Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

A briefly exposed Japanese server hosted a Rust-compiled loader delivering Cobalt Strike 'Cat', plus sqlmap, dirsearch, and Web-SurvivalScan, in attacks on South Korean organizations.

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.

A Hunt how-to on detecting RedGuard, the open-source C2 redirector built with Cobalt Strike in mind, explaining how redirectors obscure real C2 servers and how defenders can find their infrastructure.

Ceri Coburn proposes a new BOF PE reference design that runs the same linked EXE standalone or in-agent with full C++ and exception support, easing maintenance pain of traditional Beacon Object Files.

Scott Sutherland releases SQLC2, a PowerShell PoC using SQL Server, including Azure SQL, as both controller and agent for C2, blending into permitted *.database.windows.net traffic on port 1433.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.