Manjusaka imitates Cobalt Strike with Rust implants and a Go C2

Attackers are using Manjusaka, a new post-exploitation framework that its author openly advertises as an imitation of Cobalt Strike. Cisco Talos found Rust implants for Windows and Linux, controlled by a single GoLang C2 server with a Simplified Chinese UI that is freely available on GitHub. In the observed campaign, COVID-19-themed Word lures about Golmud City in Qinghai delivered Cobalt Strike beacons, and the same actor ran Manjusaka implants against the same C2 address. Stephan Berger of InfoGuard took the free version apart: the panel listens on port 3200 by default, the C2 writes a SQLite database named nps.db on first start, and the implants come without any persistence mechanism. Apparently even Cobalt Strike has knock-off brands now, and this one comes free of charge and without a license check.