Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain

Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon (TL-2026-2457) is a high-severity malware campaign, first published 2026-09-12. It has no confirmed attribution, affects Microsoft Windows (domain-joined endpoints), maps to 17 MITRE ATT&CK techniques (T1027, T1036.005, T1046), and is covered by 9 detection rules and 8 indicators of compromise.

Key facts for TL-2026-2457

Threat ID
TL-2026-2457
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-12
Last reviewed
2026-09-12
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
8

Malware and tooling in Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon

Malware and tooling: Cobalt Strike, Cobalt Strike Beacon, Cobalt Strike

Joe Security documents a three-stage infection chain in which a .NET loader uses a domain-join check to evade sandboxes before decrypting and reflectively loading a stageless Cobalt Strike beacon (protocol version 0x56) that uses RSA-1024/AES-CBC/HMAC-SHA256 for C2 and supports in-memory execution, desktop takeover, and token impersonation.

How Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon works

Joe Security's technical analysis walks a three-stage infection chain recovered from the sample G1kkgNRuTw.dll (SHA-256 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9). Stage 1 is a .NET loader that checks System.Environment.UserDomainName to confirm the host is domain-joined before proceeding -- an anti-sandbox gate that the researchers bypassed only by running the sample in Joe Sandbox Cloud Pro. Once the check passes, the loader extracts an embedded payload from the final line of the file, reverses the string, Base64-decodes it, and applies an XOR decryption pass. It then suspends iexplore.exe and injects the decrypted Stage 2 payload into it via NtMapViewOfSection (process hollowing).

Stage 2 is a small in-memory loader; the researchers reconstructed it from a memory dump using x64dbg, mapping sections, fixing relocations, and rebuilding the import table before it transfers execution to Stage 3: a stageless Cobalt Strike Beacon, protocol/build version 0x56, with its full configuration embedded rather than staged from the network.

The beacon authenticates and exchanges an AES session key with its controller using RSA-1024 (PKCS#1 v1.5), then encrypts command/response traffic with AES-CBC and authenticates it with a 16-byte HMAC-SHA256 tag. Check-ins are HTTP GET requests to /rest/funcStatus carrying RSA-encrypted host/session metadata, with tasking retrieval over a POST endpoint at /rest/policy/3/; both paths ride a hardcoded legacy Internet Explorer User-Agent. C2 was configured to microsoft.otp[.]lu and analytics.green-it[.]lu, with a 10-second sleep interval (adjustable up to 98 seconds via tasking) and 42% jitter. The extracted configuration carries license watermark 1802994334, and beacon network packets embed a 0x0000BEEF magic marker used to identify traffic. When the beacon spawns helper processes for injection it masquerades them as %windir%\syswow64\WerFault.exe (x86) or %windir%\sysnative\WerFault.exe (x64) -- Windows Error Reporting's legitimate binary name and path, chosen to blend into normal process trees.

The recovered beacon configuration exposes the full standard Cobalt Strike Beacon command set (37+ commands): interactive shell and process management, in-memory PE execution, file read/write/delete/list, socket/tunneling primitives, screenshot capture and desktop enumeration/switching for GUI takeover, process enumeration/termination, and access-token manipulation for impersonation. Two additional VirusTotal-linked samples (dff61a394c14f23537b490f7ea1530a456c57bca24bfc317691ce118aa34ee6a and 8bf7886775bfd69b6867b44a6bad2ee06df4243d814c6245975e78bb1ca2f4ab) were identified as related via the same loader/config family. No CVE or software vulnerability is involved -- this is an abuse of the legitimate Cobalt Strike red-team framework via a custom anti-analysis loader, and no named threat actor or campaign is attributed in the source reporting.

MITRE ATT&CK techniques used in TL-2026-2457

Stealth

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading

Discovery

T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery

Execution

T1059.003 Windows Command Shell; T1106 Native API

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography

Collection

T1113 Screen Capture

Privilege Escalation

T1134.003 Make and Impersonate Token

Affected products and versions in Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon

  • Microsoft — Windows (domain-joined endpoints)
    Vulnerable versions: Domain-joined Windows hosts targeted by the .NET loader; injection observed against iexplore.exe with WerFault.exe used as an x86/x64 masquerade/spawn target

Remediation for Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon

Immediate actions

  • Block C2 domains microsoft.otp.lu and analytics.green-it.lu (and their resolved IPs) at DNS, proxy, and perimeter firewall
  • Hunt for and isolate hosts with SHA-256 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9 (G1kkgNRuTw.dll) or the two related VirusTotal-linked hashes
  • Alert on outbound HTTP requests to /rest/funcStatus or /rest/policy/3/ paired with the legacy MSIE 7.0/.NET CLR 2.0.50727 User-Agent string

Workarounds

  • Enforce application allow-listing to block unsigned .NET binaries executing from user-writable directories
  • Restrict outbound endpoint connectivity to required destinations only, to blunt beacon C2 callbacks even if a host is compromised

Longer-term hardening

  • Deploy EDR/YARA coverage for stageless Cobalt Strike beacon indicators, including license watermark 1802994334 and the 0x0000BEEF packet marker
  • Detect process hollowing and NtMapViewOfSection-based injection into iexplore.exe, and flag WerFault.exe processes spawned outside the normal crash-reporting path
  • Forward Sysmon/ETW telemetry centrally to catch reflective, disk-less loading of unsigned code and unexpected token-impersonation activity

Timeline of Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon

  • Joe Security publishes "Deep Malware Analysis of a Multi-Stage Cobalt Strike Loader," documenting the full infection chain and IOCs.
  • Two additional related samples are identified on VirusTotal via loader/configuration similarity to G1kkgNRuTw.dll.
  • Joe Security extracts the full beacon configuration, recovering license watermark 1802994334, a 10-second sleep interval, and 42% jitter.
  • The beacon initiates RSA-1024/AES-CBC encrypted C2 check-ins to microsoft.otp.lu and analytics.green-it.lu over /rest/funcStatus.
  • Stage 2 transfers execution to the embedded Stage 3 payload, a stageless Cobalt Strike Beacon at protocol/build version 0x56.
  • Researchers dump and reconstruct the in-memory Stage 2 loader as a PE file using x64dbg, mapping sections, fixing relocations, and rebuilding imports.
  • Stage 1 suspends iexplore.exe and injects the decrypted Stage 2 payload into it via NtMapViewOfSection.
  • Stage 1 is observed extracting the embedded payload from the file's final line, reversing the string, Base64-decoding it, and applying XOR decryption.
  • Analysts identify Stage 1's domain-join check via System.Environment.UserDomainName, which gates execution and is bypassed only under Joe Sandbox Cloud Pro.
  • The .NET loader sample G1kkgNRuTw.dll is submitted for analysis and detonated in Joe Sandbox Cloud.

Sources cited for Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon

More in malware

Detection coverage for TL-2026-2457

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2457 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats