Malware

Cobalt Strike

Also known as: Agentemis · BEACON · CobaltStrike · cobeacon

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit. The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.

Indicators of Compromise 41

Domain cms[.]balochistanpolice[.]gov[.]pk Filename !light.bat Filename 360Safe.exe Filename HRSword.exe Filename HRSword.lnk Filename TeamViewer_Host_Setup – <encryptor_2>.exe Filename cms_plugin.exe Filename dark.sys Filename encryptor_1.exe Filename encryptor_2.exe Filename imjp14k.dll Filename pars.vbs Filename result.txt GitHub Repo TalosIntel/IOCs GitHub Repo wtyyvZQY/stU7BU0R MD5 12ec42446db8039e2a2d8c22d7fd2946 MD5 406db41215f7d333db2f2c9d60c3958b MD5 44a64331ec1c937a8385dfeeee6678fd MD5 751f47a688ae075bba11cf0235f4f6ee MD5 8dcf258f66fa0cec1e4a800fa1f6c2a2 MD5 d587724ade76218aa58c78523f6fa14e MD5 f806083c919e49aca3f301d082815b30 IP 142[.]171[.]183[.]8 IP 193[.]42[.]25[.]65 Package AnyDesk Package BypassCredGuard Package Chrome Remote Desktop Package Cobalt Strike Package Cyberduck Package Distant Desktop Package GoToDesk Package NirSoft Package QuickAssist Package ScreenConnect Package SharpDecryptPwd Package SystemBC Package WebBrowserPassView Package WinRAR Package jackson-json Package mimikatz Package netpass

MITRE ATT&CK TTPs 40

OS Credential Dumping

Credential Access

Remote System Discovery

Remote Desktop Protocol

Lateral Movement

SMB/Windows Admin Shares

Lateral Movement

Obfuscated Files or Information

Defense Evasion

System Owner/User Discovery

Network Service Discovery

Exfiltration Over Alternative Protocol

Scheduled Task/Job

Process Injection

Defense Evasion

Process Discovery

Windows Command Shell

Clear Windows Event Logs

Defense Evasion

Command And Control

Command And Control

Defense Evasion

System Information Discovery

File and Directory Discovery

Ingress Tool Transfer

Command And Control

Credential Access

Password Spraying

Credential Access

Modify Registry

Defense Evasion

External Remote Services

Compiled HTML File

Defense Evasion

File and Directory Permissions Modification

Defense Evasion

Windows File and Directory Permissions Modification

Defense Evasion

Domain Trust Discovery

Group Policy Modification

Defense Evasion

Data Encrypted for Impact

Inhibit System Recovery

Transfer Data to Cloud Account

Registry Run Keys / Startup Folder

Disable or Modify Tools

Defense Evasion

Symmetric Cryptography

Command And Control

Source Articles

Cyberespionage campaign PassiveNeuron targets machines running Windows Server | Securelist

The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. It primarily compromises Windows Server machines, often through SQL server exploitation, and deploys custom APT implants such as Neursite and NeuralExecutor. The attackers use a multi-stage DLL loader chain with anti-sandbox techniques and have shifted to using GitHub-based dead drop resolvers for C2 configuration in newer variants. Attribution remains challenging, but TTPs suggest a Chinese-speaking threat actor with low confidence.

Uncovering Qilin attack methods exposed through multiple cases

The Qilin ransomware group, active since 2022 and operating as a Ransomware-as-a-Service (RaaS), has intensified its global operations in 2025, targeting primarily the manufacturing, professional services, and wholesale trade sectors. The group employs a double-extortion strategy, combining file encryption with data exfiltration, leveraging tools such as Mimikatz, Cyberduck, and Cobalt Strike. Initial access is suspected via compromised credentials on exposed VPNs without MFA, followed by extensive reconnaissance, credential dumping, lateral movement, and deployment of dual encryptors to maximize impact.

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Cyber espionage campaigns targeting Pakistani law enforcement agencies, including the Balochistan Police, have been conducted by suspected China- and India-aligned threat actors between February 2024 and April 2026. The attackers exploited web applications such as the Complaint Management System to deploy custom malware, including PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. These operations targeted sensitive data including biometric records, criminal files, and personnel information, with infrastructure overlaps linking some activity to known threat groups like Mysterious Elephant. The compromise of public-facing portals extended the attack surface to both law enforcement and citizens.

hacker-news ·1mo ago

Maven Support Comes to GitHub Checks and OSS Package Search

The Java ecosystem is increasingly targeted by supply chain attacks, as demonstrated by the Shai-Hulud worm's second wave and a malicious lookalike of the Jackson JSON library published to Maven Central. These attacks leverage compromised or freshly published dependencies to deliver payloads such as Cobalt Strike, exploiting the window between publication and detection. Traditional vulnerability scanners are often too slow to respond, making real-time protection critical. StepSecurity now extends its Maven support to GitHub Checks and OSS Package Search to block compromised and newly published malicious Java dependencies during pull requests.

step-security ·2mo ago