CrossC2 Cross-Platform Cobalt Strike Loader Deployed with ReadNimeLoader in Attacks Linked to BlackBasta Infrastructure
CrossC2 Cross-Platform Cobalt Strike Loader Deployed with (TL-2026-2135), also tracked as CrossC2 Campaign, is a high-severity malware campaign, first published 2026-08-24. It is attributed to Black Basta with medium confidence, affects Linux (multiple distributions) Linux servers (x86, x64), maps to 18 MITRE ATT&CK techniques (T1021.002, T1021.004, T1027), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-2135
- Threat ID
- TL-2026-2135
- Also known as
- CrossC2 Campaign, ReadNimeLoader Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-24
- Last reviewed
- 2026-08-24
- Attribution
- Black Basta
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target regions
- japan
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
Malware and tooling: Black Basta - S1070, Cobalt Strike, SystemBC - S9001, black suit, CrossC2, Impacket - S0357, OdinLdr, PSEXEC, Plink, ReadNimeLoader
JPCERT/CC documented intrusions (September-December 2024, confirmed in Japan with multi-country impact) deploying CrossC2, an unofficial cross-platform Cobalt Strike 4.1+ Beacon/builder extending reach to Linux and macOS, alongside the custom Nim anti-analysis loader ReadNimeLoader, PsExec, Plink, GetNPUsers (AS-REP roasting), and an ELF variant of SystemBC. C2 domain overlap and matching file-naming conventions with prior Rapid7 reporting suggest a connection to the Black Basta/BlackSuit ransomware cluster.
How CrossC2 Cross-Platform Cobalt Strike Loader Deployed with works
CrossC2 is an unofficial, publicly-buildable Cobalt Strike Beacon variant written in C that is compatible with Cobalt Strike 4.1 and above and extends Beacon functionality beyond Windows to Linux (x86, x64) and macOS (x86, x64, Apple Silicon M1). Its configuration is appended to the end of the compiled binary as a HOOK-tag/size/encrypted-data structure and is decrypted with AES-128-CBC via OpenSSL; the C2 host and port can also be supplied at runtime through the CCHOST and CCPORT environment variables. The builder is publicly available on GitHub while the Beacon/builder source remains closed, and the resulting Beacon supports a reduced but functional subset of standard Cobalt Strike commands. CrossC2 binaries analyzed by JPCERT/CC used single-byte XOR string encoding and junk-code insertion as light anti-analysis measures.
On the Windows side of the intrusion set, JPCERT/CC recovered a custom Nim-written loader they named ReadNimeLoader (observed as a sideloaded jli.dll). It is delivered alongside a legitimate copy of java.exe and a same-directory readme.txt containing an AES-256-ECB-encrypted Cobalt Strike Beacon payload (decryption key partially embedded inside the loader's anti-analysis routines). Execution is triggered via a Windows Task Scheduler task launching java.exe, which side-loads the malicious jli.dll (classic DLL side-loading/hijack execution flow). Before decoding the embedded payload, ReadNimeLoader performs anti-debugging/anti-analysis checks: PEB BeingDebugged flag inspection, CONTEXT_DEBUG_REGISTER checking, elapsed-time measurement (execution paths diverge once roughly 0x512 units have elapsed) to detect single-stepping, and exception-handler validation. Once the checks pass, ReadNimeLoader hands the decrypted shellcode to OdinLdr, a publicly available open-source shellcode loader, which decodes and executes the Cobalt Strike Beacon fully in memory. String obfuscation inside the loader uses two distinct XOR-based decoding routines, with a newer 'decode02' routine observed in later loader samples, plus heavy junk-code insertion to slow reverse engineering.
Post-compromise, the intrusion set moved laterally and attacked Active Directory using Sysinternals PsExec v2.43 (SMB/admin-share-based remote execution) and PuTTY Plink v0.81 (SSH tunneling), and ran GetNPUsers (the Impacket AS-REP roasting tool) to harvest crackable Kerberos ticket material from accounts that do not require pre-authentication. On compromised Linux hosts the actor deployed an ELF build of SystemBC, a SOCKS-proxying backdoor that is a well-documented precursor to Cobalt Strike and ransomware deployment in Black Basta-linked activity. JPCERT/CC also recovered wermgr.exe-named binaries associated with the intrusion's privilege-escalation stage. A PDB debug path left in one binary -- D:\BuildServer\bna-4\work-git\phoenix-repository\phoenix\Release\Battle.net Launcher.exe.pdb -- masquerades as a Blizzard Battle.net component and is a useful developer/build-environment fingerprint.
JPCERT/CC assesses a probable connection to the Black Basta/BlackSuit ransomware cluster: the C2 domain api.glazeceramics[.]com and the jli.dll/readme.txt file-naming convention overlap with a Black Basta/BlackSuit report Rapid7 published around June 2025, and the combination of ELF SystemBC plus AS-REP roasting matches TTPs Rapid7 and others have previously tied to that cluster (including an earlier, distinct May-August 2024 Rapid7-documented Black Basta social-engineering campaign that used AnyDesk and a fake spam-filter credential harvester, AntiSpam.exe). The confirmed intrusion window is September-December 2024; JPCERT/CC's VirusTotal-based artifact analysis indicates the same toolset affected organizations outside Japan as well. Because many of the compromised Linux servers lacked EDR coverage, CrossC2 gives this actor a comparatively low-visibility path to extend a Windows-centric Cobalt Strike intrusion across a mixed Linux/macOS/Windows estate. JPCERT/CC released a companion Python configuration parser, parse_crossc2beacon_config.py, supporting both the Linux and macOS CrossC2 Beacon variants.
