South Korean Organizations Targeted by Cobalt Strike ‘Cat’ Delivered by a Rust Beacon

Hunt researchers discovered a briefly exposed open directory hosting tools and artifacts from an intrusion campaign targeting over 1,000 South Korean domains; the actor used reconnaissance tools (dirsearch, Web-SurvivalScan), SQLMap for injection and data theft, and deployed modified Cobalt Strike Cat beacons delivered via MinGW- and Rust-compiled loaders that decode Marte shellcode, with logs showing active victim check-ins and operator access.