ScareCrow
ScareCrow is a payload creation framework referenced in the content as being used to generate a Go-based dropper that staged a Cobalt Strike payload. In the described UNC2465 intrusion, an in-memory dropper created with the ScareCrow framework was downloaded via UltraVNC to C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe and executed with cmd.exe. Its execution resulted in creation of a Cobalt Strike stageless payload at C:\ProgramData\Cisco\update.exe. The content states the framework is integrated with tactics for unhooking and bypassing EDR products while remaining undetected, and also discusses related tradecraft such as spoofing file metadata and blending into normal endpoint and network telemetry. The observed sample masqueraded as a Cisco Jabber updater. Associated infrastructure for the resulting Beacon included domain w2doger[.]xyz and IP 185.231.68.102. The activity was attributed in the report context to UNC2465, which used the ScareCrow-generated dropper alongside other tooling including SMOKEDHAM, UltraVNC, ngrok tunneling, a keylogger, and LSASS dumping during a supply-chain-compromise intrusion involving trojanized installers for SmartPSS and SVStation.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Update.exe was a Go based dropper created using the ScareCrow framework... resulted in the creation of a Cobalt Strike stageless payload
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Command and Control
1 technique"Mandiant then observed the attacker use UltraVNC to download two LNK files..." and "The attacker used UltraVNC to download an in-memory dropper for Cobalt Strike..."
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.