Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure
ID: 9bca119d-fd4c-5b1c-8b55-6699fc2fb437
STIX ID: report--9bca119d-fd4c-5b1c-8b55-6699fc2fb437
Feed Name: Hunt.io Blog
Threat Score
Hunt Intelligence identified Cobalt Strike team servers (notably 189.1.231.190) using a shared 100000 watermark and a distinct self-signed TLS certificate linked to many IPs, along with a Golang-compiled beacon that communicates to the server and leverages Visual Studio Code dev tunnels (devtunnels.ms) as an uncommon C2 channel; the report includes sample and certificate hashes, behavioral artifacts, network indicators, and guidance to monitor or restrict dev tunnel traffic.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.