C2Looper v2 Uses GitHub Repositories as Full Command-and

Gbhackers •Mayura Kathir • August 18, 2026

C2Looper, a Rust-based backdoor likely associated with a ransomware-related threat actor. A newer build, internally identified as version 2, replaces conventional command-and-control infrastructure with GitHub repositories used to deliver tasks, receive results, maintain beacon records, and host payloads. ThreatLabz identified the malware in July 2026 and assesses, with low-to-medium confidence, that it is delivered through […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

C2Looper Backdoor Exploits GitHub for Command-and-Control Operations In July 2026, Zscaler ThreatLabz identified C2Looper, a Rust-based backdoor likely linked to ransomware actors. The malware employs a multi-stage ClickFix infection chain and utilizes GitHub repositories for command-and-control, marking a significant evolution in its delivery method. C2Looper is capable of executing arbitrary commands, performing reconnaissance, and deploying secondary payloads. It communicates with its C2 server via plaintext HTTP, sending host information as JSON objects. The malware's version 2 enhances its capabilities by using GitHub to manage tasks, receive results, and host payloads, complicating detection efforts. The attack vector primarily targets Windows systems, and the malware's use of DLL sideloading techniques raises concerns about its evasion tactics. Current assessments indicate a low to medium confidence in the threat actor's identity and operational scope. 3 sources 52

Extracted Entities

C2Looper v2 Uses GitHub Repositories as Full Command-and

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)