Recent Cybersecurity Alerts: The Rise of CrossC2 Framework
In recent months, Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC) has issued a significant warning regarding a newly identified command-and-control (C2) framework known as CrossC2. This tool, designed to enhance the capabilities of the widely recognized Cobalt Strike, allows for cross-platform operations, including Linux and macOS environments. The activity surrounding CrossC2 was observed between September and December of 2024 and has impacted various countries, including Japan.
Identifying the Threat
JPCERT/CC’s investigation revealed that the CrossC2 framework was employed alongside other popular penetration tools such as PsExec, Plink, and the original Cobalt Strike. According to JPCERT/CC researcher Yuma Masubuchi, these tools formed part of an extensive strategy aimed at compromising Active Directory systems. A closer analysis indicated that attackers utilized custom malware to serve as a loader for Cobalt Strike, making the threat even more sophisticated.
Understanding ReadNimeLoader
The malware loader involved has been identified as ReadNimeLoader. This bespoke tool, crafted specifically for the task, is closely tied to the functionality of Cobalt Strike. CrossC2 operates as an unofficial beacon and a builder, activating numerous commands from Cobalt Strike after a secure connection to a designated remote server is established. In these cyber incidents, the attackers utilized scheduled tasks on compromised devices to launch legitimate processes, specifically exploiting the java.exe binary to initiate ReadNimeLoader through a sideload process involving “jli.dll.”
Advanced Techniques of ReadNimeLoader
One of the noteworthy aspects of ReadNimeLoader is its construction in the Nim programming language. It features advanced mechanisms that extract and execute commands directly in memory, minimizing the risk of leaving digital footprints. This technique utilizes an open-source shellcode loader called OdinLdr, which decodes and runs the embedded Cobalt Strike Beacon, also in memory. Additionally, ReadNimeLoader incorporates various anti-debugging and anti-analysis strategies to ensure that its operations remain undetected until the path is clear for execution.
Connections to Ransomware Activities
The JPCERT/CC report draws parallels between the recent CrossC2 campaigns and previously documented activities related to the BlackSuit/Black Basta ransomware, as detailed by Rapid7 in June 2025. Shared command-and-control domains and similarly named files suggest a potential overlap between these threat actors. Furthermore, several ELF variants of SystemBC, known for acting as precursors to Cobalt Strike and ransomware deployments, were also identified within the context of these attacks.
Implications for Linux Servers
While Cobalt Strike is no stranger to cybersecurity incidents, JPCERT/CC has highlighted a particular concern regarding the effective use of the CrossC2 framework against Linux servers. Many of these environments lack endpoint detection and response (EDR) systems, rendering them vulnerable entry points for attackers aiming to infiltrate internal networks. This vulnerability underlines the necessity for enhanced protective measures, especially as cyber threats evolve.
