Loading story…
Researchers published detection guidance for the open-source PoshC2 command-and-control framework, emphasizing that operators who leave default settings in place can expose distinctive indicators across network and host telemetry. Reported network indicators include default HTTP(S) beacon URL patterns, static 200 and 404 responses, a default self-signed TLS certificate, predictable beacon timing, and TLS fingerprinting opportunities using JA3 and server-side JA3S techniques to identify characteristic client and server handshake behavior.
On endpoints, the guidance highlighted suspicious loading of System.Management.Automation.dll or mscoree.dll into unmanaged processes, repeated PowerShell ScriptBlock logging artifacts, and default process migration into netsh.exe. Researchers also pointed to persistence artifacts such as Wallpaper777, Wallpaper555, Wallpaper666, and IEUpdate autoruns, along with binary traits including the VoidFunc DLL entry point and YARA-detectable signatures, and said a GitHub repository was created to track PoshC2 indicators of compromise and detections over time.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Nettitude Labs published detection guidance and indicators of compromise for the PoshC2 command-and-control framework, including network, host, persistence, and binary artifacts. The article also introduced the PoshC2 Detections GitHub repository and stated the IoCs corresponded to PoshC2 version 6.0.
Salesforce Engineering published research on TLS fingerprinting with JA3 and JA3S, providing the fingerprinting approach later referenced for identifying PoshC2 implants.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026
Security researchers described how defenders can use passive OSINT sources to identify and cluster malicious internet infrastructure, particularly HTTP(S)-based command-and-control servers, by analyzing artifacts left behind in headers, response bodies, passive DNS records, and TLS certificates. The reporting highlights that attacker operational mistakes, infrastructure automation, and efforts to mimic legitimate services often create repeatable fingerprints that can be searched at scale across internet-exposed hosts. Censys demonstrated the approach with examples including **Cobalt Strike** servers that expose a characteristic HTTP `404` response pattern and infrastructure linked to **APT29** malware such as **WellMess** and **WellMail**, which could be tracked through distinctive self-signed certificate distinguished names. The guidance recommends combining host telemetry with certificate and DNS data, preserving historical results, and documenting queries so security teams can build durable visibility into adversary infrastructure and uncover related systems over time.
Aug 15, 2026
Multiple security researchers published new technical details on how **Cobalt Strike Beacon** can be modified and concealed during post-exploitation, while also outlining ways defenders can decode and detect its traffic. TrustedSec showed that Beacon’s XOR-obfuscated configuration blob can be altered in memory at runtime to change settings such as the **user-agent**, sleep and jitter values, HTTP verbs, spawn-to paths, ports, and even the active C2 destination after egress testing. Other reverse-engineering work described how Beacon resolves Windows syscalls for direct or indirect execution to evade monitoring, and how operators use **Malleable C2** profiles to shape network traffic and metadata encoding. Separate analyses highlighted how attackers increasingly hide Beacon communications behind trusted infrastructure, including **CDN services**, **domain fronting**, and **serverless reverse proxies** such as Cloudflare Workers, making attribution and blocking harder because traffic appears to target legitimate platforms. Defensive research from Unit 42, Splunk, and open-source tooling including **CobaltStrikeParser** focused on parsing Beacon configurations, decoding metadata formats such as `Base64`, `Base64URL`, `NetBIOS`, `NetBIOSU`, and `Mask`, and detecting suspicious profile settings like `spawnto_x86` and `spawnto_x64`. Together, the reports show that Cobalt Strike remains highly adaptable for adversaries and requires layered detection beyond simple perimeter filtering.
Aug 15, 2026