RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting

A cluster of trojanized npm packages is delivering the RedC2 4.0 Linux implant, providing operators with a pathway from a seemingly harmless dependency import to internal network pivoting via SOCKS5 proxies and TCP forwarding.

The campaign disguises malicious code inside functional calendar and streak-calculation utilities, underscoring how supply-chain abuse can bypass controls focused only on npm lifecycle scripts.

TrendAI Research identified 14 malicious packages, including streak-metrics-math, kit-map-vim, streak-map-cache, and streak-calc-math, that provide the date-math features advertised in their documentation.

Beneath that legitimate functionality, however, each package carries an ELF binary masquerading as a native calculation accelerator. The binary is the RedShell Linux implant, introduced with RedC2 4.0 in June 2026.

The delivery mechanism is especially notable. Rather than relying on a preinstall or postinstall hook, the malicious dist/index.mjs entry point launches an asynchronous initialization routine when the package is imported.

It resolves the bundled binary relative to the module, changes its permissions to executable, verifies its SHA-256 hash, and spawns it as a detached child process.

This means that a single import potentially from a transitive dependency can activate the implant. npm’s –ignore-scripts safeguard does not prevent this execution path because no lifecycle script is involved.

Once launched, RedShell daemonizes via a double-fork routine, disconnecting from the importing Node.js process and continuing in the background.

TrendAI™ Research analyzed a supply chain compromise beginning with a cluster of trojanized npm packages that hide a Linux backdoor behind date utilities.

RedC2 4.0 Linux implant

The implant establishes a TLS-protected command-and-control channel to a hardcoded server at 217.60.77.63:8792, with certificate validation disabled.

Its command traffic receives a further custom obfuscation layer based on repeated XOR operations and ROR1 transformations, while separate functions use plaintext HTTP for payload retrieval and bulk exfiltration.

The most operationally significant feature is RedShell’s built-in network pivoting. Operators can invoke /socks start <port> to create a SOCKS5 proxy listener on all IPv4 interfaces of the compromised Linux host.

Connections arriving at the listener can be relayed to destinations selected by the SOCKS client, effectively converting an exposed development server, build agent, or container host into an internal access point.

Unlike the encrypted main C2 channel, SOCKS proxy listener traffic is raw TCP. Encryption depends entirely on the proxied application protocol, such as SSH or HTTPS.

The same applies to RedShell’s TCP forwarding capability: /portfwd start <local-port> <remote-host> <remote-port> binds a listener on the compromised host and relays connections to an internal service chosen by the operator.

These features can allow attackers to reach otherwise inaccessible administrative interfaces, databases, SSH services, and lateral-movement targets.

RedC2 extends the traditional C2 model with Red Agent, an LLM-backed command layer accessible through the /ra command in its console and external CLI.

According to the framework documentation, Red Agent converts natural-language objectives into an ordered sequence of beacon actions, reducing the effort needed to coordinate reconnaissance, file discovery, credential collection, and other post-compromise activity.

On Linux, RedShell supports shell execution, reverse shells, process and user management, SSH key theft, browser credential collection, database discovery, fileless ELF execution through memfd_create, shellcode loading, shared-library execution via dlopen, and several persistence options.

The implant can establish persistence using cron @reboot entries, .bashrc modifications, user-level systemd services, or XDG autostart entries.

Defenders should urgently identify use of the affected packages and inspect both direct and transitive dependency trees.

On endpoints, investigate unexpected ELF files in Node.js package dist/ directories, suspicious chmod activity followed by detached processes, and anomalous systemd, cron, .bashrc, or XDG autostart changes.

Network teams should monitor for outbound connections to 217.60.77.63 on ports 8792, 8060, and 8888, as well as unexplained Linux listeners bound to 0.0.0.0 that may expose SOCKS5 or port-forwarding services.

The implant’s calls to api.ipify.org and uploads to litterbox.catbox.moe may provide additional investigation leads.

IOCs

SHA-256	File name	Detection
4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466	math-core.bin	Backdoor.Linux.REDSHELL.A
—	math-calc.bin	—
—	calc-math.dat	—
—	calc-cache.bin	—
—	math-calc.bin	—
—	calc.bin	—
—	calc-mapping.bin	—
969EF45E5E1C382D421580B8306AFF0ABF0C4D302F0AF7091AC44CE70A92F789	index.mjs	Trojan.JS.REDSHELL.A
1C5B97AD2212DE1046EAB1EF66FF5E7E21CA93C918F54F3369C06C64271F2D82	index.mjs	Trojan.JS.REDSHELL.A
0B9AEF51D5EC55D69FB52ADA41377CED07C6CFF0CAD09174390F49081D439B14	index.mjs	Trojan.JS.REDSHELL.A
F71FFEC658EB31FB2292F83E02F9451ACB6A6D70F1B7988D9CCC308286B288B9	index.mjs	Trojan.JS.REDSHELL.A
69FE4881065CF4A5E30CBAEAF30C16FD891D5BFC5A6263E518FB3EF2E23D0889	index.mjs	Trojan.JS.REDSHELL.A
7FCC2BAA9D65C190A07ADD27F84AD0644AC77A62EEB5A49062BAD290133E2CD6	index.mjs	Trojan.JS.REDSHELL.A

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide