Hackers Use GitHub and Social Media to Deliver Cobalt Strike Beacon

The latter half of 2024 saw a highly sophisticated cyberattack campaign targeting companies in Russia’s IT sector, with collateral activity detected in China, Japan, Malaysia, and Peru.

This operation, which was most active from November 2024 through April 2025, utilized clever evasion tactics, namely leveraging widely trusted platforms such as GitHub, Quora, Microsoft Learn Challenge, and Russian-language social networks to deliver and manage their payload.

By embedding key data for their malware inside profiles and user-generated content on these platforms, the attackers created a multifaceted and resilient execution chain that made traditional detection measures less effective.

Complex Execution Chains

The attacks began with spear phishing emails posing as communications from prominent state-owned entities, especially in the oil and gas industry.

Recipients were presented with what appeared to be business proposals or requests for information, but the attachments specifically named RAR archives contained a malicious payload.

The archive mimicked legitimate corporate documentation but harbored a hidden directory with executables camouflaged as PDFs.

Upon executing a .lnk shortcut, these executables were copied and renamed within the user’s environment, setting the stage for further compromise.

Central to this campaign was the abuse of DLL hijacking, specifically using the legitimate BugSplat crash reporting utility (BsSndRpt.exe), renamed to avoid suspicion and paired with a malicious DLL dubbed BugSplatRc64.dll.

As the renamed utility required the DLL to operate, the attacker ensured their malicious code was loaded instead of the authentic library.

This DLL not only hijacked legitimate calls but also obfuscated its operations by employing dynamic API resolution concealing function calls until they were needed via a CRC-like hashing routine and encrypting hashes with XOR to hamper static analysis.

Payload Delivery Through Social Platforms

The infection chain was engineered with multiple layers of stealth. Once the DLL gained execution, it hooked a Windows API (often MessageBoxW) and rerouted control to a custom function within the malicious library.

This function initiated the process of retrieving further shellcode from web-based sources. Notably, the malware extracted C2-related information and secondary payload URLs hidden within HTML content of user profiles on mainstream platforms such as Microsoft Tech Community, Quora, GitHub, and regional social media.

Base64-encoded and XOR-obfuscated strings within this content pointed the malware client to locations where shellcode could be fetched and then decrypted, ultimately leading to the deployment of the notorious Cobalt Strike Beacon.

The deployment sequence involved spawning redundant processes to repeat key steps, thereby complicating behavioral detection by sandboxes or endpoint security tools.

The final payload a reflective loader was responsible for injecting Cobalt Strike Beacon directly into memory, which then reached out to its command and control (C2) for further instructions.

Analysis revealed similarities to the EastWind campaign previously known for placing C2 data within disguised social media profiles using comparable XOR-based encryption.

The majority of observed victims were from major and mid-sized organizations in Russian IT, but the threat was not geographically limited.

Importantly, all malicious social media and platform accounts identified were purpose-built for the operation, with no evidence thus far of legitimate user profiles being compromised.

However, the techniques employed could easily be adapted to abuse comment sections or legitimate user accounts, further broadening the threat landscape.

Kaspersky’s security solutions currently flag this threat using a series of generic verdicts, and recommend organizations maintain vigilant monitoring, foster staff security awareness, and verify the integrity of key executables and DLLs.

Presence of BugSplatRc64.dll or a crash reporting executable appearing under a nonstandard name are strong indicators of compromise.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates