Skip to main content
Mallory
MalwareUsed by 1 actor

COBEACON

COBEACON is malware identified in the provided content as Cobalt Strike Beacon. It is used by the China-linked espionage threat actor Earth Alux, which overlaps with activity tracked as Jewelbug, CL-STA-0049, and REF7707. In the described intrusions, Earth Alux used COBEACON alongside tools such as VARGEIT, RAILLOAD, and RAILSETTER to establish persistence, steal credentials, and maintain command and control. The activity targeted government, technology, logistics, manufacturing, telecommunications, IT services, and retail organizations, primarily in the Asia-Pacific and Latin American regions. The broader intrusion tradecraft associated with these operations included initial access via webshells, use of renamed legitimate binaries such as cdb.exe disguised as fontdrvhost.exe to execute shellcode, process injection into legitimate Windows processes including MSPaint, calc.exe, and notepad.exe, DLL side-loading, browser credential theft, and exfiltration of compressed sensitive data to cloud storage buckets. High-confidence detection opportunities mentioned in the content include unusual process paths, suspicious DLL loading, credential access behavior, and abnormal network connections originating from trusted Windows binaries.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Earth Alux

Earth Alux employs multiple custom tools including VARGEIT, RAILLOAD, RAILSETTER, and COBEACON to establish persistence, steal credentials, and maintain command and control.

via splunk researchresearch.splunk.com
MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

T1003OS Credential DumpingEvidence1

Earth Alux employs multiple custom tools including VARGEIT, RAILLOAD, RAILSETTER, and COBEACON to establish persistence, steal credentials, and maintain command and control.

T1071Application Layer ProtocolEvidence1

Command and Control T1071: Application Layer Protocol

T1105Ingress Tool TransferEvidence1

"China-Linked Earth Alux Uses VARGEIT and COBEACON in Multi-Stage Cyber Intrusions"

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.