Last seven days
- First activity
- Sep 5, 2026
- Last activity
- Sep 5, 2026
- Feed role
- C2
- Host form
- 1 IP / 0 hostnames
C2Looper
C2Looper is a Rust-based Windows backdoor identified in 2026.
Profile source: Mallory opens in a new tabC2Looper
Family profile
C2Looper is a Rust-based Windows backdoor identified in 2026. It executes arbitrary commands, conducts host and domain reconnaissance, enumerates directories and drives, downloads and executes additional payloads, and can inject shellcode into a legitimate Windows library’s memory. Earlier variants used frequent plaintext HTTP JSON beaconing and command-result reporting; a later version moved command-and-control, command results, and collected data to GitHub. C2Looper uses XOR-obfuscated strings, dynamic Windows API resolution, and DLL side-loading through a legitimate OneDrive component to reduce detection. It has been observed in an intrusion affecting a U.S. financial-technology organization and is assessed as likely intended to establish footholds in ransomware-related operations.
Capabilities
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Post Exploitation
- Process Injection
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Sep 5
Observed infrastructure
Leading locations
- US1
Leading providers
- HOSTING INDUSTRY LIMITED1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
MITRE ATT&CK
C2Looper in ATT&CK
27 distinct techniquesTechniques
27 techniques T1102 Web Service T1204 User Execution T1105 Ingress Tool Transfer T1027.007 Dynamic API Resolution T1082 System Information Discovery T1059 Command and Scripting Interpreter T1071 Application Layer Protocol T1570 Lateral Tool Transfer T1566 Phishing T1027 Obfuscated Files or Information T1204.002 Malicious File T1135 Network Share Discovery T1083 File and Directory Discovery T1059.003 Windows Command Shell T1055 Process Injection T1071.001 Web Protocols T1132.001 Standard Encoding T1041 Exfiltration Over C2 Channel T1102.002 Bidirectional Communication T1033 System Owner/User Discovery T1120 Peripheral Device Discovery T1055.003 Thread Execution Hijacking T1016 System Network Configuration Discovery T1482 Domain Trust Discovery T1518 Software Discovery T1069.002 Domain Groups T1046 Network Service Discovery
Reporting
Research mentioning C2Looper
Aug 17
Malware News
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 - Malware News - Malware Analysis, News and Indicators
Zscaler ThreatLabz disclosed a new Rust-based backdoor dubbed C2Looper that it assesses is likely tied to a ransomware-related threat actor and used to establish footholds for lateral movement. Older samples beaconed every second over plaintext HTTP using JSON-formatted traffic and supported arbitrary shell execution, file download, and an update mechanism that abused OneDrive DLL sideloading through a malicious wtsapi32.dll. Researchers said the malware may be delivered through a multi-stage ClickFix infection chain, though that link is assessed with low to medium confidence. A newer internally labeled version 2 moves command-and-control activity to GitHub, where beacon, tasking, and result data are stored in JSON files, and expands the malware's capabilities with directory listing, drive enumeration, host reconnaissance, and shellcode injection. ThreatLabz observed older C2Looper variants downloading the newer build through their upload functionality, indicating active development and iterative refinement, while the latest version also changes command handling and fixes a task ID parsing bug present in earlier releases.
Aug 17
Zscaler Threat Labz
