---
id: 6268
title: "Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure"
source_domain: hunt.io
source_url: "https://hunt.io/blog/golang-beacons-vs-code-tunnels-tracking-cobalt-strike"
published_at: "2025-01-07T00:00:00Z"
tags: ["threat-hunting", "c2", "golang", "cobalt-strike", "dev-tunnels", "watermark"]
phying_url: "https://phying.com/item/6268"
lang: en
---

# Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

## Summary

Hunt.io tracks a Cobalt Strike team server whose Golang beacon relayed C2 through Visual Studio Code dev tunnels—an uncommon tactic—via a TLS cert shared across 50+ IPs and the 100000 watermark.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-01-07T00:00:00Z
- **Original:** https://hunt.io/blog/golang-beacons-vs-code-tunnels-tracking-cobalt-strike
- **Phying News:** https://phying.com/item/6268