Malware

Vermilion Strike

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.004Unix ShellEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Stealth

1 technique

T1620Reflective Code LoadingEvidence1

This is a 32-bit EXE sample that shares a C2 IP address (160.202.163[.]100). This is a stager that will fetch a DLL from the C2 over HTTP and execute it in-memory.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence1

Next, the beacon will fingerprint network information through the getifaddrs function. It will loop through the interfaces looking for IPv4 addresses.

T1033System Owner/User DiscoveryEvidence1

Next, the beacon will fingerprint the entry in the local password database for information about the current effective user ID of the process.

T1082System Information DiscoveryEvidence1

The beacon will begin fingerprinting the machine. A random number will be generated and the process ID will be fetched. It will grab the kernel version of the machine using uname.

T1083File and Directory DiscoveryEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

The stealthy sample uses Cobalt Strike’s Command and Control (C2) protocol when communicating to the C2 server and has Remote Access capabilities such as uploading files, running shell commands and writing to files.

T1071.001Web ProtocolsEvidence1

Command and Control is primarily performed over DNS but also available over HTTP.

T1071.004DNSEvidence1

Command and Control is primarily performed over DNS but also available over HTTP. This DNS-based approach for communications can help avoid traditional defenses that monitor HTTP traffic. Commands are received via DNS Address (A) and Text (TXT) records.

T1095Non-Application Layer ProtocolEvidence1

Vermilion Strike has a third way of communicating with the C2 server via ICMP ping messages. The malware adds the current pid to the offset 0x4 in the header and the encrypted payload is sent as data in the ICMP packet.

T1105Ingress Tool TransferEvidence1

This is a 32-bit EXE sample that shares a C2 IP address (160.202.163[.]100). This is a stager that will fetch a DLL from the C2 over HTTP and execute it in-memory.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

intezer blogNews

Jan 1, 2026

Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike

A Linux and Windows re-implementation of Cobalt Strike Beacon written from scratch. It uses Cobalt Strike’s C2 protocol and provides remote access capabilities including uploading files, running shell commands, writing to files, changing directories, listing files, and communicating primarily over DNS with HTTP support and partial ICMP capability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Vermilion Strike

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.004Unix ShellEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Stealth

1 technique

T1620Reflective Code LoadingEvidence1

This is a 32-bit EXE sample that shares a C2 IP address (160.202.163[.]100). This is a stager that will fetch a DLL from the C2 over HTTP and execute it in-memory.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence1

Next, the beacon will fingerprint network information through the getifaddrs function. It will loop through the interfaces looking for IPv4 addresses.

T1033System Owner/User DiscoveryEvidence1

Next, the beacon will fingerprint the entry in the local password database for information about the current effective user ID of the process.

T1082System Information DiscoveryEvidence1

The beacon will begin fingerprinting the machine. A random number will be generated and the process ID will be fetched. It will grab the kernel version of the machine using uname.

T1083File and Directory DiscoveryEvidence1

Tasks that the beacon can perform are: Change working directory Get current working directory Append/write to file Upload file to C2 Execute command via popen Get disk partitions List files

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

T1071.001Web ProtocolsEvidence1

Command and Control is primarily performed over DNS but also available over HTTP.

T1071.004DNSEvidence1

T1095Non-Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

This is a 32-bit EXE sample that shares a C2 IP address (160.202.163[.]100). This is a stager that will fetch a DLL from the C2 over HTTP and execute it in-memory.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

intezer blogNews

Jan 1, 2026

Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.