Loading malware…
Cobalt Strike Beacon is a Windows post-exploitation implant supplied with the commercial Cobalt Strike adversary-simulation platform. Developed for authorized security assessments, it is also used by state-sponsored espionage groups and financially motivated threat actors. Beacon provides remote command execution, payload execution, file transfer, process and shellcode injection, keystroke logging, screenshot capture, and interactive desktop access. Its post-exploitation functionality includes credential recovery through Mimikatz integration, access-token impersonation, privilege escalation, host and network discovery, port scanning, and lateral movement using service execution, PowerShell, Windows Management Instrumentation, and WinRM.
Beacon supports asynchronous task retrieval and real-time interactive operation. Command-and-control transports include HTTP, HTTPS, DNS, and SMB-based peer-to-peer communication through Windows named pipes. Peer-to-peer chains allow compromised systems to communicate through a parent Beacon rather than connecting directly to external infrastructure. Configurable sleep intervals and jitter control check-in behavior, while Malleable C2 profiles customize network indicators and data transformations to make communications resemble legitimate traffic or other malware. Beacon supports staged and stageless deployment; staged variants are retrieved by a stager and loaded into memory. Operators also deploy it through in-memory droppers, malicious scripts, executables, DLLs, and macro-enabled phishing documents.
Observed users include APT29, APT32, APT41, UNC2165, and UNC2447. APT29 has deployed SMB Beacon during intrusions against diplomatic entities, while APT32 has delivered it through spearphishing-driven infection chains. APT41 has used DUSTPAN to load encrypted Beacon payloads into memory, with command-and-control communications routed through Cloudflare-backed infrastructure or Cloudflare Workers. Beacon is used across espionage and ransomware-related intrusions rather than being restricted to a single actor, industry, or campaign.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
10 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
DUSTPAN ... loads an encrypted BEACON payloads into memory and once executed, communicate to its configured Command and Control (C2) server.
Beacon This red team tool is based on the CobaltStrike beacon. A beacon is a CobaltStrike payload used by adversaries for several goals, such as persistence, execution, privilege escalation, credential dumping, lateral movement, and Command and Control (C2) communication over HTTP, HTTPS, DNS, SMB, and TCP protocols.
UNC2165 also reportedly has used Beacon payloads and a command-and-control (C2) server other information security firms have linked to suspected Evil Corp activity...
"GOVERSHELL has already spawned five variants, including the most recent Beacon malware that could enable PowerShell command execution."
UNC2447 uses the Cobalt Strike BEACON HTTPSSTAGER implant for persistence to communicate with command-and-control (C2) servers over HTTPS...
UNC2198 has used Cobalt Strike BEACON, Metasploit METERPRETER, KOADIC, and PowerShell EMPIRE offensive security tools during this phase as well.
+4 more in the app. View in Mallory
62 distinct techniques documented for this family, organized by ATT&CK tactic.
BEACON C&C domains used by FIN12 have most commonly been registered via NameCheap or Hosting Concepts B.V. d/b/a Openprovider
the group has continued to host a significant proportion of the C&C infrastructure in the networks of Choopa, a U.S.-based VPS hosting provider
The remote script convinced users to download a fake installer, which led to workstations being infected with a Cobalt Strike BEACON backdoor.
ANTSWORD and BLUEBEAM web shells were seen on exposed Tomcat Apache Manager server.
From the onset (mid-2019) to present day, the primary stage 1 delivery vector is phishing and spearphishing emails.
These emails include a maliciously crafted document that has been weaponized to deliver a Cobalt Strike (Beacon) payload.
The TTPs used to distribute BEACON have significant overlaps with UNC2053 distribution campaigns observed between March 2020 and February 2021, including similar lure themes, phishing emails that contain links to malicious PDFs hosted on Google Documents, and the use of legitimate web services for payload hosting.
MITRE ATT&CK Techniques ... T1047 Windows Management Instrumentation
RUN_task.ps1 creates a scheduled task that executes the ransomware payloads five minutes after scheduled task creation.
The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement.
For now the tool rely on PowerShell the execute the final shellcode payload... Generate PowerShell payload to execute on the victim system.
MITRE ATT&CK Techniques ... T1059.003 Command and Scripting Interpreter: Windows Command Shell
“The Base64 encoded ActiveMime data also contained an OLE file with malicious macros.”
MITRE ATT&CK Techniques ... T1072 Software Deployment Tools
Beacon is a C++ implant... Its primary capability beyond standard C2 tasks is BOF (Beacon Object File) execution ... lets operators run compiled C code in-process without touching disk.
“Although the files had ‘.doc’ file extensions, the recovered phishing lures were ActiveMime ‘.mht’ web page archives that contained text and images.”
Named Pipe
"built-in Windows capabilities such as PsExec"; "methods for lateral movement including... PsExec"
RUN_task.ps1 creates a scheduled task that executes the ransomware payloads five minutes after scheduled task creation.
RUN_task.ps1 creates a scheduled task that executes the ransomware payloads five minutes after scheduled task creation.
Usually, the Cobalt Strike beacon injects itself into any running process to evade detection and stay persistent.
DKMC is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode.
