In July 2026, IIJ identified PIVOTPIPE, an unofficial .NET-based beacon payload similar in functionality to Cobalt Strike Beacon. It communicates with C2 servers using configurations close to default profiles and supports numerous C2 commands. PIVOTPIPE differentiates itself through unique detection evasion mechanisms, including AMSI bypass, indirect syscalls, sleep masking, custom loaders, and obfuscated strings. The tool comprises two components: a loader that implements evasion techniques and a RAT module. It supports TCP and SMB Beacon modes enabling peer-to-peer communication across compromised hosts. Debug artifacts indicate the tool was still in development at discovery, implying ongoing enhancements.

PIVOTPIPE enables attackers to maintain stealthy command and control communications with compromised systems, leveraging advanced evasion techniques to bypass security controls such as AMSI and EDR solutions. Its support for peer-to-peer communication via SMB Beacon functionality allows lateral movement within networks. The presence of a RAT module facilitates remote access and control of infected hosts. As the tool is under development, its capabilities may expand, potentially increasing its threat impact.

No official patches or vendor advisories are available for PIVOTPIPE, as it is an unofficial and newly discovered tool. Organizations should monitor for indicators of compromise such as the provided hashes and YARA signature to detect the presence of PIVOTPIPE components. Employing behavioral detection techniques that identify AMSI bypass, indirect syscalls, and unusual SMB traffic may help mitigate risk. Since the tool is still under development, maintaining updated endpoint protection and network monitoring is advisable. Patch status is not yet confirmed—check vendor advisories and threat intelligence sources for updates.