THREAT OPS › Threat News › CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks
CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks
<p>From September to December 2024, JPCERT/CC has confirmed incidents involving CrossC2, the extension tool to create Cobalt Strike Beacon for Linux OS. The attacker employed CrossC2 as well as other tools such as PsExec, Plink, and Cobalt Strike in attempts to penetrate AD. Further investigation revealed that the attacker used custom malware (hereafter referred to as <strong>"ReadNimeLoader"</str
MITRE ATT&CK techniques
Indicators of compromise
- 56b941f6dcb769ae6d6995412559012abab830f05d5d8acf2648f7fa48c20833sha256
- 6246fb5c8b714707ac49ade53e6fe5017d96442db393b1c0ba964698ae24245dsha256
- dfe79b9c57cfb9fc10597b43af1c0a798991b6ceeec2af9b1e0ed46e6a8661c8sha256
- acdf2a87ed03f2c6fe1d9899e8a74e8b56f7b77bb8aed5adf2cc374ee5465168sha256
- 3f96b6589996e57abc1c4d9b732528d2d11dea5c814f8241170c14ca2cd0281dsha256
- 6b80d602472c76b1d0f05bcce62e0a34de758232d9d570ba61b540784c663c01sha256
- 0ab709728666f8759ad8db574d4009cf74ebce36ef2572ef52b058997a9b2a25sha256
- 3079a29575a0adff91f04c5493a7f3e1c89795e3a90cf842650cd8bd45c4e1bcsha256
- ecca3194613b0bab02059c3544fdc90f6d4af5a4c06518c853517eb1d81b9735sha256
- ad90a4490d82c7bd300fdbbdca0336e5ad2219d63ea0f08cebc33050d65b7ef2sha256
- 70b3b8e07752c1f3d4a462b2ab47ca3d9fb5094131971067230031b8b2cd84f2sha256
- 99d6b73b1a9e66d7f6dcb3244ea0783b60776efd223d95c4f95e31fde434e258sha256
- 16b1819186f0803b9408d9a448a176142f8271a4bc0b42cdb78eb4489bce16fesha256
- 28d668f3e1026a56d55bc5d6e36fad71622c1ab20ace52d3ab12738f9f8c6589sha256
- 9e8c550545aea5212c687e15399344df8a2c89f8359b90d8054f233a757346e7sha256
- 74a33138ce1e57564baa4ea4db4a882d6bf51081b79a167a6cb2bf9130ddad7fsha256
- 7ccff87db7b4e6bc8c5a7e570f83e26ccb6f3a8f72388210af466048d3793b00sha256
- e0e827198a70eef6c697559660106cfab7229483b0cd7f0c7abd384a3d2ee504sha256
- f79e047ae4834e6a9234ca1635f18b074a870b366fe4368c10c2ddc56dfbb1bcsha256
- ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2casha256
- 2e338a447b4ceaa00b99d742194d174243ca82830a03149028f9713d71fe9aabsha256
- 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937bsha256
- d74eac55eeaa3138bc1e723c56013bb1af7709f0a77308bfbf268d4e32b37243sha256
- d67a7903c6777d64b69845b6fcd5db65md5
- https://www.rapid7.com/blog/post/2025/06/10/blacksuit-continues-social-engineering-attacks-in-wake-of-black-bastas-internal-conflict/url
- 162.33.179.247ipv4
- 64.95.10.209ipv4
- 179.60.149.209ipv4
- 64.52.80.62ipv4
- 67.217.228.55ipv4
- 137.184.155.92ipv4
- 159.65.241.37ipv4
- 165.227.113.183ipv4
- 192.241.190.181ipv4
- battle.netdomain
- westeurope-teams.azureedge.netdomain
- api.glazeceramics.comdomain
- doc.docu-duplicator.comdomain
- doc2.docu-duplicator.comdomain
- comdoc1.docu-duplicator.comdomain
Original source: https://blogs.jpcert.or.jp/en/2025/08/crossc2.html