# C2Looper: New Rust Backdoor Likely Tied to Ransomware Operations, Uses GitHub for C2

> Zscaler ThreatLabz describes C2Looper, a Rust-based Windows backdoor likely used by ransomware-related actors. Version 1 beacons over plaintext HTTP POST; version 2 uses a GitHub repository (JSON files) for tasking and results. ThreatLabz assesses with low to medium confidence that delivery is via a multi-stage ClickFix chain.

- **Published:** 2026-10-13T10:33:20Z
- **Last reviewed:** 2026-10-13T10:33:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3395
- **ID:** TL-2026-3395
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

C2Looper is a Rust-based Windows backdoor identified by Zscaler ThreatLabz in July 2026 and described as likely used by a ransomware-related threat actor to establish footholds. ThreatLabz assesses with low to medium confidence that it is delivered through a multi-stage ClickFix infection chain, in which victims are tricked into pasting and running attacker-supplied commands; the individual ClickFix stages are not detailed in the public report. The malware resolves Windows APIs dynamically (LoadLibrary/GetProcAddress) and encrypts its strings with an 8-byte XOR key.

Version 1 sends a JSON beacon (id as DNSHOSTNAME_Username, user, host, pid) via HTTP POST to /api/beacon every second on the operator's server (45.158.196.23:8888 and 45.158.196.184:8888) and returns results to /api/result/BOT_ID/task_ID. Supported commands are ping, run (cmd.exe, output ignored), shell (output written to c2_out.txt and exfiltrated), upload (drops a PE to %LocalAppData%\Microsoft\OneDrive\ as wtsapi32.dll, terminates OneDrive and sideloads the DLL through the legitimate executable) and download (saves pld.exe to %LocalAppData%, purpose unknown). A JSON parsing bug (seq integer vs string) causes the task ID to always be reported as 0.

Version 2 replaces the HTTP C2 with a GitHub repository. Each bot gets a directory holding cmd.json (commands), result.json (output) and beacon.json (bot ID and last successful request timestamp). The beacon is reduced to username and local timestamp, the binary contains the debug string '!!! v2 !!! pongv2 from', and the seq bug is fixed. New or changed commands: ls, recon (ipconfig /all, whoami /all, nltest /dclist, domain computer and admin enumeration, WMIC product inventory), drives, inject (loads winspool.drv, copies shellcode into the text section and runs it in a new thread), upload (downloads from a dedicated GitHub folder to the Windows temp directory), run (ShellExecuteW, deletes the file after execution) and shell (output captured via Windows pipes). Routing tasking and data theft through GitHub makes operator traffic resemble ordinary developer activity.

Attribution is unresolved. ThreatLabz notes that the Oyster malware, which is likely related to the actor behind Latrodectus (spelled 'Lactrodectus' in the Zscaler post), uses similar API endpoints for C2; third-party coverage states this is insufficient for definitive attribution. The source lists no CVEs and no GitHub account or repository names. Severity is an analyst assessment, not stated by the source. Zscaler detects the sample as Win64.Trojan.C2Looper.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1070.004 Indicator Removal: File Deletion
- T1574.001 DLL
- T1033 System Owner/User Discovery
- T1018 Remote System Discovery
- T1069.002 Permission Groups Discovery: Domain Groups
- T1518 Software Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1571 Non-Standard Port
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

## Sources

- [C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2)
- [C2Looper Builds Footholds for Ransomware (Hive Pro threat advisory)](https://hivepro.com/threat-advisory/c2looper-builds-footholds-for-ransomware)
- [C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 (Gurucul community)](https://community.gurucul.com/articles/ThreatResearch/C2Looper-A-New-Backdoor-Likely-Tied-18-8-2026)
- [C2Looper: Rust-Based Backdoor Utilizing GitHub for C2 (detections.ai)](https://detections.ai/intel-exchange/01a016ee-cc7e-715a-a91d-3c73a4da0c1a)
- [C2Looper Backdoor Exploits GitHub for Command-and-Control Operations (ThreatCluster)](https://threatcluster.io/cluster/c2looper-backdoor-exploits-github-for-command-and-control-op-9439ceb0)
- [C2Looper threat summary (OffSeq Radar)](https://radar.offseq.com/threat/c2looper-a-new-backdoor-likely-tied-to-ransomware-with-github-c2-9a650e3a863576dc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3395