Threats Tagged 'cobalt strike beacon'

Since February 2026, there has been a resurgence of attacks abusing Node.js, targeting government, technology, and hospitality sectors. Attackers use the legitimate, signed node.exe binary to execute malicious JavaScript payloads, bypassing signature-based detection. Notable incidents include compromises of an Asian technology company and a U.S. fintech firm, involving advanced techniques such as EtherHiding and deployment of Rust-based backdoors linked to ransomware operations. Multiple attacks involve ModeloRAT, associated with initial access broker Woodgnat, connected to various ransomware families. Attackers combine living-off-the-land tactics with commodity malware and employ ClickFix techniques for initial access.

MediumMalwareUnited States#node.js abuse#cobalt strike#adaptixc2

The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, El Salvador, Australia, and the Philippines. The infection methods evolved over time, using NSIS installers, Metasploit downloaders, and Cobalt Strike Beacons. The attackers employed clever techniques to evade detection, including the abuse of legitimate software and the use of multiple C2 servers. The article provides a comprehensive timeline of the attack, describes the different execution chains, and offers guidance on detecting traces of the attack.

MediumMalwareGermanyFranceUnited Kingdom+4#mgbot#supply-chain#cobalt strike beacon

A Pakistan-linked APT group conducted two campaigns targeting Indian government entities. The Gopher Strike campaign used PDFs with malicious links to deliver an ISO file containing GOGITTER, a Golang downloader that fetches payloads from private GitHub repositories. GITSHELLPAD, a Golang backdoor, was used for C2 communication via GitHub. GOSHELL, a Golang shellcode loader, deployed Cobalt Strike Beacon on specific hostnames. The attackers used various techniques including scheduled tasks for persistence, obfuscation, and environmental keying. Post-compromise activities involved system reconnaissance and data exfiltration. The campaign demonstrated sophisticated TTPs and custom-built tools, indicating a potentially new subgroup or parallel Pakistan-linked threat actor.

MediumMalwareIndiaUnited KingdomGermany+2#government#cobalt strike#india

APT24, a Chinese threat actor, has conducted a three-year cyber espionage campaign using BADAUDIO, a highly obfuscated first-stage downloader. The group has evolved from broad strategic web compromises to more sophisticated tactics, including supply chain attacks and targeted phishing. They compromised a Taiwanese digital marketing firm, affecting over 1,000 domains. APT24 uses advanced techniques like control flow flattening, fingerprinting, and covert data exfiltration. The malware integrates with Cobalt Strike Beacon and employs DLL Search Order Hijacking for execution. The campaign demonstrates the actor's persistent and adaptive capabilities, highlighting the growing sophistication of Chinese cyber threats.

MediumCampaignGermanyFranceUnited Kingdom+5#badaudio#phishing#obfuscation

A sophisticated cyberattack campaign targeted the Russian IT industry and other entities globally in late 2024. The attackers used social media profiles and popular websites to deliver payload information, bypassing detection methods. They employed spear phishing emails with malicious RAR archives, exploiting DLL hijacking techniques to deploy Cobalt Strike Beacon. The campaign used profiles on GitHub, Microsoft Learn Challenge, Quora, and Russian social networks to conceal activities. The attacks primarily focused on Russian companies but also affected organizations in China, Japan, Malaysia, and Peru. The complexity of the methods used highlights the evolving tactics of threat actors in concealing well-known tools and emphasizes the need for robust cybersecurity measures.

MediumMalwareRussiaGermanyFrance+4#cobalt strike beacon#cobalt strike#api obfuscation

A sophisticated malware campaign is targeting financial services in Hong Kong with SquidLoader, a highly evasive malware that deploys Cobalt Strike Beacon for remote access. The malware exhibits advanced anti-analysis, anti-sandbox, and anti-debugging techniques, achieving near-zero detection rates on VirusTotal. The attack chain is complex and poses a significant threat to targeted organizations. The analysis provides detailed technical insights into SquidLoader's features and indicators of compromise, including SHA256 hashes for samples found in Hong Kong, Singapore, China, and Australia. The campaign utilizes multiple command and control servers, primarily mimicking Kubernetes API endpoints.

MediumMalwareUnited KingdomGermanyFrance+6#squidloader#cobalt strike#cobalt strike beacon

Malware campaigns exploiting vulnerabilities in Ivanti Connect Secure devices, specifically CVE-2025-0282, have been active from December 2024 through July 2025. Attackers use MDifyLoader to side-load Cobalt Strike Beacon DLLs, along with vshell RAT and Fscan network scanner, to maintain persistent access. Initial access is gained via brute-force attacks, direct exploitation, and stolen credentials. The threat actors employ advanced lateral movement, persistence mechanisms such as domain account creation and malware service/task registration, and evasion techniques including use of legitimate files and ETW bypasses. European organizations using Ivanti Connect Secure devices are particularly targeted. The threat is assessed as medium severity due to moderate impact and exploitation complexity. No public exploits are currently available.

CriticalMalwareGermanyFranceNetherlands+7#cobalt strike#fscan#cobalt strike beacon