C2Looper v2 Uses GitHub Repositories as Full Command-and-Control Infrastructure.

C2Looper, a Rust-based backdoor likely associated with a ransomware-related threat actor.

A newer build, internally identified as version 2, replaces conventional command-and-control infrastructure with GitHub repositories used to deliver tasks, receive results, maintain beacon records, and host payloads.

ThreatLabz identified the malware in July 2026 and assesses, with low-to-medium confidence, that it is delivered through a multi-stage ClickFix infection chain.

The backdoor’s combination of host profiling, remote command execution, payload delivery, and evolving post-compromise functions suggests a role in establishing footholds before lateral movement, data theft, or ransomware deployment.

Earlier C2Looper samples communicate over plaintext HTTP using a simple JSON-based protocol.

The implant sends a beacon to /api/beacon every second, including a bot identifier derived from the compromised host’s DNS name and username, as well as the username, hostname, and process ID.

Operators return tasking instructions, while command output is submitted to /api/result/BOT_ID/task_ID.

The original command set is limited but operationally useful. The run and shell commands launch commands through cmd.exe; shell writes output to c2_out.txt before returning it to the server.

The upload command retrieves a PE payload, stores it as wtsapi32.dll under %LocalAppData%\Microsoft\OneDrive\, terminates OneDrive, and abuses a legitimate OneDrive executable for DLL sideloading.

This provides an update or payload-deployment mechanism that blends malicious code execution with a trusted Windows application.

Strings are decrypted at runtime through XOR using a consistent eight-byte key, an implementation choice that is straightforward but sufficient to obstruct casual static inspection.

C2Looper v2 removes the HTTP C2 endpoints entirely and makes GitHub the malware’s full operational backend.

Each infected host receives its own repository directory containing three JSON artifacts: cmd.json for pending instructions, result.json for command output, and beacon.json for the bot identifier and the timestamp of its last successful request.

This architecture gives operators a resilient, trusted web service for tasking and data exchange while eliminating attacker-owned C2 domains that defenders can more easily block, sinkhole, or correlate.

It also shifts detection opportunities toward anomalous GitHub API or repository access from endpoints that have no development-related business need.

Zscaler ThreatLabz identified a malware, C2Looper also employs basic defensive friction. All known variants dynamically resolve Windows APIs with LoadLibrary and GetProcAddress, reducing static imports that can simplify detection.

The v2 beacon is reduced to the victim username and a locally generated timestamp. The developer also removed the ok field from beacon traffic and corrected a task-sequence parsing flaw in older builds that caused returned results to be reported with task ID zero.

Debug content, including !!! v2 !!! pongv2 from, indicates the authors themselves refer to the revision as version 2.

C2Looper v2 Uses GitHub

Version 2 broadens the backdoor from a lightweight shell into a more practical intrusion utility. The recon function runs ipconfig /all, whoami /all, nltest /dclist, domain group queries, installed-product enumeration, and drive discovery.

These commands expose identity context, network configuration, Active Directory topology, privileged groups, available storage, and installed software high-value intelligence for ransomware operators preparing lateral movement.

New ls and drives capabilities support filesystem discovery, while shell now captures output through Windows pipes rather than using the observable c2_out.txt staging file.

The revised run command launches a file with ShellExecuteW and removes it if execution succeeds. The upload routine now pulls files from a dedicated GitHub repository folder into the Windows temporary directory.

Most notably, the inject command loads legitimate winspool.drv, copies downloaded shellcode into its .text section, and starts a thread at that memory address.

The technique attempts to execute attacker-controlled code from the memory of a legitimate module, complicating memory-based triage and behavioral detection.

Security teams should investigate unexpected GitHub access from non-developer Windows endpoints, especially repository interactions followed by shell execution, PowerShell or CMD activity, ShellExecuteW launches, unusual OneDrive process termination, or DLL sideloading behavior.

Monitoring for reconnaissance commands such as nltest /dclist, net group /domain, and whoami /all can surface early-stage post-compromise activity.

C2Looper’s progression shows that its operators are actively refining both reliability and stealth.

The transition to GitHub-backed tasking is particularly significant: it transforms a public developer platform into a reusable C2 transport, payload store, and exfiltration channel in a single workflow.

Indicators Of Compromise (IOCs)

IOC	Description
f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b	Latest variant of C2Looper.
20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549	C2Looper debug build.
f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6	Older variant of C2Looper.
45.158.196[.]23:8888	C2Looper C2.
45.158.196.184:8888	C2Looper C2.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now