Blowing Cobalt Strike Out of the Water With Memory Analysis
Summary: Unit 42 researchers describe three Cobalt Strike loaders - KoboldLoader (SMB beacon), MagnetLoader (HTTPS beacon) and LithiumLoader (stager beacon) - that were detected by a hypervisor-based sandbox that analyzes deltas in process memory at key points of execution. The samples use native API calls resolved by hash, a fake mscms.dll that forwards to the real library, and a malicious libcurl.dll side-loaded through a Fortinet VPN installer, with the LithiumLoader shellcode connecting to the IP address of a university in Thailand.
What's compelling: Cobalt Strike operates mainly in memory once the loader runs, and its source code leaks have put it in the hands of actors from ransomware groups to state actors, including in the 2020 SolarWinds incident - so a sample that shows no malicious behavior in a standard sandbox can still be a live beacon.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026