10 minhigh
C2Looper Backdoor Uses GitHub for C2 | ThreatLabz
Zscaler ThreatLabz identified a new Rust-based backdoor called C2Looper in July 2026, likely tied to ransomware operations and delivered via ClickFix infection chains. C2Looper supports backdoor commands including remote shell execution, reconnaissance, and second-stage payload deployment. A version 2 variant introduces GitHub-based C2 communication, shellcode injection via winspool.drv, and additional reconnaissance commands, indicating active development by its authors.
Sens:▲ 24hConf:medium
Showing defanged values
- filenamebeacon.jsonJSON file in GitHub repository used by C2Looper v2 to store bot ID and timestamp of last successful request.
- filenamec2_out.txtTemporary file used by older C2Looper variant to store shell command output before reading and sending contents to C2 server.
- filenamecmd.jsonJSON file in GitHub repository used by C2Looper v2 to store command data for execution.
- filename%LocalAppData%\Microsoft\OneDrive\wtsapi32.dllPath where C2Looper saves a downloaded PE file for DLL sideloading via OneDrive executable.
- filename%LocalAppData%\pld.exePath where C2Looper saves a file downloaded by the download command.
- filenamepld.exeFile downloaded by the download command and saved under %LocalAppData%. Intended purpose currently unknown.
- filenameresult.jsonJSON file in GitHub repository used by C2Looper v2 to store command output.
- filenamewtsapi32.dllMalicious PE file downloaded by the upload command and saved as wtsapi32.dll in %LocalAppData%\Microsoft\OneDrive\ for DLL sideloading via legitimate OneDrive executable.
Detection / Hunteropenrouter
What Happened
Security researchers discovered a new type of malicious software called C2Looper in July 2026. This software secretly takes control of computers and is likely connected to ransomware attacks. It can run commands, gather information about the computer, and download additional harmful programs. A newer version of this software uses GitHub (a popular website for software developers) to receive instructions and send stolen data, making it harder to detect. The malware disguises itself by hiding inside legitimate programs like OneDrive. Organizations using Windows computers should be aware of this threat, check their security tools for detection coverage, and educate employees about avoiding suspicious downloads or prompts that may deliver this malware.
Key Takeaways
- C2Looper is a new Rust-based backdoor likely used by ransomware-related threat actors, delivered via ClickFix infection chains with low to medium confidence.
- C2Looper v2 uses GitHub for all C2 communications, storing command data, results, and beacon info in JSON files (cmd.json, result.json, beacon.json) within per-bot directories in a GitHub repository.
- The upload command uses DLL sideloading: it downloads a PE file as wtsapi32.dll into the OneDrive application directory and abuses a legitimate OneDrive executable to load it.
- C2Looper dynamically resolves Windows APIs via LoadLibrary and GetProcAddress and encrypts strings using XOR with an 8-byte key.
- The inject command loads legitimate winspool.drv, copies shellcode into its text section, and executes it by creating a new thread pointing to that section.
Affected Systems
- Microsoft Windows systems
- OneDrive installations on Windows
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: C2Looper likely delivered via ClickFix infection chain (low to medium confidence assessment)
- Execution: C2Looper runs on compromised Windows host, collects username, hostname, and PID for bot registration
- C2 Communication (v1): Beacon sent every second to /api/beacon over plaintext HTTP to retrieve commands; results reported to /api/result/BOT_ID/task_ID
- C2 Communication (v2): GitHub repository used for all C2; per-bot directories contain cmd.json, result.json, and beacon.json for command and control
- Persistence/Evasion: upload command downloads PE file as wtsapi32.dll into OneDrive directory; legitimate OneDrive executable loads malicious DLL via sideloading
- Discovery: recon command collects host, domain, and installed software information; ls and drives commands enumerate files and drives
- Execution/Injection: inject command loads winspool.drv, copies shellcode into its text section, and executes via new thread
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Zscaler ThreatLabz blog post
The blog post describes Zscaler coverage but does not include reproducible detection rules. Zscaler references its own coverage in a dedicated section. No YARA, Sigma, Snort, Suricata, or query content is provided in the article text.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | C2Looper executes commands via cmd.exe, writes files to disk (wtsapi32.dll, pld.exe, c2_out.txt), and performs process injection into winspool.drv. These behaviors are visible to EDR if it monitors process creation, file writes to application directories, and thread creation in legitimate modules. However, DLL sideloading via OneDrive may blend with legitimate activity. |
| Network Visibility | Medium | Older C2Looper variants use plaintext HTTP to communicate with C2 endpoints /api/beacon and /api/result. This is visible on network sensors. However, v2 uses GitHub for C2, which blends with legitimate GitHub traffic and is harder to distinguish without content inspection or GitHub API monitoring. |
| Detection Difficulty | Hard | The v2 variant uses GitHub for C2, which blends with legitimate developer traffic. DLL sideloading via OneDrive abuses a legitimate executable. String encryption and dynamic API resolution reduce static analysis effectiveness. The plaintext HTTP C2 in v1 is easier to detect but may be replaced by v2 in the wild. |
Required Log Sources
- Process creation logs (Sysmon Event ID 1 or EDR equivalent)
- File creation logs (Sysmon Event ID 11)
- Network connection logs (Sysmon Event ID 3 or firewall/proxy logs)
- Thread creation or injection logs (Sysmon Event ID 8)
- DNS resolution logs
- GitHub API audit logs if GitHub Enterprise is used
