Malware
Cobalt Strike Beacon
- First Reported
- Jan 7, 2025
- Latest Reported
- Apr 22, 2026
Reported Context (4)
- Beacon agent. This marks a departure from earlier TOSHIS versions, which delivered either a Cobalt Strike Beacon or a Merlin Mythic agent Tropic Trooper Uses AdaptixC2 and GitHub C2 to Establish VS Code Tunnel Access
- command-and-control (C2) communication, and GOSHELL, a Golang shellcode loader used to deploy a Cobalt Strike Beacon. The second part of the blog explores the Sheet Attack campaign, including the attack chain, Pakistan-Linked Campaign Uses GOGITTER, GITSHELLPAD and GOSHELL to Target Indian Government
- The Cobalt Strike loader Talos examined decrypts the encrypted payload contained in the .bss section of the binary shown in Figure 16, then deploys and executes the Cobalt Strike Beacon in memory. Cisco Talos Details Qilin Ransomware Tactics, from VPN Access to Network Encryption
- was uploaded to multiple malware sandbox platforms and flagged by several vendors as a Cobalt Strike beacon. For this analysis, we focus on the results obtained from VirusTotal and Hatching Triage. Golang Cobalt Strike Beacon Uses VS Code Tunnels for Command and Control
Malware (9)
People (5)
Threat Actors (4)
MITRE ATT&CK (45)
Vendors (3)
Products (11)
Tools (24)
Industries (11)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.