Manjusaka

Description

Manjusaka is a Chinese-language intrusion framework comparable to Cobalt Strike and Sliver, with a Go based controller for Windows and Linux implants written in Rust. First identified in 2022, it consists of multiple components, only one of which, the command and control module, is freely available.

Stats

First seen: August 2022
Last seen: September 2026

MITRE ATT&CK techniques

10 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0009 Collection

T1113Screen Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1132Data Encoding
- T1132.001Standard Encoding

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Alert name variants

Alert Name	Engine
Linux.Trojan.Manjusaka	ATP Sandbox Adv. Heuristics
Trojan.Linux.Manjusaka.3	AV
Trojan.Linux.Manjusaka.4	AV
Trojan.Linux.Manjusaka.5	AV
Trojan.Manjusaka.A	AV
Trojan.Manjusaka.B	AV
Trojan.Manjusaka.D	AV
Win64.Backdoor.Manjusaka	ATP Sandbox Adv. Heuristics
Win64.Trojan.Manjusaka	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.Manjusaka outbound connection	IPS-SWG

Related families

Zebrocy KONNI RedLine Stealer Empire Machete