Since at least February 2020, FIN12 has leveraged a series of in-memory droppers including, MALTSHAKE, ICECANDLE, WHITEDAGGER, WEIRDLOOP, and templates associated with Cobalt Strike's Artifact Kit to deploy various malware payloads.
"DUSTPAN is an in-memory dropper that decrypts and executes an embedded payload" and "DUSTTRAP... decrypts its Portable Executable (PE) file to execute in memory."
The idea is to avoid sandbox analysis since it's a simple "legit" image.
The Beacon tool utilizes built-in Windows binaries, such as msbuild.exe, Microsoft.Workflow.Compiler.exe, and regsvr32.exe to execute arbitrary payloads... It renames these binaries to avoid name-based detection rules by masquerading.
MITRE ATT&CK Techniques ... T1036.004 Masquerading: Task or Service
MITRE ATT&CK Techniques ... T1036.005 Masquerading: Match Legitimate Name or Location
Usually, the Cobalt Strike beacon injects itself into any running process to evade detection and stay persistent.
DUSTPAN is an in-memory dropper written in C/C++ that decrypts and executes an embedded payload.
Does the spawnto_ value make network connections? Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?
The function GetCurrentProcessId() is used to get all process id along with ThreadId, the GetSystemTimeAsFileTime() to obtain current time. GetStartupInfoA is used to retrieve the content of the STARTUPINFO structure from when the calling process is created.
Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk.
Anti Debugging function IsDebuggerPresent() is used to identify the presence of the debugger by returning a non-zero value. The kernel32 UnhandledExceptionFilter() is also used as an anti-debugging parameter to detect debugger.
FIN12 has frequently leveraged code-signed payloads in their operations.
It was found to be blocking or disabling the system security services to execute the malware flawlessly. This sample was trying to find out the firewall service and terminate it.
The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement.
Get-DataInfo.ps1 is a reconnaissance PowerShell script that has been used regularly by FIN12. This script scans the network to identify all active hosts...
GetUserNameA is used to retrieve the name of the user associated with the thread.
The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement.
victim_info ... process_name
To retrieve the name of the local computer GetComputerNameA API is used.
The malware extracts the name of the files in the current directory.
The function GetCurrentProcessId() is used to get all process id along with ThreadId, the GetSystemTimeAsFileTime() to obtain current time. GetStartupInfoA is used to retrieve the content of the STARTUPINFO structure from when the calling process is created.
Anti Debugging function IsDebuggerPresent() is used to identify the presence of the debugger by returning a non-zero value. The kernel32 UnhandledExceptionFilter() is also used as an anti-debugging parameter to detect debugger.
"methods for lateral movement including RDP"
BeaconSMB : Named pipe communication for peer-to-peer pivoting within compromised networks
MITRE ATT&CK Techniques ... T1072 Software Deployment Tools
"allowing unauthenticated attackers to execute arbitrary code on vulnerable servers via a single crafted HTTP request" / "manipulating prototype chains" / "trigger the `Function()` constructor with attacker-controlled code"
The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement.
"ATT&CK... T1074.002: Remote Data Staging"; "exfiltrate data to their BEACON infrastructure"
The teamserver exposes a full REST and WebSocket API for operator control — credential management, agent tasking, screenshot capture... /screen/image GET Retrieve a screenshot image
The most visible differences between a default profile and a custom profile Beacon configuration are the number of instructions and data transformations, as well as the HTTP parameters used.
HttpOpenRequestA is used to create an HTTP POST request handle. HttpOpenRequestA API is used to send the request to an HTTP server. The malware queries the server to determine the amount of data available using the InternetQueryDataAvailable API.
DUSTPAN loads BEACON into memory and, once executed, it communicates with its configured C2 server; the ATT&CK table lists Web Protocols for Command and Control.
dns-beacon: After Cobalt Strike v4.3, DNS options became part of the dns-beacon transaction. This transaction modifies the DNS C2 communication.
The beacon includes a variety of functions like command execution, keylogging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning, and lateral movement.
Domain fronting is a technique that attempts to disguise the traffic by smuggling data to a well-known service or domain.
“BEACON payloads… communicated using either self-managed infrastructure hosted behind Cloudflare or utilized Cloudflare Workers as their command-and-control (C2) channels.”
With the Cobalt Strike payloads injected, the cybercriminals can then further traverse the target environment (move laterally) or pull-down additional tools and malware.
Figure 14 shows extracted configuration metadata for a custom profile Beacon... includes encoding types... Build Metadata: [7:Metadata, 11,5:tmp ] NETBIOS uppercase Parameter tmp
Next-Generation Firewalls with a Threat Prevention subscription can identify and block Cobalt Strike HTTP C2 requests as well as responses that are masked with the base64 encoding settings of the default profile
shellcode separator “gogo” NetBIOS-encoded beacon terminator “aa”
Third-party Command & Control / External C2 (TCP)
クライアント認証 (TLS) ... HTTPS ... TLS Server Hello
word CRYPTO_SCHEME (1 = disable encryption) at 0x746: 0
MITRE ATT&CK Techniques T1071.001 Application Layer Protocol: Web Protocols T1029 Scheduled Transfer
Cobalt Strike can also be used to directly handle the exfiltration tasks as well, although that is not always the case.
76 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.