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for OneDrive process loading a DLL named wtsapi32.dll from the %LocalAppData%\Microsoft\OneDrive\ directory, as this is indicative of DLL sideloading by C2Looper's upload command. | Process image load events (Sysmon Event ID 7) showing OneDrive executable loading wtsapi32.dll from a non-standard path | Persistence/Evasion | Low — legitimate OneDrive does not typically load wtsapi32.dll from %LocalAppData%\Microsoft\OneDrive\ |
| Consider hunting for winspool.drv loading followed by a new thread being created with a start address in its text section, which would indicate the inject command's shellcode execution method. | Sysmon Event ID 8 (CreateRemoteThread) or EDR thread creation events showing winspool.drv as the target module | Execution/Injection | Medium — legitimate software may load winspool.drv, but thread creation pointing into its text section is unusual |
| Consider hunting for processes making frequent HTTP POST requests to endpoints matching /api/beacon every second, as this matches C2Looper v1 beaconing behavior. | Network proxy or firewall logs showing periodic HTTP POST requests to /api/beacon paths | C2 | Low — legitimate applications rarely beacon to /api/beacon endpoints at one-second intervals |
| Consider hunting for files named cmd.json, result.json, or beacon.json being created or modified within GitHub repository directories, as these are used by C2Looper v2 for GitHub-based C2. | GitHub API audit logs or endpoint file monitoring showing creation of these specific JSON filenames in repository contexts | C2 | Medium — these filenames are generic and may appear in legitimate development repositories |
| Consider hunting for execution of recon command chains including ipconfig /all, whoami /all, nltest /dclist, net group /domain, and wmic product get name version executed in rapid succession from the same process. | Process creation logs showing these commands executed in sequence within a short time window | Discovery | Medium — these commands may appear in legitimate administrative scripts but rapid sequential execution from a single process is suspicious |
Control Gaps
- Network-based detection may miss C2Looper v2 traffic because GitHub is a commonly used and trusted platform, making it difficult to distinguish malicious repository access from legitimate developer activity.
- Static file analysis may be less effective due to string encryption using XOR with an 8-byte key and dynamic Windows API resolution via LoadLibrary and GetProcAddress.
- DLL sideloading via OneDrive may bypass application allowlisting if the legitimate OneDrive executable is trusted by the endpoint control framework.
Key Behavioral Indicators
- OneDrive executable loading wtsapi32.dll from %LocalAppData%\Microsoft\OneDrive\ directory
- Process injection into winspool.drv text section via new thread creation
- HTTP POST requests to /api/beacon endpoint at one-second intervals
- Files named cmd.json, result.json, beacon.json used in GitHub repository for C2
- Debug string '!!! v2 !!! pongv2 from' in process memory or network traffic
- Rapid sequential execution of recon commands (ipconfig, whoami, nltest, net group, wmic) from a single process
- File c2_out.txt created in working directory for shell command output capture
False Positive Assessment
Medium
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the presence of wtsapi32.dll in %LocalAppData%\Microsoft\OneDrive\ directories and for OneDrive process loading this DLL.
- Consider reviewing proxy and firewall logs for HTTP POST requests to endpoints matching /api/beacon or /api/result/ patterns.
- If your EDR supports it, consider hunting for process injection events targeting winspool.drv.
Infrastructure Hardening
- Evaluate whether your proxy or next-generation firewall can inspect and flag traffic to GitHub repositories that exhibit unusual access patterns consistent with C2 behavior.
- Consider implementing monitoring for GitHub API usage if GitHub is used in your environment, focusing on automated file creation or modification in repositories by non-developer accounts.
- If applicable, consider blocking or alerting on plaintext HTTP communication from endpoints to unknown external servers.
User Protection
- Consider ensuring endpoint detection and response tools are configured to alert on DLL sideloading attempts involving legitimate applications such as OneDrive.
- Evaluate whether your endpoint protection can detect process injection into legitimate Windows modules like winspool.drv.
- Consider deploying application control policies that restrict execution of DLLs from user-writable directories such as %LocalAppData%.
Security Awareness
- Consider incorporating ClickFix attack awareness into existing security training programs, as C2Looper is assessed to be delivered via ClickFix infection chains with low to medium confidence.
- Remind employees to verify the legitimacy of any prompts requesting them to copy or execute commands, especially those presented via web pages or pop-ups.
- Consider training help desk staff to recognize and escalate reports of unexpected OneDrive process activity or unfamiliar DLL files in OneDrive directories.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping15 techniques
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- File Paths:
%LocalAppData%\Microsoft\OneDrive\wtsapi32.dll- Path where C2Looper saves a downloaded PE file for DLL sideloading via OneDrive executable.%LocalAppData%\pld.exe- Path where C2Looper saves a file downloaded by the download command.c2_out.txt- Temporary file used by older C2Looper variant to store shell command output before exfiltration.
- Command Lines:
- Purpose: Reconnaissance of host and domain environment | Tools:
cmd.exe,ipconfig,whoami,nltest,net,wmic| Stage: Discovery - Purpose: Execute system command without returning output | Tools:
cmd.exe| Stage: Execution |cmd.exe /c <command> - Purpose: Execute system shell command and capture output via Windows pipes (v2) or file (v1) | Tools:
cmd.exe| Stage: Execution |cmd.exe /c <command>
- Purpose: Reconnaissance of host and domain environment | Tools:
- Other:
!!! v2 !!! pongv2 from- Debug message embedded in C2Looper v2 binary, used as response to ping command. Indicates developer refers to this variant as version 2./api/beacon- C2 endpoint used by older C2Looper variant to retrieve commands from C2 server via HTTP POST./api/result/BOT_ID/task_ID- C2 endpoint used by older C2Looper variant to report command output to C2 server.
