Threat reportMalwareTL-2026-3395
C2Looper: New Rust Backdoor Likely Tied to Ransomware Operations, Uses GitHub for C2
C2Looper: New Rust Backdoor Likely Tied to Ransomware (TL-2026-3395), also tracked as C2Looper, is a high-severity malware campaign, first published 2026-10-13. It has no confirmed attribution, affects Microsoft Windows (x64), maps to 15 MITRE ATT&CK techniques (T1018, T1027, T1033), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-3395
- Threat ID
- TL-2026-3395
- Also known as
- C2Looper
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in C2Looper: New Rust Backdoor Likely Tied to Ransomware
Malware and tooling: Broomstick, C2Looper, Latrodectus - S1160, Win64.Trojan.C2Looper, Nltest - S0359, cmd - S0106
How C2Looper: New Rust Backdoor Likely Tied to Ransomware works
Zscaler ThreatLabz describes C2Looper, a Rust-based Windows backdoor likely used by ransomware-related actors. Version 1 beacons over plaintext HTTP POST; version 2 uses a GitHub repository (JSON files) for tasking and results. ThreatLabz assesses with low to medium confidence that delivery is via a multi-stage ClickFix chain.
C2Looper is a Rust-based Windows backdoor identified by Zscaler ThreatLabz in July 2026 and described as likely used by a ransomware-related threat actor to establish footholds. ThreatLabz assesses with low to medium confidence that it is delivered through a multi-stage ClickFix infection chain, in which victims are tricked into pasting and running attacker-supplied commands; the individual ClickFix stages are not detailed in the public report. The malware resolves Windows APIs dynamically (LoadLibrary/GetProcAddress) and encrypts its strings with an 8-byte XOR key.
Version 1 sends a JSON beacon (id as DNSHOSTNAME_Username, user, host, pid) via HTTP POST to /api/beacon every second on the operator's server (45.158.196.23:8888 and 45.158.196.184:8888) and returns results to /api/result/BOT_ID/task_ID. Supported commands are ping, run (cmd.exe, output ignored), shell (output written to c2_out.txt and exfiltrated), upload (drops a PE to %LocalAppData%\Microsoft\OneDrive\ as wtsapi32.dll, terminates OneDrive and sideloads the DLL through the legitimate executable) and download (saves pld.exe to %LocalAppData%, purpose unknown). A JSON parsing bug (seq integer vs string) causes the task ID to always be reported as 0.
Version 2 replaces the HTTP C2 with a GitHub repository. Each bot gets a directory holding cmd.json (commands), result.json (output) and beacon.json (bot ID and last successful request timestamp). The beacon is reduced to username and local timestamp, the binary contains the debug string '!!! v2 !!! pongv2 from', and the seq bug is fixed. New or changed commands: ls, recon (ipconfig /all, whoami /all, nltest /dclist, domain computer and admin enumeration, WMIC product inventory), drives, inject (loads winspool.drv, copies shellcode into the text section and runs it in a new thread), upload (downloads from a dedicated GitHub folder to the Windows temp directory), run (ShellExecuteW, deletes the file after execution) and shell (output captured via Windows pipes). Routing tasking and data theft through GitHub makes operator traffic resemble ordinary developer activity.
Attribution is unresolved. ThreatLabz notes that the Oyster malware, which is likely related to the actor behind Latrodectus (spelled 'Lactrodectus' in the Zscaler post), uses similar API endpoints for C2; third-party coverage states this is insufficient for definitive attribution. The source lists no CVEs and no GitHub account or repository names. Severity is an analyst assessment, not stated by the source. Zscaler detects the sample as Win64.Trojan.C2Looper.
MITRE ATT&CK techniques used in TL-2026-3395
Discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1571 Non-Standard Port
Exfiltration
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
stealth
Affected products and versions in C2Looper: New Rust Backdoor Likely Tied to Ransomware
- Microsoft — Windows (x64)
Vulnerable versions: Windows x64 endpoints (no specific versions stated by source)
Remediation for C2Looper: New Rust Backdoor Likely Tied to Ransomware
Immediate actions
- Block 45.158.196.23 and 45.158.196.184 (TCP/8888) at the perimeter and hunt historical egress to them
- Hunt for wtsapi32.dll created or modified in %LocalAppData%\Microsoft\OneDrive\ and for unexpected OneDrive process termination
- Hunt for pld.exe in %LocalAppData% and c2_out.txt on endpoints
- Review GitHub API and raw.githubusercontent.com traffic from non-developer hosts and non-browser processes
Workarounds
- Where GitHub is not a business requirement, restrict or proxy-inspect access to it from servers and standard user workstations
Longer-term hardening
- Train staff to recognize paste-and-run (ClickFix) lures and restrict Win+R / PowerShell paste-execution where feasible
- Restrict execution from user-writable paths such as %LocalAppData% and temp directories (application control)
- Alert on thread creation within modified sections of signed system modules (e.g. winspool.drv)
- Deploy EDR with behavioral detection for DLL sideloading and process injection
Timeline of C2Looper: New Rust Backdoor Likely Tied to Ransomware
- C2Looper version 1 observed beaconing via HTTP POST to /api/beacon on 45.158.196.23:8888 and 45.158.196.184:8888 (observation month per ThreatLabz; exact date not stated).
- Zscaler ThreatLabz identifies C2Looper in July 2026 (exact day not stated in the source; first of month used as month marker).
- Zscaler sandbox and endpoint detections identify the sample as Win64.Trojan.C2Looper; three SHA-256 hashes (older, debug and latest variants) are published as IOCs.
- ThreatLabz notes that Oyster malware, likely related to the actor behind Latrodectus, uses similar C2 API endpoints; no definitive attribution is made and ClickFix delivery is assessed with low to medium confidence.
- Zscaler ThreatLabz publishes 'C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2' with 3 SHA-256 hashes, 2 C2 IPs and detection name Win64.Trojan.C2Looper.
- ThreatLabz documents version 2, which moves tasking and results to a GitHub repository using cmd.json, result.json and beacon.json per bot, indicating continued development.
- Secondary coverage of the Zscaler research appears (Gurucul community summary dated 18 August 2026), followed by Hive Pro, detections.ai, ThreatCluster and OffSeq summaries.
Sources cited for C2Looper: New Rust Backdoor Likely Tied to Ransomware
- C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 (Zscaler ThreatLabz)
- C2Looper Builds Footholds for Ransomware (Hive Pro threat advisory)
- C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 (Gurucul community)
- C2Looper: Rust-Based Backdoor Utilizing GitHub for C2 (detections.ai)
- C2Looper Backdoor Exploits GitHub for Command-and-Control Operations (ThreatCluster)
- C2Looper threat summary (OffSeq Radar)
Detection coverage for TL-2026-3395
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3395 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.