MITRE ATT&CK techniques used in TL-2026-2135
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 Remote Services: SSH
Defense Evasion
T1027 Obfuscated Files or Information; T1027.009 Obfuscated Files or Information: Embedded Payloads; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL; T1622 Debugger Evasion
Execution
T1053.005 Scheduled Task/Job: Scheduled Task
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1090 Proxy; T1573.001 Encrypted Channel: Symmetric Cryptography
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Credential Access
T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Web Services; T1588.002 Obtain Capabilities: Tool
Affected products and versions in CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
- Linux (multiple distributions) — Linux servers (x86, x64)
Vulnerable versions: all - Apple — macOS (x86, x64, Apple Silicon M1)
Vulnerable versions: all - Oracle — Java Runtime Environment (java.exe abused for jli.dll side-loading)
Vulnerable versions: unspecified - Microsoft — Windows Server / Active Directory domain environments
Vulnerable versions: unspecified
Remediation for CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
Immediate actions
- Block the identified CrossC2/Cobalt Strike C2 IPs and domains at the firewall, proxy, and DNS layers
- Hunt for java.exe processes side-loading an unexpected jli.dll, especially when launched from a Windows Task Scheduler task
- Deploy EDR/AV coverage on internet-facing and internal Linux servers, not only Windows endpoints
- Audit Task Scheduler across the environment for unauthorized tasks launching java.exe or other LOLBins
Workarounds
- Restrict/allow-list java.exe execution paths to prevent DLL side-loading of jli.dll from non-standard directories
- Disable or tightly scope any Active Directory accounts that do not require Kerberos pre-authentication
Longer-term hardening
- Deploy behavioral EDR on Linux and macOS servers to close the coverage gap CrossC2 is specifically built to exploit
- Segment networks to limit SMB-based (PsExec) and SSH-based (Plink) lateral movement between server tiers
- Enforce Kerberos pre-authentication domain-wide to eliminate AS-REP roasting exposure
- Monitor for anomalous outbound DNS traffic on port 53 to non-standard/attacker-registered domains as a possible C2 channel
- Track infrastructure and file-naming overlaps with Black Basta/BlackSuit reporting to accelerate future correlation
Timeline of CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
- Rapid7 first documents a Black Basta-linked social engineering campaign (AnyDesk delivery, fake AntiSpam.exe credential harvester) later cited as part of the same actor cluster's activity pattern.
- Rapid7 and The Hacker News report an evolved Black Basta-linked campaign deploying SystemBC via update8.exe, establishing the SystemBC-precedes-Cobalt-Strike pattern later observed in this intrusion set.
- Earliest confirmed intrusion activity in the JPCERT/CC-documented window using CrossC2, ReadNimeLoader, PsExec, Plink, GetNPUsers, and ELF SystemBC against internal Linux servers and Active Directory.
- Close of the confirmed September-December 2024 intrusion window analyzed by JPCERT/CC.
- JPCERT/CC conducts VirusTotal-based retrohunting on CrossC2 and ReadNimeLoader artifacts, confirming impact extended to organizations outside Japan.
- Rapid7 publishes a BlackSuit/Black Basta ransomware report documenting C2 domain and file-naming overlaps that JPCERT/CC later cites as evidence connecting this campaign to the Black Basta cluster.
- The Hacker News, GBHackers, and other outlets report on JPCERT/CC's findings, broadening visibility of the CrossC2/ReadNimeLoader toolset to Linux and macOS defenders.
- JPCERT/CC publishes 'Unveiling Attacks Employing CrossC2', detailing the CrossC2 Beacon, ReadNimeLoader, associated toolset, IOCs, and a public CrossC2 Beacon configuration parser.
Sources cited for CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
- Unveiling Attacks Employing CrossC2 - JPCERT/CC Eyes
- Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS
- Threat Actors Leverage CrossC2 to Extend Cobalt Strike to Linux and macOS
- Cobalt Strike for everyone with CrossC2! We're paying attention to Linux servers without EDR
- Hackers Leverage CrossC2 to Bring Cobalt Strike Beacon to Linux and macOS
- Social Engineering Campaign Linked to Black Basta Ransomware Operators
- Black Basta Ransomware Campaign Drops Zbot, DarkGate, & Custom Malware
- Black Basta ransomware gang linked to a malware campaign
- Black Basta-Linked Attackers Target Users with SystemBC Malware
- CrossC2Kit - generate CobaltStrike's cross-platform payload
Threats related to CrossC2 Cross-Platform Cobalt Strike Loader Deployed with
Detection coverage for TL-2026-2135
As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2135 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.