CrossC2 loader links Linux Cobalt Strike attacks to Black Basta

14 August 2025 routine threat

JPCERT/CC observed attackers using CrossC2 to run Cobalt Strike Beacons on Linux/macOS alongside a custom loader chain tied by infrastructure overlap to Black Basta.

Between September and December 2024, JPCERT/CC investigated intrusions using CrossC2, an unofficial cross-platform extension that lets attackers generate Cobalt Strike Beacons for Linux and macOS in addition to Windows. The attacker combined CrossC2 with standard Cobalt Strike, PsExec, Plink, and GetNPUsers (AS-REP Roasting) in apparent attempts to compromise Active Directory environments, while also deploying ELF variants of SystemBC on Linux hosts — systems that frequently lack EDR coverage and thus serve as durable footholds.

On the Windows side, JPCERT/CC identified a custom loader dubbed ReadNimeLoader, written in Nim and sideloaded via a legitimate java.exe (jli.dll) launched from an attacker-created Scheduled Task. ReadNimeLoader decrypts a companion readme.txt using AES-256-ECB with a key partially embedded inside its anti-debugging routines, then hands execution to OdinLdr, an open-source shellcode loader that decodes and runs the Cobalt Strike Beacon in memory, periodically re-encrypting it with a random XOR key to evade memory scanners. Both CrossC2 and ReadNimeLoader employ heavy junk-code insertion and string XOR-encoding as anti-analysis measures. Files were staged under C:\$recycle.bin\, and some samples carried a spoofed Battle.net Launcher PDB path.

JPCERT/CC assesses a potential link to Black Basta based on overlapping infrastructure (a C2 domain matching one in Rapid7's Black Basta reporting), shared filenames (jli.dll, readme.txt), consistent use of SystemBC, and AS-REP Roasting during AD attacks. VirusTotal submissions suggest the campaign was not limited to Japan. JPCERT/CC released a public CrossC2 Beacon configuration parser to aid detection and analysis.

Mentioned in this report

Threat actors Black Basta

Malware Cobalt StrikeCrossC2GetNPUsersOdinLdrPlinkPsExecReadNimeLoaderSystemBC

Detection guidance

Java Process Loading Suspicious DLL via Sideloading

ATT&CK T1574.002

java.exe or javaw.exe spawned from a Scheduled Task loads jli.dll, characteristic of DLL sideloading attacks using legitimate Java binaries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Loading Suspicious DLL via Sideloading
description: Detects java.exe or javaw.exe spawned by schtasks.exe (or task scheduler)
  and subsequently loading jli.dll - indicative of DLL sideloading where attackers
  abuse legitimate Java binaries to load malicious libraries.
tags:
- attack.defense-evasion
- attack.t1574.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \schtasks.exe
    - \taskeng.exe
  selection_java:
    Image|endswith:
    - \java.exe
    - \javaw.exe
  condition: selection_parent and selection_java
falsepositives:
- Legitimate Java application deployments scheduled via Windows Task Scheduler
- Software deployment or update tasks that invoke Java binaries
level: high
id: 7aefd32f-3046-5b57-a7e3-131044403578
status: experimental
author: Vorant

Scheduled Task Creating Java Process with Uncommon Working Directory

ATT&CK T1053.005

schtasks.exe creates a task that launches java.exe or javaw.exe from $Recycle.Bin or other suspicious staging locations, commonly used for loader persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Scheduled Task Creating Java Process with Uncommon Working Directory
description: Detects schtasks.exe registering a scheduled task that executes java.exe
  or javaw.exe, particularly when staged in suspicious locations like $Recycle.Bin.
  This behaviour is atypical for legitimate Java deployments and aligns with ReadNimeLoader
  persistence patterns.
tags:
- attack.persistence
- attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains: /create
  selection_java_task:
    CommandLine|contains:
    - java.exe
    - javaw.exe
  selection_suspicious_path:
    CommandLine|contains:
    - $recycle.bin
    - \\$recycle.bin
    - AppData\\Roaming\\Microsoft\\
  condition: selection and selection_java_task and selection_suspicious_path
falsepositives:
- Custom enterprise Java deployment orchestration tools
- Specialized backup or recovery software staging executables in recycle bin paths
level: high
id: 6e044410-936d-5745-b224-a705065aa56a
status: experimental
author: Vorant

Process Injection via Legitimate Loader Binary Spawning Beacon Shell

ATT&CK T1055

Legitimate Windows binary (java.exe, rundll32.exe) creates a subprocess that immediately injects shellcode or in-memory payload, characteristic of OdinLdr or similar memory-resident loaders. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Injection via Legitimate Loader Binary Spawning Child Process
description: Detects a benign Windows binary (java.exe, rundll32.exe, or similar)
  spawning a child process with suspicious characteristics (hollow creation, low integrity,
  or direct shellcode execution patterns). This pattern aligns with OdinLdr in-memory
  Beacon injection techniques.
tags:
- attack.defense-evasion
- attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \rundll32.exe
  selection_child:
    Image|endswith:
    - \svchost.exe
    - \lsass.exe
    - \services.exe
    - \explorer.exe
  selection_suspicious_cmdline:
    CommandLine: ''
  filter_legitimate:
    ParentCommandLine|contains:
    - Update
    - Install
  condition: selection_parent and selection_child and selection_suspicious_cmdline
    and not filter_legitimate
falsepositives:
- Java applications legitimately spawning system processes for sandboxing
- Software update agents using rundll32 to launch child processes
level: medium
id: 6ce1132b-feda-5854-9545-f6c868576d03
status: experimental
author: Vorant

3 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/en/2025/08/crossc2.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free