Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows
summary
Researchers find an ELF implant that implements a Cobalt Strike–compatible Beacon called Vermilion Strike, with a matching Windows DLL (stager seen from 2019). It decodes a C2 config using the hex 69 key, fingerprints the host, and talks back primarily as a DNS-over-HTTP beacon (commands: cd, ls, upload/download, execute); an ICMP branch exists but is unreachable. Telemetry shows targeting of high‑profile orgs worldwide; Linux samples are undetected on Linux while the Windows DLL has detections. Detection relies on spotting the unique stager or memory‑only payload execution.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:41Cobalt strike overview
- 9:20Linux threat landscape
- 11:47Discovery of Vermilion Strike
- 14:32Technical analysis
- 19:33Attribution and findings
- 22:45Detection and future outlook
- 26:21Q&A session
related talks
30mItinerary to Defeat Yet Another Beacon Implementation
47mDetecting and analyzing files-less malware
01h 00mStories from NC3 - investigating hackers
32mHey Attacker! I Can See You!
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
12mIntroduction To Red Team Tooling And Opsec
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
42mDriven Response to UNC5174