C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 ThreatLabz (Zscaler)

IntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.In this blog post, ThreatLabz provides a technical analysis of the identified C2Looper variants, including their network communication protocols and capabilities. Key TakeawaysIn July 2026, ThreatLabz identified C2Looper, a new malware family likely used in ransomware attacks to establish a foothold for lateral movement.C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.C2Looper dynamically resolves Windows APIs and encrypts strings.C2Looper appears to be under active development. ThreatLabz identified a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications.ThreatLabz assesses with low to medium confidence that C2Looper is distributed through ClickFix campaigns. Technical AnalysisIn the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.String encryption and Windows API resolutionAll identified C2Looper variants use string encryption and dynamically resolve Windows APIs.C2Looper uses the Windows API functions LoadLibrary and GetProcAddress to load and resolve any necessary functions at runtime. C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key. Despite not having a single decryption function for every encrypted string, C2Looper uses the same XOR key throughout the code.Network communicationC2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol. First, C2Looper collects host information and sends it to the C2 server as a JSON object in an HTTP POST request. The JSON object contains the following information:Username.DNS hostname of the compromised host.The process identifier (PID) of C2Looper that is currently running on the compromised host.Bot ID (id key), which is a combination of the username and hostname.This information is formatted as follows:{
“id”: “DNSHOSTNAME_Username”,
“user”: “username”,
“host”: “DNSHOSTNAME”,
“pid”: C2LOOPER_PID_NUMBER
}C2Looper sends this information to the endpoint /api/beacon every second to request a command. Each command that is received from the C2 server is formatted as a JSON object containing the keys described in the table below. JSON KeyDescriptionarg The command parameters. For example, this key contains the payload URL for the upload command.cmd Specifies the command name.ok A Boolean value indicating whether the command was parsed successfully.seq Appears to serve as a task ID. C2Looper includes this value when reporting command results to the endpoint /api/result/. In this version, the value received from the C2 server is an integer but C2Looper expects a string. This is a parsing bug that always causes C2Looper to set the task ID value to 0 when reporting results.Table 1: C2Looper command message format.The table below describes the C2 endpoints used by C2Looper.EndpointDescription/api/beaconRetrieves commands from the C2 server./api/result/BOT_ID/task_IDReports command output to the C2 server.Table 2: C2Looper C2 endpoints.The table below describes the commands supported by C2Looper.CommandDescriptionping Ping messagerun Executes a system command on the compromised host using cmd.exe. The output is ignored.shell Executes a system shell command and returns the output to the C2 server. C2Looper first writes the output to the file c2_out.txt. C2Looper then reads the file and sends its contents to the C2 server.upload Downloads a PE file from a specified URL to the compromised host and saves it as the filename wtsapi32.dll under the path %LocalAppData%MicrosoftOneDrive. C2Looper then terminates the OneDrive process and abuses a legitimate OneDrive executable to load the malicious DLL. We assess that this command functions as an update mechanism and uses DLL sideloading to evade detection.downloadDownloads a file from a specified location and saves it as the filename pld.exe under %LocalAppData%. The command’s intended purpose is currently unknown.Table 3: Commands supported by C2Looper in older variants.ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.C2Looper version 2During our research, ThreatLabz identified a new version of C2Looper that supports additional commands, and most interestingly, uses GitHub for C2 communication. We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command. This latest version appears to be internally tagged as version 2 as we will discuss later. C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output. In addition to the use of GitHub, C2Looper v2 introduces new commands and modifies the functionality of existing commands. The table below describes these additions and changes.CommandDescriptionlsLists files in a specified directory.reconCollects additional host information using the following commands:ipconfig /allwhoami /allnltest /dclistnet group /domain “domain computers”net group /domain “domain admins”wmic product get name, versiondrivesReturns a list of drives on the compromised host.injectLoads the legitimate winspool.drv and copies the downloaded shellcode data into its text section. Then, C2Looper executes this section by creating a new thread that points to this section’s address.uploadUnlike the previous