, 1473793097 and 1357776117, tied to a single ransomware affiliate.

Key questions

Q: What fails when ransomware affiliates move across multiple RaaS brands but keep the same infrastructure?

A: The failure is treating brand names as the primary investigative unit.

Q: Why do internet-facing VPN and firewall appliances remain such a common ransomware entry point?

A: They remain attractive because they sit at the boundary of remote access and trust.

Q: How do security teams know if ransomware detections are catching the right stage?

A: Look for detections that fire before mass file encryption, especially on account creation, task scheduling, shadow copy deletion, and boot configuration changes.

Practitioner guidance

• Hunt for loader and beacon reuse across campaigns Correlate CountLoader variants, Cobalt Strike watermarks, and repeated C2 infrastructure to identify the same affiliate operating under different RaaS brands.
• Review internet-facing VPN and firewall exposure Prioritise patching and configuration review for edge appliances that provide remote access because the article identifies them as the preferred initial access path.
• Add C2 fingerprints to detection pipelines Push confirmed malicious IPs, domains, and beacon identifiers into firewall, SIEM, and EDR workflows so blocking happens before an intrusion matures.

Bottom line: The article shows that ransomware attribution is increasingly a matter of infrastructure and tooling continuity, not just public group names.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →