CrossC2 Chaos: The Cyber Circus Hits Japan with Cross-Platform Cobalt Strike Shenanigans!
CrossC2 is causing a stir by taking Cobalt Strike on a world tour, targeting Linux and macOS systems. JPCERT/CC discovered this crafty tool being used in cyberattacks across multiple countries, including Japan. With ReadNimeLoader in its arsenal, CrossC2 is leaving security teams scrambling like a cat chasing a laser pointer.
Hot Take:
Ah, the digital world’s version of “Guess Who?” – Cobalt Strike, now with CrossC2, is playing dress-up and hitting up multiple platforms like it’s at a cybersecurity costume party. Watch out, Linux and macOS, there’s a new trickster in town, and it’s ready to crash the party!
Key Points:
- Japan’s CERT detected CrossC2 usage, extending Cobalt Strike functionality to Linux and macOS.
- Activities spanned from September to December 2024, targeting several countries, including Japan.
- CrossC2 works in tandem with tools like PsExec, Plink, and custom malware ReadNimeLoader.
- The attack strategy involves sideloading payloads directly in memory, avoiding disk traces.
- There’s a potential link between this campaign and BlackSuit/Black Basta ransomware activities.
Already a member? Log in here