version, this version downloads a specified file from a dedicated folder in the GitHub repository to the Windows temporary folder.runUnlike the previous version, C2Looper v2 executes a specified file on disk using ShellExecuteW and then deletes the file if the execution was successful.shellInstead of storing the command output in the file c2_out.txt, this variant captures the output using Windows pipes.Table 4: C2Looper v2 commands. Furthermore, we identified the following noteworthy changes:Unlike the previous variant, the beacon request includes only the host’s username and timestamp (based on the host’s local time).The binary includes debug messages including !!! v2 !!! pongv2 from. This is used as a response when the network command ping is used. This is an indicator that the malware developer refers to this variant as version 2 of C2Looper.The JSON key ok has been removed from beacon requests and responses.The parsing bug related to the JSON key seq has been fixed in this version and C2Looper uses the correct task ID with the appropriate command output. Since this variant uses GitHub for C2 communication, the endpoints have been removed. Instead, C2Looper creates a directory for each bot in the GitHub repository and uses the JSON files in the table below:FilenameDescriptioncmd.jsonStores command data for C2Looper to execute.result.jsonStores command output.beacon.jsonStores the bot ID and a timestamp that indicates the last successful request.Table 5: JSON files used by C2Looper v2 with GitHub-based C2 communication. ConclusionOverall, C2Looper is a new malware family that provides common backdoor capabilities, including system command execution and deploying arbitrary second-stage binaries. This functionality is likely used by an initial access broker to steal sensitive data and deploy ransomware. Despite its code simplicity, the additional functionality in the latest variant indicates that its developers continue to expand and refine its capabilities. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for C2Looper. Figure 1: Zscaler Cloud Sandbox Report for C2Looper.In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels with the following threat names:Win64.Trojan.C2Looper  Indicators Of Compromise (IOCs)IOCDescriptionf96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867bLatest variant of C2Looper.20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549C2Looper debug build.f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6Older variant of C2Looper.45.158.196[.]23:8888C2Looper C2.45.158.196.184:8888C2Looper C2.  

​[#item_full_content] [[{“value”:”IntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.In this blog post, ThreatLabz provides a technical analysis of the identified C2Looper variants, including their network communication protocols and capabilities. Key TakeawaysIn July 2026, ThreatLabz identified C2Looper, a new malware family likely used in ransomware attacks to establish a foothold for lateral movement.C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.C2Looper dynamically resolves Windows APIs and encrypts strings.C2Looper appears to be under active development. ThreatLabz identified a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications.ThreatLabz assesses with low to medium confidence that C2Looper is distributed through ClickFix campaigns. Technical AnalysisIn the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.String encryption and Windows API resolutionAll identified C2Looper variants use string encryption and dynamically resolve Windows APIs.C2Looper uses the Windows API functions LoadLibrary and GetProcAddress to load and resolve any necessary functions at runtime. C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key. Despite not having a single decryption function for every encrypted string, C2Looper uses the same XOR key throughout the code.Network communicationC2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol. First, C2Looper collects host information and sends it to the C2 server as a JSON object in an HTTP POST request. The JSON object contains the following information:Username.DNS hostname of the compromised host.The process identifier (PID) of C2Looper that is currently running on the compromised host.Bot ID (id key), which is a combination of the username and hostname.This information is formatted as follows:{
“id”: “DNSHOSTNAME_Username”,
“user”: “username”,
“host”: “DNSHOSTNAME”,
“pid”: C2LOOPER_PID_NUMBER
