Loading story…
Researchers identified Vermilion Strike, a from-scratch reimplementation of Cobalt Strike Beacon for both Linux and Windows that was used in targeted intrusions and assessed as likely supporting espionage activity. The malware reused Cobalt Strike’s command-and-control protocol while adding remote access capabilities including command execution, file upload, and file writing. Intezer linked the Linux and Windows variants through shared C2 infrastructure, overlapping functionality, and similar internal version strings, while telemetry indicated the operation had been active since at least 2021 against telecommunications companies, government agencies, IT firms, financial institutions, and advisory organizations worldwide.
Analysis of the Linux ELF variant showed it was initially undetected on VirusTotal, appeared tailored to Red Hat-based systems such as CentOS 7, and relied primarily on DNS beaconing with additional HTTP support and partially implemented ICMP C2. Reverse engineering found the sample decrypted an embedded Malleable C2 profile with XOR key 0x69, collected host metadata, encrypted it with an RSA public key, and used DNS TXT responses for tasking before issuing HTTP GET requests in a hybrid DNS/HTTP model. Investigators tied activity to domains including update.microsoftkernel.com and update.microsofthk.com, which resolved to 160.202.163.100, and observed victim systems beaconing to the infrastructure months before public disclosure.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Netbytesec published analysis of a Linux malware sample described as a customized Cobalt Strike beacon that primarily used DNS for command and control. The report documented zero VirusTotal detections at upload time, Red Hat-based compatibility, and C2 domains resolving to 160.202.163.100.
Telemetry shared with McAfee Enterprise ATR indicated the Linux Vermilion Strike threat had been active since August 2021. The activity targeted telecommunications companies, government agencies, IT companies, financial institutions, and advisory firms worldwide.
Intezer discovered a Linux ELF implementation of Cobalt Strike Beacon in August 2021 and named it Vermilion Strike. The company later linked it to related Windows samples as part of a cross-platform re-implementation used in targeted intrusions.
Splunk telemetry cited by Netbytesec indicated several client servers had been beaconing to the malware's command-and-control infrastructure since April 2021. This marks the earliest explicit evidence in the references of the activity in the wild.
Intezer reported that Linux and Windows Vermilion Strike samples shared command-and-control infrastructure, overlapping functionality, and similar internal version strings. It assessed the malware as a from-scratch re-implementation of Cobalt Strike Beacon likely used by a skilled espionage actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced command-and-control infrastructure used in a malicious email campaign targeting Ukraine to multiple **Cobalt Strike** servers and customized **Malleable C2** profiles designed to evade detection. The activity, described in **CERT-UA alert `#4490`**, involved malicious Microsoft Office macros attempting to deploy Cobalt Strike Beacon, while follow-on analysis identified at least eight distinct malleable profiles across the related infrastructure. Two 2022 profiles stood out: a common jQuery-themed profile and a rarer **"minimal defender bypass"** profile using the URI `/apiv8/getStatus`, with the latter sharing watermark `1580103824` across several domains and suggesting a clustered operator footprint. The reporting shows how Cobalt Strike’s profile customization can make beacon traffic resemble legitimate web activity and frustrate signature-based detection, especially when operators alter HTTP, HTTPS, or DNS transaction patterns instead of relying on default Beacon behavior. Investigators also found operational consistency in the campaign’s infrastructure, including concentration at a small set of hosting providers and registrars such as **HostKey** and **Eranet**, and identified an additional related domain, `furfen[.]com`, beyond those listed in the original alert. Together, the findings indicate a coordinated effort to tailor C2 traffic and reuse infrastructure in attacks against Ukrainian targets.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026