# CrossC2 Cross-Platform Cobalt Strike Loader Deployed with ReadNimeLoader in Attacks Linked to BlackBasta Infrastructure

> JPCERT/CC documented intrusions (September-December 2024, confirmed in Japan with multi-country impact) deploying CrossC2, an unofficial cross-platform Cobalt Strike 4.1+ Beacon/builder extending reach to Linux and macOS, alongside the custom Nim anti-analysis loader ReadNimeLoader, PsExec, Plink, GetNPUsers (AS-REP roasting), and an ELF variant of SystemBC. C2 domain overlap and matching file-naming conventions with prior Rapid7 reporting suggest a connection to the Black Basta/BlackSuit ransomware cluster.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2135
- **ID:** TL-2026-2135
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Black Basta
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrossC2 is an unofficial, publicly-buildable Cobalt Strike Beacon variant written in C that is compatible with Cobalt Strike 4.1 and above and extends Beacon functionality beyond Windows to Linux (x86, x64) and macOS (x86, x64, Apple Silicon M1). Its configuration is appended to the end of the compiled binary as a HOOK-tag/size/encrypted-data structure and is decrypted with AES-128-CBC via OpenSSL; the C2 host and port can also be supplied at runtime through the CCHOST and CCPORT environment variables. The builder is publicly available on GitHub while the Beacon/builder source remains closed, and the resulting Beacon supports a reduced but functional subset of standard Cobalt Strike commands. CrossC2 binaries analyzed by JPCERT/CC used single-byte XOR string encoding and junk-code insertion as light anti-analysis measures.

On the Windows side of the intrusion set, JPCERT/CC recovered a custom Nim-written loader they named ReadNimeLoader (observed as a sideloaded jli.dll). It is delivered alongside a legitimate copy of java.exe and a same-directory readme.txt containing an AES-256-ECB-encrypted Cobalt Strike Beacon payload (decryption key partially embedded inside the loader's anti-analysis routines). Execution is triggered via a Windows Task Scheduler task launching java.exe, which side-loads the malicious jli.dll (classic DLL side-loading/hijack execution flow). Before decoding the embedded payload, ReadNimeLoader performs anti-debugging/anti-analysis checks: PEB BeingDebugged flag inspection, CONTEXT_DEBUG_REGISTER checking, elapsed-time measurement (execution paths diverge once roughly 0x512 units have elapsed) to detect single-stepping, and exception-handler validation. Once the checks pass, ReadNimeLoader hands the decrypted shellcode to OdinLdr, a publicly available open-source shellcode loader, which decodes and executes the Cobalt Strike Beacon fully in memory. String obfuscation inside the loader uses two distinct XOR-based decoding routines, with a newer 'decode02' routine observed in later loader samples, plus heavy junk-code insertion to slow reverse engineering.

Post-compromise, the intrusion set moved laterally and attacked Active Directory using Sysinternals PsExec v2.43 (SMB/admin-share-based remote execution) and PuTTY Plink v0.81 (SSH tunneling), and ran GetNPUsers (the Impacket AS-REP roasting tool) to harvest crackable Kerberos ticket material from accounts that do not require pre-authentication. On compromised Linux hosts the actor deployed an ELF build of SystemBC, a SOCKS-proxying backdoor that is a well-documented precursor to Cobalt Strike and ransomware deployment in Black Basta-linked activity. JPCERT/CC also recovered wermgr.exe-named binaries associated with the intrusion's privilege-escalation stage. A PDB debug path left in one binary -- D:\BuildServer\bna-4\work-git\phoenix-repository\phoenix\Release\Battle.net Launcher.exe.pdb -- masquerades as a Blizzard Battle.net component and is a useful developer/build-environment fingerprint.

JPCERT/CC assesses a probable connection to the Black Basta/BlackSuit ransomware cluster: the C2 domain api.glazeceramics[.]com and the jli.dll/readme.txt file-naming convention overlap with a Black Basta/BlackSuit report Rapid7 published around June 2025, and the combination of ELF SystemBC plus AS-REP roasting matches TTPs Rapid7 and others have previously tied to that cluster (including an earlier, distinct May-August 2024 Rapid7-documented Black Basta social-engineering campaign that used AnyDesk and a fake spam-filter credential harvester, AntiSpam.exe). The confirmed intrusion window is September-December 2024; JPCERT/CC's VirusTotal-based artifact analysis indicates the same toolset affected organizations outside Japan as well. Because many of the compromised Linux servers lacked EDR coverage, CrossC2 gives this actor a comparatively low-visibility path to extend a Windows-centric Cobalt Strike intrusion across a mixed Linux/macOS/Windows estate. JPCERT/CC released a companion Python configuration parser, parse_crossc2beacon_config.py, supporting both the Linux and macOS CrossC2 Beacon variants.

## MITRE ATT&CK

- T1053.005 Scheduled Task/Job: Scheduled Task
- T1548 Abuse Elevation Control Mechanism
- T1574.001 DLL
- T1622 Debugger Evasion
- T1027 Obfuscated Files or Information
- T1027.009 Obfuscated Files or Information: Embedded Payloads
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.004 Remote Services: SSH
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.004 Application Layer Protocol: DNS
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1090 Proxy
- T1583.006 Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1588.002 Obtain Capabilities: Tool

## Sources

- [Unveiling Attacks Employing CrossC2 - JPCERT/CC Eyes](https://blogs.jpcert.or.jp/en/2025/08/crossc2.html)
- [Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS](https://thehackernews.com/2025/08/researchers-warn-crossc2-expands-cobalt.html)
- [Threat Actors Leverage CrossC2 to Extend Cobalt Strike to Linux and macOS](https://gbhackers.com/threat-actors-leverage-crossc2/)
- [Cobalt Strike for everyone with CrossC2! We're paying attention to Linux servers without EDR](https://www.redhotcyber.com/en/post/cobalt-strike-for-everyone-with-crossc2-were-paying-attention-to-linux-servers-without-edr/)
- [Hackers Leverage CrossC2 to Bring Cobalt Strike Beacon to Linux and macOS](https://nubetia.com/hackers-leverage-crossc2-to-bring-cobalt-strike-beacon-to-linux-and-macos/)
- [Social Engineering Campaign Linked to Black Basta Ransomware Operators](https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators/)
- [Black Basta Ransomware Campaign Drops Zbot, DarkGate, & Custom Malware](https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/)
- [Black Basta ransomware gang linked to a malware campaign](https://securityaffairs.com/167079/cyber-crime/black-basta-ransomware-systembc-campaign.html)
- [Black Basta-Linked Attackers Target Users with SystemBC Malware](https://thehackernews.com/2024/08/black-basta-linked-attackers-targets.html)
- [CrossC2Kit - generate CobaltStrike's cross-platform payload](https://github.com/CrossC2/CrossC2Kit)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2135