Cobalt Strike, an attack simulation tool used by legitimate red teams and ethical hackers, has been used by malicious threat actors for years. Cracked versions of the software are often distributed on hacker forums to be used as a malicious command-and-control (C2) server for malware and ransomware operations. While Cobalt Strike has been one of the most popular pieces of malware for a long time, a new penetration testing tool named “Brute Ratel C4,” has recently been used by multiple threat actors. Brute Ratel started as a simple C2 server developed part-time by security engineer Chetan Nayak, an ex-penetration tester for both Mandiant and CrowdStrike. In January of 2022, Nayak began working full-time on the project. The first major update features techniques that allowed Brute Ratel to evade most endpoint detection and antivirus software, a service that is extremely valuable to malicious threat actors. When first spotted in the wild, none of the antivirus solutions on the platform VirusTotal detected the Brute Ratel executable as malicious. Threat actors looking to gain access to Brute Ratel had to first pass a manual verification process by submitting an email address with a valid business domain. Researchers from Unit 42 discovered that several threat groups gained access to a license that Nayak claims was leaked by a disgruntled employee and was revoked shortly after. According to the CEO of AdvIntel, former members from the ransomware group Conti have begun acquiring licenses through the verification process by creating fake United States-based companies, indicating that the verification process may not be as strict as it needs to be. This new shift away from Cobalt Strike is a reminder to many endpoint detection and antivirus organizations that new malware is constantly being developed specifically to evade the best anti-malware solutions. With the rise of Brute Ratel being used by threat actors, endpoint detection and antivirus solutions have begun to detect the payload.