Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 20:14:42 UTC Home > List all groups > List all tools > List all groups using tool BEACON Tool: BEACON Names BEACON Category Malware Type Backdoor Description (Mandiant) The BEACON payloads, once executed, communicated using either self-managed infrastructure hosted behind Cloudflare or utilized Cloudflare Workers as their command-and-control (C2) channels. BEACON configuration can be found in the Indicators of Compromise section. Information Last change to this tool card: 26 August 2024 Download this tool card in JSON format All groups using tool BEACON Changed Name Country Observed APT groups   APT 41 2012-Jul 2025 1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=365cf995-1e41-4f59-a788-fea8af594f6c https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=365cf995-1e41-4f59-a788-fea8af594f6c Page 1 of 1