Trusted Design

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

概要

In July 2026, a new Rust-based malware family called C2Looper was identified, likely used by ransomware-related threat actors. The malware is assessed with low to medium confidence to be delivered through multi-stage ClickFix infection chains. C2Looper provides backdoor capabilities including remote shell execution, reconnaissance, and deploying additional payloads. It dynamically resolves Windows APIs and encrypts strings using XOR operations. The malware communicates via plaintext HTTP initially, but an evolved version uses GitHub repositories for command-and-control operations, storing commands and exfiltrated data in JSON files. Version 2 introduces additional commands such as reconnaissance collection, drive enumeration, shellcode injection, and file listing. The malware demonstrates active development with refined capabilities, likely serving initial access brokers for data theft and ransomware deployment.

Created: 2026-08-18

Indicators

• FileHash-SHA256 - 20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549 -
• IPv4 - 45.158.196.23 -
• FileHash-SHA256 - f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b -
• FileHash-SHA256 - f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6 -
• IPv4 - 45.158.196.184 -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る