Loading story…
Cisco Talos disclosed Manjusaka, an offensive framework used in the wild and marketed by its developers as an alternative to Cobalt Strike and Sliver. The toolkit includes a Go-based ELF command-and-control server with a Simplified Chinese interface and Rust-based implants for both Windows and Linux. Talos found a publicly accessible C2 binary on GitHub capable of generating customized payloads, and reported that the Windows implant supports broad remote-access and post-compromise functions including command execution, file management, screenshot capture, browser and Wi-Fi credential theft, Navicat credential theft, and host reconnaissance.
Talos also tied the framework to a multi-stage intrusion campaign that used COVID-19-themed Microsoft Word lures referencing Golmud City in Qinghai Province. That infection chain ultimately deployed a Cobalt Strike beacon, while investigators also observed a Manjusaka implant communicating with the same infrastructure, including IP address 39.104.90.45, indicating operational overlap between the tools. Talos stopped short of firm attribution, but said available indicators suggest the framework developer is Chinese-speaking and may be based in Guangdong, China.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A GitHub IOC entry documented Manjusaka's internal packaging and unpacking, including raw-deflated hex-encoded blobs and a change from version 05 onward that moved EXE and ELF binaries into a plugins folder. The publication also listed hashes, infrastructure, user-agent strings, domains, URLs, and forensic indicators associated with Manjusaka artifacts observed in the wild.
Talos found a publicly available Manjusaka command-and-control binary and repository on GitHub at github.com/YDHCUI/manjusaka. The C2 could generate customized Rust-based payloads for Windows and Linux.
Cisco Talos reported a new offensive framework called Manjusaka being used in the wild and marketed by its developers as similar to Cobalt Strike. Talos identified a Go-based ELF C2 server with a Simplified Chinese interface and Rust-based implants for Windows and Linux.
During the campaign investigation, Talos found a Manjusaka implant communicating with the same IP address, 39.104.90.45, used by the Cobalt Strike beacon. This indicated the same threat actor was using both Cobalt Strike and Manjusaka implants.
Cisco Talos investigated a malicious campaign using COVID-19-themed Microsoft Word documents referencing Golmud City in Qinghai Province. The infection chain used a VBA macro, Metasploit shellcode, and ultimately loaded a Cobalt Strike beacon communicating with 39.104.90.45.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.talosintelligence.com
Open sourcetalos-intelligence-site.s3.amazonaws.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Researchers identified **Vermilion Strike**, a from-scratch reimplementation of **Cobalt Strike Beacon** for both Linux and Windows that was used in targeted intrusions and assessed as likely supporting espionage activity. The malware reused Cobalt Strike’s command-and-control protocol while adding remote access capabilities including command execution, file upload, and file writing. Intezer linked the Linux and Windows variants through shared C2 infrastructure, overlapping functionality, and similar internal version strings, while telemetry indicated the operation had been active since at least 2021 against telecommunications companies, government agencies, IT firms, financial institutions, and advisory organizations worldwide. Analysis of the Linux ELF variant showed it was initially undetected on VirusTotal, appeared tailored to **Red Hat-based** systems such as CentOS 7, and relied primarily on **DNS beaconing** with additional **HTTP** support and partially implemented **ICMP** C2. Reverse engineering found the sample decrypted an embedded Malleable C2 profile with XOR key `0x69`, collected host metadata, encrypted it with an RSA public key, and used DNS TXT responses for tasking before issuing HTTP GET requests in a hybrid DNS/HTTP model. Investigators tied activity to domains including `update.microsoftkernel.com` and `update.microsofthk.com`, which resolved to `160.202.163.100`, and observed victim systems beaconing to the infrastructure months before public disclosure.
Aug 15, 2026
Japanese security researchers reported that **menuPass (`APT10`)** targeted multiple organizations in Japan with new spearphishing campaigns that delivered **Cobalt Strike Beacon** in memory, marking the first observed case of the group using the framework. One infection chain used an encrypted executable attachment that unpacked a loader DLL and **AES-encrypted shellcode**; another used a macro-enabled document inside an encrypted ZIP archive to download staged scripts and shellcode disguised as a bitmap file. The malware ultimately beaconed to attacker-controlled infrastructure, including `95.128.168[.]227`, while attempting to blend into normal web traffic. The activity aligns with broader reporting on Asian intrusion campaigns in which advanced threat actors relied on **Cobalt Strike** and stealthy post-compromise tradecraft to maintain access inside enterprise networks. In the Japan-focused campaign, operators spoofed `Host` headers for `en.wikipedia.org` and used a self-signed certificate containing "wikipedia" fields to mask command-and-control traffic, underscoring a shift toward more covert tooling and infrastructure designed to evade detection during targeted espionage operations.
Aug 15, 2026