Rust Loaders Deliver Cobalt Strike Cat in Intrusions Targeting South Korean Organizations
Summary
Researchers found evidence of intrusions against South Korean organizations using reconnaissance tools, SQL injection, and Rust- and MinGW-compiled loaders to deploy Cobalt Strike Cat and Marte shellcode. Logs showed two compromised hosts beaconing.
Key points
- Researchers found an exposed server hosting reconnaissance tools, SQLMap output, malware loaders, and logs from an intrusion campaign targeting South Korean organizations.
- A target list contained more than 1,000 Korean government, municipal, and business domains; SQLMap files included extracted database entries and credentials from a bulletin board system.
- Logs showed two victim machines establishing Cobalt Strike beacons after payload delivery, with one running under LOCAL SERVICE and the other under an Admin account.
- Rust-compiled loaders decoded and executed Marte beacon shellcode; MinGW-compiled beacon samples used a Cobalt Strike malleable C2 profile.
- The researchers could not determine whether attackers moved laterally or exfiltrated additional data from victim systems.
- Recommended defenses include monitoring unusual network traffic and HTTP requests, validating input, patching web applications, and logging database queries.
Article Details
- Attack Vectors
- SQL injection against South Korean websites, with SQLMap output documenting extracted database entries and credential data.
- Reconnaissance using Web-SurvivalScan to enumerate subdomains from a list of more than 1,000 Korean government and business domains.
- Cobalt Strike Cat beacons delivered through MinGW- and Rust-compiled loaders; the Rust loaders decoded and executed Marte beacon shellcode.
- Scripted Web Delivery using PowerShell to stage a payload on the exposed server.
- Defensive Notes
- Monitor unusual network traffic over uncommon ports, irregular HTTP requests mimicking benign web traffic, and repeated connections to external infrastructure.
- Enforce input validation and apply security patches to web applications to mitigate SQL injection.
- Log database queries to detect signs of exploitation attempts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]167[.]222[.]106 | Secondary IP observed logging into the Cobalt Strike Cat server. |
| IPV4 | 144[.]48[.]4[.]219 | Exposed attacker infrastructure hosting tools and malware; also used to stage a payload. |
| SHA256 | 36ca817200204eae59263031e64971e18a8f1d187c81e858d21e4567885e3040 | SHA-256 hash listed for the Marte beacon shellcode extracted from the Rust binaries. |
| SHA256 | 4b00b7ef72db51bd3c40366e283fc4eed7d613b410fdebaf451bf926fdd427fd | SHA-256 hash listed for 0101.txt, a beacon binary described as nearly identical to ma.exe. |
| SHA256 | 8212f3c18f5c875e5543e08389798edb8cdace8446211cedb0baee70e0e37d97 | SHA-256 hash of 882.txt, a Rust-compiled Cobalt Strike Cat beacon loader. |
| SHA256 | 97536e893cbd37b535911d36b284de01325f3a6cd7213e4e82536cef1d85c3aa | SHA-256 hash of 88.txt, a Rust-compiled Cobalt Strike Cat beacon loader. |
| SHA256 | bbb6542d8602dfe0b66073266a3606e6804f5b2c67d64266b0ef245220ccc3cc | SHA-256 hash of 888.txt, a Rust-compiled Cobalt Strike Cat beacon loader. |
| SHA256 | cb884be5f579e4e4917de5d9ae0a9cd3d9c80397b9a1519a8bb1fd5eeb6b882b | SHA-256 hash listed for 123.zip, the archive the operator extracted on the server. |
| SHA256 | f635f424b967e3df6bec0e6bd4643d5b19bb6e3e3d9c925d91124b80f85e8d1b | SHA-256 hash of ma.exe, identified as a Cobalt Strike beacon. |
| URL | hxxp[:]//144[.]48[.]4[.]219/a | Attacker infrastructure URL used to stage a payload through Scripted Web Delivery. |
MITRE ATT&CK
T1059.001 · PowerShellThe operator used Scripted Web Delivery (PowerShell) to stage a payload.T1059.006 · PythonThe Rust loaders decoded and executed shellcode in memory rather than dropping a standalone payload to disk.T1071.001 · Web ProtocolsCobalt Strike beacons used HTTP requests that mimicked benign web traffic.T1105 · Ingress Tool TransferA payload was staged from the exposed server to victim systems.T1190 · Exploit Public-Facing ApplicationSQLMap output documents SQL injection activity against South Korean websites for initial access.T1595.003 · Wordlist ScanningWeb-SurvivalScan was used to enumerate active subdomains from the actor's target list.
Malware
Vendors
Products
Cobalt StrikeThe server, accessible for less than 24 hours, hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat (CS Cat).Microsoft WindowsSouth Korean organizations. The server, accessible for less than 24 hours, hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat (CS Cat).Python144.48.4[.]219:8000, hosted on the EDGENAP LTD network in Japan. The server, which was briefly exposed, used the SimpleHTTP/0.6 Python/3.12.3 header, indicating it was running Python's built-in SimpleHTTPServer.
Tools
CyberChefthe Rust binaries. Among the output were strings separated by hyphens, which, when processed through CyberChef, revealed a Windows PE file header (MZ). After reconstructing the extracted data and submitting it todirsearchversion of the popular penetration testing tool, we found instances of SQLMap, Web-SurvivalScan, and dirsearch, suggesting the actor leveraged open-source tools to identify and exploit vulnerable web applications.FLOSSUsing the open-source FLOSS tool by Mandiant, we extracted encoded data from the Rust binaries. Among the output were strings separated by hyphens, which, when processed through CyberChef, revealed a Windows PE filesqlmapAlongside the modified version of the popular penetration testing tool, we found instances of SQLMap, Web-SurvivalScan, and dirsearch, suggesting the actor leveraged open-source tools to identify and exploit vulnerableWeb-SurvivalScanAlongside the modified version of the popular penetration testing tool, we found instances of SQLMap, Web-SurvivalScan, and dirsearch, suggesting the actor leveraged open-source tools to identify and exploit vulnerable
Countries
Industries
Commercialand file contents indicate that some of the attacks may have been successful, with government and commercial entities appearing to be primary targets.GovernmentMetadata and file contents indicate that some of the attacks may have been successful, with government and commercial entities appearing to be primary targets.