C2Looper Backdoor Uses GitHub for C2 | ThreatLabz - Zscaler, Inc.

In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper , which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.

In this blog post, ThreatLabz provides a technical analysis of the identified C2Looper variants, including their network communication protocols and capabilities.

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.

All identified C2Looper variants use string encryption and dynamically resolve Windows APIs.

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol. First, C2Looper collects host information and sends it to the C2 server as a JSON object in an HTTP POST request. The JSON object contains the following information:

This information is formatted as follows:

C2Looper sends this information to the endpoint /api/beacon every second to request a command. Each command that is received from the C2 server is formatted as a JSON object containing the keys described in the table below.

The command parameters. For example, this key contains the payload URL for the upload command.

Specifies the command name.

A Boolean value indicating whether the command was parsed successfully.

Appears to serve as a task ID. C2Looper includes this value when reporting command results to the endpoint /api/result/ . In this version, the value received from the C2 server is an integer but C2Looper expects a string. This is a parsing bug that always causes C2Looper to set the task ID value to 0 when reporting results.

Table 1: C2Looper command message format.

The table below describes the C2 endpoints used by C2Looper.

Retrieves commands from the C2 server.

/api/result/BOT_ID/task_ID

Reports command output to the C2 server.

Table 2: C2Looper C2 endpoints.

The table below describes the commands supported by C2Looper.

Executes a system command on the compromised host using cmd.exe . The output is ignored.

Executes a system shell command and returns the output to the C2 server. C2Looper first writes the output to the file c2_out.txt . C2Looper then reads the file and sends its contents to the C2 server.

Downloads a PE file from a specified URL to the compromised host and saves it as the filename wtsapi32.dll under the path %LocalAppData%\Microsoft\OneDrive\ . C2Looper then terminates the OneDrive process and abuses a legitimate OneDrive executable to load the malicious DLL. We assess that this command functions as an update mechanism and uses DLL sideloading to evade detection.

Downloads a file from a specified location and saves it as the filename pld.exe under %LocalAppData% . The command’s intended purpose is currently unknown.

Table 3: Commands supported by C2Looper in older variants.

ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.

During our research, ThreatLabz identified a new version of C2Looper that supports additional commands, and most interestingly, uses GitHub for C2 communication. We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command. This latest version appears to be internally tagged as version 2 as we will later.

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output. In addition to the use of GitHub, C2Looper v2 introduces new commands and modifies the functionality of existing commands. The table below describes these additions and changes.

Lists files in a specified directory.

Collects additional host information using the following commands:

Returns a list of drives on the compromised host.

Loads the legitimate winspool.drv and copies the downloaded shellcode data into its text section. Then, C2Looper executes this section by creating a new thread that points to this section's address.

Unlike the version, this version downloads a specified file from a dedicated folder in the GitHub repository to the Windows temporary folder.

Unlike the version, C2Looper v2 executes a specified file on disk using ShellExecuteW and then deletes the file if the execution was successful.

Instead of storing the command output in the file c2_out.txt , this variant captures the output using Windows pipes.

Table 4: C2Looper v2 commands.

Furthermore, we identified the following noteworthy changes:

Since this variant uses GitHub for C2 communication, the endpoints have been removed. Instead, C2Looper creates a directory for each bot in the GitHub repository and uses the JSON files in the table below:

Stores command data for C2Looper to execute.

Stores command output.

Stores the bot ID and a timestamp that indicates the last successful request.

Table 5: JSON files used by C2Looper v2 with GitHub-based C2 communication.

Overall, C2Looper is a new malware family that provides common backdoor capabilities, including system command execution and deploying arbitrary second-stage binaries. This functionality is likely used by an initial access broker to steal sensitive data and deploy ransomware. Despite its code simplicity, the additional functionality in the latest variant indicates that its developers continue to expand and refine its capabilities.

Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for C2Looper.

Figure 1: Zscaler Cloud Sandbox Report for C2Looper.

In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels with the following threat names:

f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b

Latest variant of C2Looper.

20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549

C2Looper debug build.

f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6

Older variant of C2Looper.

Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.