Cobalt Strike Beacon delivered via GitHub and social media

Kaspersky analysed an active spear‑phishing campaign (Nov 2024–Apr 2025) targeting primarily Russian IT and oil & gas organizations that used RAR archives and LNK shortcuts to drop a malicious BugSplatRc64.dll which hijacks a legitimate crash-reporting utility (BsSndRpt.exe). The malicious DLL uses dynamic API resolution and hooks (e.g., MessageBoxW) to fetch XOR/base64‑encoded payload addresses hidden in public profiles on platforms like GitHub, Quora and Microsoft Learn, downloads an additional XOR-encrypted shellcode that loads a reflective Cobalt Strike Beacon, and the report provides IoCs and detection names.