Loading story…
A malware loader linked to a TrickBot-associated intrusion crew was observed fetching an encoded payload from GitHub files disguised as images, decoding the data into shellcode, and launching a 64-bit Cobalt Strike beacon directly in memory. The sample used obfuscated strings, manually resolved APIs from ntdll.dll and kernel32.dll, and loaded wininet.dll to handle network communications, reflecting a stealth-focused delivery chain commonly associated with post-compromise ransomware activity.
Analysis of the beacon configuration tied command-and-control traffic to rainbowmango.info subdomains over HTTPS/443, with gpupdate.exe configured as the spawn-to process for execution. One GitHub account previously used to host the payload was later deleted, indicating likely operational cleanup by the actor as defenders and researchers tracked the infrastructure and tooling behind the campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Walmart Global Tech published an analysis of a new malware loader attributed to an actor involved in TrickBot Cobalt Strike and ransomware operations. The loader downloaded encoded payload data from GitHub-hosted files masquerading as images and ultimately launched a 64-bit Cobalt Strike beacon in memory.
The analysis noted that a GitHub account previously used to host the payload, Asderfolkij092, had been deleted by the time of review. Researchers assessed this as possible operational cleanup by the threat actor after campaign use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied multiple malware components to **TrickBot-associated operations**, including a custom loader that fetched encoded payloads from GitHub files disguised as images and launched a 64-bit **Cobalt Strike** beacon directly in memory. The loader manually resolved APIs from `ntdll.dll` and `kernel32.dll`, loaded `wininet.dll`, and used HTTPS command-and-control on port `443`, with beacon configuration pointing to `rainbowmango.info` subdomains and `gpupdate.exe` configured as a spawn-to process. Separate analysis of **TrickLoader**, the TrickBot framework’s loader component, showed years of increasing obfuscation, including hidden resource names, custom Base64 schemes, compressed payloads, function-table reconstruction, and anti-analysis techniques such as UAC bypass and Heaven’s Gate. Additional reporting linked a newer **Krypton/Xenon crypter** and related data-exfiltration malware to the same ecosystem through a distinctive string-encoding pattern ending in `mOrxx` that had previously appeared in TrickBot tooling. Unpacked samples contained references to **Mimikatz**, a proof-of-concept for `CVE-2020-0787`, and downloads from `raw.githubusercontent.com`, while the exfiltration malware used WinINet APIs to upload stolen data to hard-coded `uploadFile.php` endpoints and also enumerated processes and collected desktop and window information. Investigators identified infrastructure including `temp.positiveseca.com`, `se1.buttonrich.com`, `figures.pablotech.info`, and `files.pablotech.info`, reinforcing links between TrickBot loaders, post-exploitation tooling, and data-theft activity.
Aug 14, 2026
Attackers operating the **Gootkit** loader compromised legitimate websites and used **SEO poisoning** to lure users searching for legal document templates into downloading malicious ZIP archives. The archives contained JavaScript that, once executed, launched obfuscated PowerShell and began a multi-stage infection chain designed to avoid writing the final payload to disk. Trend Micro reported that the updated intrusion flow used **registry stuffing**, **scheduled-task persistence**, and reflective in-memory loading to reconstruct and run a fileless **Cobalt Strike** beacon. The campaign differed from earlier Gootkit activity by shifting from freeware-themed lures to legal-document themes and by encrypting registry-stored content with a custom text-replacement algorithm instead of Base64; in the observed case, the beacon communicated with `89.238.185.13` before the attack was interrupted.
Aug 15, 2026
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026