C2Looper Builds Footholds for Ransomware

C2Looper is a Rust-based Windows backdoor first identified in July 2026. It likely reaches victims through a multi-stage ClickFix chain, where the user is talked into copying a command and running it themselves. The binary is built to resist analysis from the outset: it keeps its strings encrypted and decrypts them at runtime with a simple XOR operation, and it declares almost none of its imports, instead resolving the Windows functions it needs on the fly through LoadLibrary and GetProcAddress. The practical effect is that a static look at the file reveals very little about what it actually does.

Early C2Looper builds talk to a hardcoded server over plain, unencrypted HTTP. On startup the backdoor collects the username, the machine's DNS hostname, and its own process ID, combines the hostname and username into a bot identifier, and beacons that data out once every second to request a task. The command set covers liveness checks, running commands through the Windows command shell either silently or with output returned, and downloading further payloads. One of those downloads is planted in the folder used by OneDrive, after which the backdoor kills the running OneDrive process so the genuine executable loads the malicious library on restart, serving as both an update mechanism and a hiding place since the code now runs inside a trusted signed process.

A later build, labelled version 2 in its own debug strings, adds the reconnaissance an operator needs before pushing deeper. A single command runs against the domain computers and domain admins groups, and wmic product get name, version, returning the network layout, the current user's privileges, the domain controllers, the privileged accounts, and the installed software in one response. Two further commands list a chosen directory and the drives attached to the host. Version 2 also gains an injection command that loads a legitimate Windows system module, writes downloaded shellcode into it, and runs that code on a new thread, letting follow-on payloads execute under the identity of a trusted module. The backdoor carries no credential theft capability of its own, so the enumeration is groundwork for whatever tooling arrives next.

The largest change in version 2 is that it abandons its own C2 server and runs everything through GitHub. Each infected host gets its own folder in a repository holding three JSON files, one carrying tasking, one carrying command output, and one recording the bot identifier and the time of its last check-in. Stolen data is written into the same repository. This matters most for defenders, because the traffic is ordinary HTTPS to a domain most organisations allow by default, so data theft is hard to separate from routine developer activity. Older builds have been observed downloading version 2, confirming the two are operated together. Taken as a whole, the capability set fits an initial access broker, providing quiet entry, reconnaissance, data theft, and a foothold ready to hand to a ransomware crew. Oyster, a family linked to the operators behind Latrodectus, uses closely similar API endpoints — a resemblance worth recording though not enough on its own to connect the two.