Manjusaka: A Chinese sibling of Sliver and Cobalt Strike
Summary: Cisco Talos discovered a new attack framework called Manjusaka, whose C2 is a GoLang ELF binary with a Simplified Chinese interface and whose implants are written in Rust for Windows and Linux, both freely available on GitHub. Talos found the implant in the wild contacting the same IP address (39.104.90.45) as a Cobalt Strike beacon delivered through a malicious Word document posing as a COVID-19 advisory about an outbreak in Golmud City, Qinghai Province, with maldoc metadata indicating creation in the second half of June 2022.
Why it matters: A fully functional C2 binary that generates custom implants with no external dependencies is publicly downloadable, which Talos says increases the chances of wider adoption by malicious actors - and the developer can readily extend it to macOS and embedded Linux.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026