Loading story…
Researchers traced command-and-control infrastructure used in a malicious email campaign targeting Ukraine to multiple Cobalt Strike servers and customized Malleable C2 profiles designed to evade detection. The activity, described in CERT-UA alert #4490, involved malicious Microsoft Office macros attempting to deploy Cobalt Strike Beacon, while follow-on analysis identified at least eight distinct malleable profiles across the related infrastructure. Two 2022 profiles stood out: a common jQuery-themed profile and a rarer "minimal defender bypass" profile using the URI /apiv8/getStatus, with the latter sharing watermark 1580103824 across several domains and suggesting a clustered operator footprint.
The reporting shows how Cobalt Strike’s profile customization can make beacon traffic resemble legitimate web activity and frustrate signature-based detection, especially when operators alter HTTP, HTTPS, or DNS transaction patterns instead of relying on default Beacon behavior. Investigators also found operational consistency in the campaign’s infrastructure, including concentration at a small set of hosting providers and registrars such as HostKey and Eranet, and identified an additional related domain, furfen[.]com, beyond those listed in the original alert. Together, the findings indicate a coordinated effort to tailor C2 traffic and reuse infrastructure in attacks against Ukrainian targets.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
On April 18, 2022, CERT-UA published alert #4490 describing a malicious email campaign targeting Ukraine. The emails attempted to deploy Cobalt Strike beacons through malicious Microsoft Office macros and included C2 indicators such as domains and IP addresses.
On March 16, 2022, Palo Alto Networks Unit 42 published research explaining how default and customized Malleable C2 profiles shape Cobalt Strike Beacon traffic and complicate detection. The article included examples of in-the-wild default-profile and customized-profile samples.
IronNet said it had longitudinal monitoring data on the Cobalt Strike command-and-control servers later referenced in the Ukraine campaign analysis starting in May 2021.
In its follow-on analysis of the CERT-UA indicators, IronNet found at least eight malleable profiles across the referenced infrastructure and identified furfen[.]com as an additional domain sharing the rare /apiv8/getStatus URI and watermark 1580103824 pattern. The company also described three activity clusters over the prior 15 months and a 2022 cluster containing 35 similar domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
mandiant.com
Open sourceironnet.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Vermilion Strike**, a from-scratch reimplementation of **Cobalt Strike Beacon** for both Linux and Windows that was used in targeted intrusions and assessed as likely supporting espionage activity. The malware reused Cobalt Strike’s command-and-control protocol while adding remote access capabilities including command execution, file upload, and file writing. Intezer linked the Linux and Windows variants through shared C2 infrastructure, overlapping functionality, and similar internal version strings, while telemetry indicated the operation had been active since at least 2021 against telecommunications companies, government agencies, IT firms, financial institutions, and advisory organizations worldwide. Analysis of the Linux ELF variant showed it was initially undetected on VirusTotal, appeared tailored to **Red Hat-based** systems such as CentOS 7, and relied primarily on **DNS beaconing** with additional **HTTP** support and partially implemented **ICMP** C2. Reverse engineering found the sample decrypted an embedded Malleable C2 profile with XOR key `0x69`, collected host metadata, encrypted it with an RSA public key, and used DNS TXT responses for tasking before issuing HTTP GET requests in a hybrid DNS/HTTP model. Investigators tied activity to domains including `update.microsoftkernel.com` and `update.microsofthk.com`, which resolved to `160.202.163.100`, and observed victim systems beaconing to the infrastructure months before public disclosure.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
A financially motivated cybercrime group has launched Operation FrostBeacon, a sophisticated malware campaign targeting business-to-business (B2B) enterprises across the Russian Federation. The attackers use a dual infection strategy: one method involves phishing emails containing archive files with malicious LNK shortcuts disguised as PDF documents, which, when executed, trigger hidden PowerShell commands to download further payloads. The second method exploits unpatched legacy vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882, embedded in malicious DOCX and RTF documents. Both infection chains ultimately execute a remote HTML Application (HTA) file, which launches an obfuscated PowerShell loader to deploy Cobalt Strike beacons, granting persistent access to compromised networks. The campaign primarily targets legal, finance, logistics, industrial production, construction, and technical departments within Russian B2B organizations. Attackers leverage Russian-controlled domains for command-and-control infrastructure and employ customized Cobalt Strike malleable profiles to evade detection. Seqrite Labs reports that over 20 initial infection files have been observed, with multiple infection chains and infrastructure components identified in the wild. The operation demonstrates a high level of technical sophistication and persistence, posing a significant threat to Russian corporate environments reliant on outdated security postures.
Jun 29, 2026