Pikabot: The Multi-C2 Cobalt Strike Loader

A freight operations coordinator followed a malspam link to a compromised site and downloaded a transport docket that turned out to be a script. Follow the chain from the booby-trapped link through a curl-staged loader DLL, a rundll32 execution proxy, and a spread of high-port beacons to the memory-only Cobalt Strike handoff.