Windows C++ proof of concept for carrying Cobalt Strike Beacon traffic in project-specific NTP extension fields through External C2. The client fetches the Beacon stage from a configured External C2 service, launches it through the project's documented CreateThread path, and exchanges Beacon data over a named pipe; a separate controller relays chunked traffic over NTP (UDP/123 by default). It requires a configured External C2 listener and network reachability to the configured NTP controller. The client and controller are separate Visual Studio solutions, and the project warns that its basic CreateThread launch is detectable.
C++
RESTRICTED_ACCESS_BLUR_MARKER