Last seven days
- First activity
- Sep 10, 2026
- Last activity
- Sep 10, 2026
- Feed role
- C2
- Host form
- 1 IP / 0 hostnames
RedShell
RedShell is a native Linux implant associated with the RedC2 4.0 command-and-control framework.
Profile source: Mallory opens in a new tabRedShell
Family profile
RedShell is a native Linux implant associated with the RedC2 4.0 command-and-control framework. It functions as a post-exploitation backdoor and beacon, providing remote operators with interactive shell access, command execution, file operations, host and network reconnaissance, data collection, and network pivoting capabilities. Documented functionality includes theft of SSH keys, browser-stored credentials, and database-related files; reverse shell access; file transfer; SOCKS5 proxying; TCP port forwarding; tunneling; persistence through cron, shell startup files, user-level services, and desktop autostart mechanisms; and in-memory execution of ELF payloads and shellcode. The implant also gathers host metadata such as user, hostname, operating system details, network information, and privilege context before entering its command-processing loop.
RedShell has been observed delivered through software supply-chain compromises involving trojanized npm packages masquerading as legitimate date, calendar, and streak-calculation utilities. In these cases, the malicious packages preserved advertised functionality while using the module entry point to silently make an embedded Linux ELF payload executable and launch it as a detached background process when the package was imported, including via transitive dependencies. This execution path did not depend on npm lifecycle hooks, increasing the likelihood of unnoticed compromise in developer and build environments. The malware is positioned to expose source code, deployment secrets, cloud access, and internal services reachable from trusted Linux hosts.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Sep 10
Observed infrastructure
Leading locations
- US1
Leading providers
- Miteflux Technologies Ltd1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
Reported operators
Threat actors
1 named in public reportingIt's located either directly within the "dist/" or under "dist/internal/," but what it contains is the same: the RedShell Linux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.
MITRE ATT&CK
RedShell in ATT&CK
37 distinct techniquesTechniques
37 techniques T1106 Native API T1195 Supply Chain Compromise T1059.007 JavaScript T1105 Ingress Tool Transfer T1090 Proxy T1033 System Owner/User Discovery T1053.003 Cron T1649 Steal or Forge Authentication Certificates T1057 Process Discovery T1059 Command and Scripting Interpreter T1090.003 Multi-hop Proxy T1555 Credentials from Password Stores T1204 User Execution T1016 System Network Configuration Discovery T1037 Boot or Logon Initialization Scripts T1219 Remote Access Tools T1021 Remote Services T1543.002 Systemd Service T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1005 Data from Local System T1082 System Information Discovery T1090.001 Internal Proxy T1059.004 Unix Shell T1098.004 SSH Authorized Keys T1620 Reflective Code Loading T1083 File and Directory Discovery T1036 Masquerading T1129 Shared Modules T1136 Create Account T1041 Exfiltration Over C2 Channel T1218 System Binary Proxy Execution T1567.002 Exfiltration to Cloud Storage T1055 Process Injection T1204.002 Malicious File T1070 Indicator Removal T1046 Network Service Discovery T1570 Lateral Tool Transfer
Reporting
Research mentioning RedShell
Aug 21
The Hacker News
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Researchers reported 14 trojanized npm packages posing as calendar, date, and streak utility libraries that secretly install the RedShell Linux beacon tied to the RedC2 4.0 command-and-control framework. The malicious code runs when a package is merely imported—including through transitive dependencies—by using dist/index.mjs to mark a bundled ELF binary as executable and launch it as a detached background process, avoiding traditional npm install hooks and rendering mitigations such as --ignore-scripts ineffective. The implanted payload connects over TLS to a hardcoded C2 server at 217.60.77.63:8792 with certificate verification disabled and provides capabilities including persistence, credential theft, fileless execution, tunneling, SOCKS proxying, and data exfiltration. Researchers said RedC2 is marketed as a cross-platform toolkit for Windows, macOS, and Linux, and includes an AI-enabled Red Agent component that converts natural-language prompts into post-exploitation actions, underscoring how weaponized open-source packages can quietly deliver a full-featured backdoor and reduce the skill required for follow-on intrusions.
Aug 21
Trendai Security
