Loading story…
Arista documented a malware operation tracked as White Stork, describing how the threat was identified and analyzed in flight as part of incident-response and network-defense efforts. The reporting indicates the campaign relied on post-compromise tooling and command-and-control behavior consistent with modern intrusion activity, giving defenders network-level indicators and behavioral context for detecting the malware’s communications.
CrowdStrike’s research on extracting intelligence from Cobalt Strike Beacon traffic adds technical context to the operation, highlighting how Beacon activity can reveal attacker infrastructure, configuration details, and follow-on tradecraft after initial access. Taken together, the references show a threat campaign in which defenders used Beacon-related telemetry and malware analysis to uncover adversary communications and improve detection of malicious command-and-control activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026
Researchers identified **Vermilion Strike**, a from-scratch reimplementation of **Cobalt Strike Beacon** for both Linux and Windows that was used in targeted intrusions and assessed as likely supporting espionage activity. The malware reused Cobalt Strike’s command-and-control protocol while adding remote access capabilities including command execution, file upload, and file writing. Intezer linked the Linux and Windows variants through shared C2 infrastructure, overlapping functionality, and similar internal version strings, while telemetry indicated the operation had been active since at least 2021 against telecommunications companies, government agencies, IT firms, financial institutions, and advisory organizations worldwide. Analysis of the Linux ELF variant showed it was initially undetected on VirusTotal, appeared tailored to **Red Hat-based** systems such as CentOS 7, and relied primarily on **DNS beaconing** with additional **HTTP** support and partially implemented **ICMP** C2. Reverse engineering found the sample decrypted an embedded Malleable C2 profile with XOR key `0x69`, collected host metadata, encrypted it with an RSA public key, and used DNS TXT responses for tasking before issuing HTTP GET requests in a hybrid DNS/HTTP model. Investigators tied activity to domains including `update.microsoftkernel.com` and `update.microsofthk.com`, which resolved to `160.202.163.100`, and observed victim systems beaconing to the infrastructure months before public disclosure.
Aug 15, 2026
Multiple security researchers published new technical details on how **Cobalt Strike Beacon** can be modified and concealed during post-exploitation, while also outlining ways defenders can decode and detect its traffic. TrustedSec showed that Beacon’s XOR-obfuscated configuration blob can be altered in memory at runtime to change settings such as the **user-agent**, sleep and jitter values, HTTP verbs, spawn-to paths, ports, and even the active C2 destination after egress testing. Other reverse-engineering work described how Beacon resolves Windows syscalls for direct or indirect execution to evade monitoring, and how operators use **Malleable C2** profiles to shape network traffic and metadata encoding. Separate analyses highlighted how attackers increasingly hide Beacon communications behind trusted infrastructure, including **CDN services**, **domain fronting**, and **serverless reverse proxies** such as Cloudflare Workers, making attribution and blocking harder because traffic appears to target legitimate platforms. Defensive research from Unit 42, Splunk, and open-source tooling including **CobaltStrikeParser** focused on parsing Beacon configurations, decoding metadata formats such as `Base64`, `Base64URL`, `NetBIOS`, `NetBIOSU`, and `Mask`, and detecting suspicious profile settings like `spawnto_x86` and `spawnto_x64`. Together, the reports show that Cobalt Strike remains highly adaptable for adversaries and requires layered detection beyond simple perimeter filtering.
Aug 15, 2026