}C2Looper sends this information to the endpoint /api/beacon every second to request a command. Each command that is received from the C2 server is formatted as a JSON object containing the keys described in the table below. JSON KeyDescriptionarg The command parameters. For example, this key contains the payload URL for the upload command.cmd Specifies the command name.ok A Boolean value indicating whether the command was parsed successfully.seq Appears to serve as a task ID. C2Looper includes this value when reporting command results to the endpoint /api/result/. In this version, the value received from the C2 server is an integer but C2Looper expects a string. This is a parsing bug that always causes C2Looper to set the task ID value to 0 when reporting results.Table 1: C2Looper command message format.The table below describes the C2 endpoints used by C2Looper.EndpointDescription/api/beaconRetrieves commands from the C2 server./api/result/BOT_ID/task_IDReports command output to the C2 server.Table 2: C2Looper C2 endpoints.The table below describes the commands supported by C2Looper.CommandDescriptionping Ping messagerun Executes a system command on the compromised host using cmd.exe. The output is ignored.shell Executes a system shell command and returns the output to the C2 server. C2Looper first writes the output to the file c2_out.txt. C2Looper then reads the file and sends its contents to the C2 server.upload Downloads a PE file from a specified URL to the compromised host and saves it as the filename wtsapi32.dll under the path %LocalAppData%MicrosoftOneDrive. C2Looper then terminates the OneDrive process and abuses a legitimate OneDrive executable to load the malicious DLL. We assess that this command functions as an update mechanism and uses DLL sideloading to evade detection.downloadDownloads a file from a specified location and saves it as the filename pld.exe under %LocalAppData%. The command’s intended purpose is currently unknown.Table 3: Commands supported by C2Looper in older variants.ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.C2Looper version 2During our research, ThreatLabz identified a new version of C2Looper that supports additional commands, and most interestingly, uses GitHub for C2 communication. We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command. This latest version appears to be internally tagged as version 2 as we will discuss later. C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output. In addition to the use of GitHub, C2Looper v2 introduces new commands and modifies the functionality of existing commands. The table below describes these additions and changes.CommandDescriptionlsLists files in a specified directory.reconCollects additional host information using the following commands:ipconfig /allwhoami /allnltest /dclistnet group /domain “domain computers”net group /domain “domain admins”wmic product get name, versiondrivesReturns a list of drives on the compromised host.injectLoads the legitimate winspool.drv and copies the downloaded shellcode data into its text section. Then, C2Looper executes this section by creating a new thread that points to this section’s address.uploadUnlike the previous version, this version downloads a specified file from a dedicated folder in the GitHub repository to the Windows temporary folder.runUnlike the previous version, C2Looper v2 executes a specified file on disk using ShellExecuteW and then deletes the file if the execution was successful.shellInstead of storing the command output in the file c2_out.txt, this variant captures the output using Windows pipes.Table 4: C2Looper v2 commands. Furthermore, we identified the following noteworthy changes:Unlike the previous variant, the beacon request includes only the host’s username and timestamp (based on the host’s local time).The binary includes debug messages including !!! v2 !!! pongv2 from. This is used as a response when the network command ping is used. This is an indicator that the malware developer refers to this variant as version 2 of C2Looper.The JSON key ok has been removed from beacon requests and responses.The parsing bug related to the JSON key seq has been fixed in this version and C2Looper uses the correct task ID with the appropriate command output. Since this variant uses GitHub for C2 communication, the endpoints have been removed. Instead, C2Looper creates a directory for each bot in the GitHub repository and uses the JSON files in the table below:FilenameDescriptioncmd.jsonStores command data for C2Looper to execute.result.jsonStores command output.beacon.jsonStores the bot ID and a timestamp that indicates the last successful request.Table 5: JSON files used by C2Looper v2 with GitHub-based C2 communication. ConclusionOverall, C2Looper is a new malware family that provides common backdoor capabilities, including system command execution and deploying arbitrary second-stage binaries. This functionality is likely used by an initial access broker to steal sensitive data and deploy ransomware. Despite its code simplicity, the additional functionality in the latest variant indicates that its developers continue to expand and refine its capabilities. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for C2Looper. Figure 1: Zscaler Cloud Sandbox Report for C2Looper.In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to C2Looper at various levels with the following threat names:Win64.Trojan.C2Looper  Indicators Of Compromise (IOCs)IOCDescriptionf96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867bLatest variant of C2Looper.20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549C2Looper debug build.f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6Older variant of C2Looper.45.158.196[.]23:8888C2Looper C2.45.158.196.184:8888C2Looper C2.”}]]