---
id: 6302
title: "Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems"
source_domain: hunt.io
source_url: "https://hunt.io/blog/geacon-and-geacon-pro-a-constant-menace-to-linux-and-windows-systems"
published_at: "2024-06-27T00:00:00Z"
tags: ["threat-hunting", "cobalt-strike", "tls-certificates", "open-directories", "geacon", "malware-infrastructure"]
phying_url: "https://phying.com/item/6302"
lang: en
---

# Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems

## Summary

Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2024-06-27T00:00:00Z
- **Original:** https://hunt.io/blog/geacon-and-geacon-pro-a-constant-menace-to-linux-and-windows-systems
- **Phying News:** https://phying.com/item/6302