CrossC2 loader links Linux Cobalt Strike attacks to Black Basta
JPCERT/CC observed attackers using CrossC2 to run Cobalt Strike Beacons on Linux/macOS alongside a custom loader chain tied by infrastructure overlap to Black Basta.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Between September and December 2024, JPCERT/CC investigated intrusions using CrossC2, an unofficial cross-platform extension that lets attackers generate Cobalt Strike Beacons for Linux and macOS in addition to Windows. The attacker combined CrossC2 with standard Cobalt Strike, PsExec, Plink, and GetNPUsers (AS-REP Roasting) in apparent attempts to compromise Active Directory environments, while also deploying ELF variants of SystemBC on Linux hosts — systems that frequently lack EDR coverage and thus serve as durable footholds.
On the Windows side, JPCERT/CC identified a custom loader dubbed ReadNimeLoader, written in Nim and sideloaded via a legitimate java.exe (jli.dll) launched from an attacker-created Scheduled Task. ReadNimeLoader decrypts a companion readme.txt using AES-256-ECB with a key partially embedded inside its anti-debugging routines, then hands execution to OdinLdr, an open-source shellcode loader that decodes and runs the Cobalt Strike Beacon in memory, periodically re-encrypting it with a random XOR key to evade memory scanners. Both CrossC2 and ReadNimeLoader employ heavy junk-code insertion and string XOR-encoding as anti-analysis measures. Files were staged under C:\$recycle.bin\, and some samples carried a spoofed Battle.net Launcher PDB path.
JPCERT/CC assesses a potential link to Black Basta based on overlapping infrastructure (a C2 domain matching one in Rapid7's Black Basta reporting), shared filenames (jli.dll, readme.txt), consistent use of SystemBC, and AS-REP Roasting during AD attacks. VirusTotal submissions suggest the campaign was not limited to Japan. JPCERT/CC released a public CrossC2 Beacon configuration parser to aid detection and analysis.
Mentioned in this report
Detection guidance
Java Process Loading Suspicious DLL via Sideloading
A behavioural hunt for the technique in general.
java.exe or javaw.exe spawned from a Scheduled Task loads jli.dll, characteristic of DLL sideloading attacks using legitimate Java binaries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Loading Suspicious DLL via Sideloading
description: Detects java.exe or javaw.exe spawned by schtasks.exe (or task scheduler)
and subsequently loading jli.dll - indicative of DLL sideloading where attackers
abuse legitimate Java binaries to load malicious libraries.
tags:
- attack.stealth
- attack.t1574.001
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \schtasks.exe
- \taskeng.exe
selection_java:
Image|endswith:
- \java.exe
- \javaw.exe
condition: selection_parent and selection_java
falsepositives:
- Legitimate Java application deployments scheduled via Windows Task Scheduler
- Software deployment or update tasks that invoke Java binaries
level: high
id: 7aefd32f-3046-5b57-a7e3-131044403578
status: experimental
author: Vorant
Scheduled Task Creating Java Process with Uncommon Working Directory
A behavioural hunt for the technique in general.
schtasks.exe creates a task that launches java.exe or javaw.exe from $Recycle.Bin or other suspicious staging locations, commonly used for loader persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scheduled Task Creating Java Process with Uncommon Working Directory
description: Detects schtasks.exe registering a scheduled task that executes java.exe
or javaw.exe, particularly when staged in suspicious locations like $Recycle.Bin.
This behaviour is atypical for legitimate Java deployments and aligns with ReadNimeLoader
persistence patterns.
tags:
- attack.persistence
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \schtasks.exe
CommandLine|contains: /create
selection_java_task:
CommandLine|contains:
- java.exe
- javaw.exe
selection_suspicious_path:
CommandLine|contains:
- $recycle.bin
- \\$recycle.bin
- AppData\\Roaming\\Microsoft\\
condition: selection and selection_java_task and selection_suspicious_path
falsepositives:
- Custom enterprise Java deployment orchestration tools
- Specialized backup or recovery software staging executables in recycle bin paths
level: high
id: 6e044410-936d-5745-b224-a705065aa56a
status: experimental
author: Vorant
Process Injection via Legitimate Loader Binary Spawning Beacon Shell
A behavioural hunt for the technique in general.
Legitimate Windows binary (java.exe, rundll32.exe) creates a subprocess that immediately injects shellcode or in-memory payload, characteristic of OdinLdr or similar memory-resident loaders. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Injection via Legitimate Loader Binary Spawning Child Process
description: Detects a benign Windows binary (java.exe, rundll32.exe, or similar)
spawning a child process with suspicious characteristics (hollow creation, low integrity,
or direct shellcode execution patterns). This pattern aligns with OdinLdr in-memory
Beacon injection techniques.
tags:
- attack.stealth
- attack.t1055
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \rundll32.exe
selection_child:
Image|endswith:
- \svchost.exe
- \lsass.exe
- \services.exe
- \explorer.exe
selection_suspicious_cmdline:
CommandLine: ''
filter_legitimate:
ParentCommandLine|contains:
- Update
- Install
condition: selection_parent and selection_child and selection_suspicious_cmdline
and not filter_legitimate
falsepositives:
- Java applications legitimately spawning system processes for sandboxing
- Software update agents using rundll32 to launch child processes
level: medium
id: 6ce1132b-feda-5854-9545-f6c868576d03
status: experimental
author: Vorant
3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2025/08/crossc2.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs