Researchers from Cisco Talos discovered a relatively new attack framework dubbed “Manjusaka” that mimics the popular Cobalt Strike framework. Cobalt Strike is an offensive framework that allows penetration testers and ethical hackers to easily implant and manage beacons during security tests, but malicious threat actors have also gotten their hands on the tool. Due to the popularity of the Cobalt Strike tool, many endpoint detection and antivirus products detect the beacons it plants on victim machines. The risk of detection led to sophisticated threat actors developing their own frameworks. The Manjusaka framework uses Golang to program its command and control (C2) server and user interface while the implants that are installed on victim devices are written in Rust. The implants are remote access trojans, arriving on victim computers through a malicious Microsoft Word document. They have multiple functionalities on both Windows and Linux devices, such as command execution, harvesting credentials, taking screenshots, and file management capabilities. The researchers discovered a C2 project on GitHub that features the same C2 user interface written in the Simplified Chinese language that Manjusaka uses. The C2 server is built on the Gin Web Framework and interacts with the implants using HTTP requests. The communications can also be encrypted using a cryptographic key. When analyzing the Rust implants, the researchers also noticed the malware does not use the default “crates.io” library repository. Instead, it is manually configured to use a package mirror run by the University Science and Technology of China. This, along with OSINT findings, resulted in the malware being attributed to the GuangDong region of China, though it’s operators may reside elsewhere. Interestingly, the campaigns where Manjusaka was used also installed a Cobalt Strike beacon on the victim device. Due to the open-source nature of the C2 framework, it is possible this malware may become popular outside of its original operators. CTIX analysts recommend blocking known hashes and IOCs relating to the Manjusaka framework and utilizing endpoint detection to defend against the implants.