Its the latest massive ransomware exploit, as concerns over such attacks have skyrocketed. The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable. Ransomware attack on Kaseya, a software firm, threatens businesses worldwide.

Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP Beacons can be daisy-chained. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement.

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine.

Kaseya agent wiki