C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Introduction

In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.

In this blog post, ThreatLabz provides a technical analysis of the identified C2Looper variants, including their network communication protocols and capabilities.

Key Takeaways

• In July 2026, ThreatLabz identified C2Looper, a new malware family likely used in ransomware attacks to establish a foothold for lateral movement.
• C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.
• C2Looper dynamically resolves Windows APIs and encrypts strings.
• C2Looper appears to be under active development. ThreatLabz identified a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications.
• ThreatLabz assesses with low to medium confidence that C2Looper is distributed through ClickFix campaigns.

Technical Analysis

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.

String encryption and Windows API resolution

All identified C2Looper variants use string encryption and dynamically resolve Windows APIs.

• C2Looper uses the Windows API functions LoadLibrary and GetProcAddress to load and resolve any necessary functions at runtime. 
• C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key. Despite not having a single decryption function for every encrypted string, C2Looper uses the same XOR key throughout the code.

Network communication

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol. First, C2Looper collects host information and sends it to the C2 server as a JSON object in an HTTP POST request. The JSON object contains the following information:

• Username.
• DNS hostname of the compromised host.
• The process identifier (PID) of C2Looper that is currently running on the compromised host.
• Bot ID (id key), which is a combination of the username and hostname.

This information is formatted as follows:

{
  "id": "DNSHOSTNAME_Username",
  "user": "username",
  "host": "DNSHOSTNAME",
  "pid": C2LOOPER_PID_NUMBER
}

C2Looper sends this information to the endpoint /api/beacon every second to request a command. Each command that is received from the C2 server is formatted as a JSON object containing the keys described in the table below. 

Table 1: C2Looper command message format.

The table below describes the C2 endpoints used by C2Looper.

Table 2: C2Looper C2 endpoints.

The table below describes the commands supported by C2Looper.

Table 3: Commands supported by C2Looper in older variants.

ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.

C2Looper version 2

During our research, ThreatLabz identified a new version of C2Looper that supports additional commands, and most interestingly, uses GitHub for C2 communication. We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command. This latest version appears to be internally tagged as version 2 as we will discuss later. 

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output. In addition to the use of GitHub, C2Looper v2 introduces new commands and modifies the functionality of existing commands. The table below describes these additions and changes.

Table 4: C2Looper v2 commands. 

Furthermore, we identified the following noteworthy changes:

• Unlike the previous variant, the beacon request includes only the host’s username and timestamp (based on the host’s local time).
• The binary includes debug messages including !!! v2 !!! pongv2 from. This is used as a response when the network command ping is used. This is an indicator that the malware developer refers to this variant as version 2 of C2Looper.
• The JSON key ok has been removed from beacon requests and responses.
• The parsing bug related to the JSON key seq has been fixed in this version and C2Looper uses the correct task ID with the appropriate command output. 

Since this variant uses GitHub for C2 communication, the endpoints have been removed. Instead, C2Looper creates a directory for each bot in the GitHub repository and uses the JSON files in the table below:

Table 5: JSON files used by C2Looper v2 with GitHub-based C2 communication.

Conclusion

Overall, C2Looper is a new malware family that provides common backdoor capabilities, including system command execution and deploying arbitrary second-stage binaries. This functionality is likely used by an initial access broker to steal sensitive data and deploy ransomware. Despite its code simplicity, the additional functionality in the latest variant indicates that its developers continue to expand and refine its capabilities.

Zscaler Coverage

Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for C2Looper. 

Figure 1: Zscaler Cloud Sandbox Report for C2Looper.

In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels with the following threat names:

• Win64.Trojan.C2Looper 

Indicators Of Compromise (IOCs)