C2Looper Backdoor Uses GitHub C2 and Shellcode Injection to Establish Ransomware Footholds | #ransomware | #cybercrime

The malware was discovered in July 2026 and is likely used by a ransomware-related threat actor to gain an initial foothold, perform reconnaissance, move laterally, and deploy additional payloads.

Researchers assess with low to medium confidence that C2Looper is delivered through multi-stage ClickFix infection chains.

ClickFix attacks commonly trick victims into running malicious commands or files by presenting fake verification prompts, software errors, or CAPTCHA-style instructions.

C2Looper provides attackers with a standard but effective set of backdoor functions. It can execute remote commands, gather system information, download additional files, and launch second-stage malware.

Its latest version adds GitHub-based command-and-control communications and shellcode injection, indicating that its developers are actively improving the malware.

The malware also uses basic defense-evasion methods. It encrypts embedded strings using an XOR operation with an eight-byte key and resolves Windows APIs dynamically through LoadLibrary and GetProcAddress.

This makes static analysis more difficult because important functions and strings are not immediately visible in the binary.

Older C2Looper samples communicate with a command-and-control server through plaintext HTTP. After execution, the malware collects the username, DNS hostname, process ID, and a bot identifier created from the hostname and username.

It sends this information as a JSON object to the /api/beacon endpoint every second to retrieve tasks. Command output is then returned to /api/result/BOT_ID/task_ID.

The shell command writes output to a file named c2_out.txt, reads its contents, and sends the data back to the C2 server.

The upload command is particularly notable. It downloads a payload and saves it as wtsapi32.dll under %LocalAppData%\Microsoft\OneDrive\.

C2Looper then terminates the OneDrive process and abuses a legitimate OneDrive executable to load the malicious DLL.

This DLL sideloading method can help attackers hide payload execution behind a trusted Windows application. ThreatLabz noted that Oyster malware has used similar C2 API endpoint patterns.

Oyster has been associated with activity potentially linked to the threat actor behind Lactrodectus, although this does not establish a direct connection between the malware families.

C2Looper version 2 removes the conventional HTTP C2 infrastructure and instead uses GitHub for all command-and-control operations.

The malware creates a separate directory for every infected device in a GitHub repository, zscaler said. It uses three JSON files for communications:

• cmd.json contains commands for the victim machine
• result.json stores command output
• beacon.json records the bot ID and latest successful check-in time

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR