Golang Cobalt Strike Beacon Uses VS Code Tunnels for Command and Control
Summary
Researchers traced a Golang Cobalt Strike beacon to a server using VS Code dev tunnels for command and control. The investigation details beacon behavior and indicators, while noting that no specific target has been identified.
Key points
- Researchers identified a Cobalt Strike server at 189.1.231[.]190, with servers on ports 443 and 1001 using a shared watermark and self-signed TLS certificate.
- A Golang-compiled beacon communicated with the server and made a request to a VS Code dev tunnel hosted on Microsoft Azure.
- The beacon checked its execution environment and collected host details, including OS version, hosts file, computer name, and timezone.
- The tunnel's creation timestamp indicated it was established less than 24 hours before the researchers' analysis was written.
- The investigation found no evidence identifying a specific target, and researchers cautioned that other domains on the shared Azure host may be unrelated.
- Defenders are advised to monitor traffic to dev tunnel domains and consider restricting their use where VS Code is not needed.
Article Details
- Attack Vectors
- A Golang-compiled Cobalt Strike beacon communicated with a Cobalt Strike server and made an HTTP GET request to a Visual Studio Code dev tunnel endpoint.
- The beacon collected host details, including operating system version, hosts file, computer name, and machine timezone; the article says this data was likely exfiltrated.
- The beacon checked its execution environment using the GetCommandLine API to determine whether it was running in a virtualized environment.
- Defensive Notes
- Monitor traffic to known dev tunnel domains.
- Scrutinize or restrict Visual Studio Code dev tunnel use in environments where Visual Studio Code is not operational.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 189[.]1[.]231[.]190 | Cobalt Strike C2 server identified by the researchers; the beacon also communicated with it. |
| SHA256 | c717d8b26de612e15015cd55940215be336963b6062196f9d847912b98582627 | SHA-256 hash of the malicious executable identified as a Cobalt Strike beacon. |
| SHA256 | eb5ac849e783e3c6eddcd5619ca230b6d8e218e3c7326e0148c21eef3847ff69 | SHA-256 hash of the self-signed TLS certificate used by the identified Cobalt Strike servers. |
| URL | hxxps[:]//189[.]1[.]231[.]190:1001/sugrec | C2 endpoint on the identified server, contacted by the beacon. |
| URL | hxxps[:]//lcjp4gwb-1001[.]asse[.]devtunnels[.]ms/_/passApi/js/wrapper[.]js | Visual Studio Code dev tunnel endpoint contacted by the beacon as part of its communications. |
MITRE ATT&CK
T1071.001 · Web ProtocolsThe beacon made HTTP requests to its C2 server and a Visual Studio Code dev tunnel endpoint.T1082 · System Information DiscoveryThe beacon collected system details, including operating system version, computer name, and machine timezone.T1102.002 · Bidirectional CommunicationThe article describes a Visual Studio Code dev tunnel used as a command-and-control channel.T1497.001 · System ChecksThe beacon used an environment check to determine whether it was running in a virtualized environment.
People
Malware
Vendors
Products
AzureAdditional Azure-hosted infrastructure, though its connection to the initial server, remains uncertain due to shared hosting.Cobalt StrikeIn late November, our research team identified a Cobalt Strike server displaying a well-known watermark and a unique TLS certificate, a pivot point shared by 50 other IPs. Shortly thereafter, a Golang-compiled beaconVisual Studio Codeto multiple malware sandbox platforms. Further analysis revealed the beacon's communication using Visual Studio Code dev tunnels-an uncommon tactic increasingly observed among threat actors leveraging trusted