KaynStrike

KaynStrike 一种用于 Cobalt Strike Beacon 的用户自定义反射加载器，可伪装线程起始地址，并在入口点执行后释放自身。 线程起始地址欺骗 反射加载器清理 证明 如何使用 只需加载 KaynStrike.cna Aggressor 脚本，并构建一个无阶段 beacon（已作为 exe 测试过） 致谢 S4ntiagoP。从他的一条推文中获得了释放反射加载器的想法 Austin Hudson（又名 SecIdiot）。反射加载器设计与 ROP 链...

CobaltStrikeScan

CobaltStrikeScan 파일 또는 프로세스 메모리에서 Cobalt Strike 비콘을 스캔하고 해당 구성을 파싱합니다. CobaltStrikeScan은 Windows 프로세스 메모리에서 DLL 인젝션클래식 또는 리플렉티브 인젝션의 증거를 스캔하거나, 대상 프로세스 메모리에서 Cobalt Strike v3 및 v4 비콘 시그니처에 대한 YARA 스캔을 수행합니다. 또는 CobaltStrikeScan은 명령줄 인수로 절대 또는 상대 경로로 제공된 파일에 대해 동일한 YARA 스캔을 수행할 수 있습니다. 파일이나 프로세스에서...

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark , said the...

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

Introduction During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader. What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional...

Cobalt Strike Beacon delivered via GitHub and social media

Introduction In the latter half of 2024, the Russian IT industry, alongside a number of entities in other countries, experienced a notable cyberattack. The attackers employed a range of malicious techniques to trick security systems and remain undetected. To bypass detection, they delivered...

Threat Analysis: SquidLoader - Still Swimming Under the Radar

Threat Analysis: SquidLoader - Still Swimming Under the Radar By Charles Crofford · July 15, 2025 Executive summary A new wave of SquidLoader malware samples are actively targeting financial services institutions in Hong Kong. This sophisticated malware exhibits significant evasion capabilities,...

MAL-2025-616 Malicious code in marked-at (npm)

This package contains a PowerShell download cradle to execute a Cobalt Strike beacon and establish command and control. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2adf9556402c124dc6a1146e6c3bb6a90efee66a9a0bbfdeb3188d4477099d2d Any computer that has this packag...

Malicious code in @dz-lib/icon (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48177d2f5e82546462b55524174635af9b9c224b960955ce998919a80db4d812 Any computer that has this package installed or...

Malicious code in interview-question (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...

Malicious code in flybook-table (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...

MAL-2024-12178 Malicious code in @dz-lib/dz-cli (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec9421e5d1892420fe8194f8361f8c856ef3b31d6996e2554d840fc850e59a1e Any computer that has this package installed or...

Malicious code in @hi.editor/core (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...

Malicious code in @dz-lib/dz-cli (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec9421e5d1892420fe8194f8361f8c856ef3b31d6996e2554d840fc850e59a1e Any computer that has this package installed or...

Malicious code in bs-auto-dark-mode (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a5c6958e14a49e20ebdd6902cdb4cad7872983ed4d39e94b625cc50a20314ac The OpenSSF Package Analysis project...

Chinese APT41 Upgrades Malware Arsenal with DodgeBox and MoonWalk

The China-linked advanced persistent threat APT group codenamed APT41 is suspected to be using an "advanced and upgraded version" of a known malware called StealthVector to deliver a previously undocumented backdoor dubbed MoonWalk. The new variant of StealthVector – which is also referred to as...

Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern

Ransomware attacks targeting VMware ESXi infrastructure follow an established pattern regardless of the file-encrypting malware deployed, new findings show. "Virtualization platforms are a core component of organizational IT infrastructure, yet they often suffer from inherent misconfigurations an...

Turkish Hackers Exploiting Poorly Secured MS SQL Servers Across the Globe

Poorly secured Microsoft SQL MS SQL servers are being targeted in the U.S., European Union, and Latin American LATAM regions as part of an ongoing financially motivated campaign to gain initial access. "The analyzed threat campaign appears to end in one of two ways, either the selling of 'access'...

PicassoLoader Malware Used in Ongoing Attacks on Ukraine and Poland

Government entities, military organizations, and civilian users in Ukraine and Poland have been targeted as part of a series of campaigns designed to steal sensitive data and gain persistent remote access to the infected systems. The intrusion set, which stretches from April 2022 to July 2023,...

BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising

Threat actors associated with the BlackCat ransomware have been observed employing malvertising tricks to distribute rogue installers of the WinSCP file transfer application. "Malicious actors used malvertising to distribute a piece of malware via cloned webpages of legitimate organizations," Tre...

BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising

Threat actors associated with the BlackCat ransomware have been observed employing malvertising tricks to distribute rogue installers of the WinSCP file transfer application. "Malicious actors used malvertising to distribute a piece of malware via cloned webpages of legitimate organizations," Tre...