“Cobalt Strike and Metasploit have both played a role in threat activity for quite some time, Metasploit being open (source),” said Devon Kerr, director at Elastic Security Labs. “But we also see new flavors of open-source malware available to the folks. Silver, in particular, made a really big showing this year.”

Kerr further explained that these tools are particularly attractive to adversaries with minimal technical capabilities. “They can go deploy these tools, and in some environments, they’ll work automatically, and in others, with some modification, they’ll be successful,” Kerr said.

Furthermore, it complicates the process of accurately attributing the origin of these malicious activities, Kerr added.