C2Looper Backdoor Malware Uses GitHub for C2
Security specialists at Zscaler have unearthed a novel backdoor dubbed C2Looper, which malicious actors presumably deploy as a precursor to devastating ransomware assaults. This pernicious software enables adversaries to establish a clandestine foothold within a network, harvest critical intelligence regarding host machines, execute arbitrary commands, and seamlessly download supplementary malicious payloads. Comprehensive analysis reveals that its architects have already significantly augmented the capabilities of the C2Looper framework.
The Evolution of a Rust-Based Threat
The ThreatLabz research team initially detected C2Looper in July 2026. Forged in the Rust programming language, the backdoor conceals its internal strings utilizing XOR operations and dynamically loads essential Windows functions exclusively during active execution. Zscaler researchers attribute the proliferation of C2Looper to ClickFix campaigns, albeit with low to medium confidence, wherein victims are cunningly deceived into manually executing malicious commands.
Initial HTTP Command Infrastructure
The inaugural iteration of this malware communicated with its command and control infrastructure via unencrypted HTTP protocols. At intervals of a single second, C2Looper dispatched a request transmitting the username, computer moniker, and its specific process identifier. In return, the server could instruct the program to execute system-level commands, spawn a command shell, or retrieve supplementary files.
To facilitate updates, C2Looper downloaded a malicious wtsapi32.dll library directly into the OneDrive directory. It then abruptly terminated the application process and compelled the legitimate OneDrive executable to load the compromised library. This sophisticated technique successfully executes malicious code through the facade of a trusted application, thereby severely complicating detection efforts.
Migrating to GitHub for Command and Control
Subsequently, security experts discovered C2Looper version 2. This evolved variant entirely abandoned the reliance on an independent command server, strategically migrating its command and control exchange mechanisms directly to GitHub. For every infected host, the malware meticulously generates a distinct directory within the repository and interacts with three specific JSON files. The operator deposits instructions within cmd.json, while result.json receives the output of their subsequent execution. Concurrently, beacon.json preserves the unique identifier of the compromised system alongside the timestamp of its most recent communication.
Enhanced Reconnaissance and Payload Execution
C2Looper version 2 possesses the capability to peruse files and disk drives, harvest comprehensive intelligence regarding the operating system and the overarching Windows domain, launch applications, and download novel components. To execute reconnaissance operations, the malware invokes standard system commands such as ipconfig, whoami, nltest, net, and wmic. An additional directive permits the insertion of downloaded machine code directly into the memory enclave of the legitimate winspool.drv library, subsequently executing it within an isolated thread.
Furthermore, the developers rectified a flaw present in the inaugural version, which caused C2Looper to process job identifiers inaccurately. Within the source code of this second iteration, residual debug strings explicitly marked “v2” persist, unequivocally confirming that this malware family remains under active and aggressive development.
A Precursor to Ransomware Deployment
As detailed in a recent analysis, Zscaler postulates that C2Looper functions primarily as an instrument for initial network penetration. Having successfully established access, malicious actors can meticulously map the corporate network, exfiltrate highly confidential data, and subsequently deploy devastating ransomware. However, security specialists have not yet established a definitive correlation between C2Looper and any specific cybercriminal syndicate.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
