Malware

C2Looper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

shell Executes a system shell command and returns the output to the C2 server.

T1059.003Windows Command ShellEvidence2

run executes a system command on the compromised host using cmd.exe. The output is ignored. shell Executes a system shell command and returns the output to the C2 server.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

inject Loads the legitimate winspool.drv and copies the downloaded shellcode data into its text section. Then, C2Looper executes this section by creating a new thread that points to this section’s address.

T1055.003Thread Execution HijackingEvidence1

Then, C2Looper executes this section by creating a new thread that points to this section's address.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key.

T1027.007Dynamic API ResolutionEvidence1

All identified C2Looper variants use string encryption and dynamically resolve Windows APIs. | All identified C2Looper variants use string encryption and dynamically resolve Windows APIs. C2Looper uses the Windows API functions LoadLibrary and GetProcAddress to load and resolve any necessary functions at runtime.

T1055Process InjectionEvidence2

T1055.003Thread Execution HijackingEvidence1

Then, C2Looper executes this section by creating a new thread that points to this section's address.

Discovery

9 techniques

T1016System Network Configuration DiscoveryEvidence2

recon Collects additional host information using the following commands: ipconfig /all

T1033System Owner/User DiscoveryEvidence2

recon Collects additional host information using the following commands: whoami /all

T1046Network Service DiscoveryEvidence1

recon Collects additional host information using the following commands: ... nltest /dclist

T1069.002Domain GroupsEvidence2

recon Collects additional host information using the following commands: ... net group /domain "domain computers" net group /domain "domain admins"

T1082System Information DiscoveryEvidence2

First, C2Looper collects host information and sends it to the C2 server... Username. DNS hostname... PID... Bot ID... recon Collects additional host information using the following commands: ipconfig /all whoami /all ... wmic product get name, version

T1083File and Directory DiscoveryEvidence2

ls Lists files in a specified directory.

T1120Peripheral Device DiscoveryEvidence2

drives Returns a list of drives on the compromised host.

T1482Domain Trust DiscoveryEvidence1

recon Collects additional host information using the following commands: ... nltest /dclist

T1518Software DiscoveryEvidence1

recon Collects additional host information using the following commands: ... wmic product get name, version

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol.

T1071.001Web ProtocolsEvidence1

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol.

T1102Web ServiceEvidence1

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output.

T1105Ingress Tool TransferEvidence2

upload Downloads a PE file from a specified URL to the compromised host... download Downloads a file from a specified location... We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 17, 2026

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 - Malware News - Malware Analysis, News and Indicators

A new Rust-based backdoor likely used in ransomware-related intrusions to establish footholds for lateral movement. It communicates over HTTP in older variants and via GitHub in v2, supports remote command execution, reconnaissance, file operations, payload deployment, and shellcode injection, and appears to be under active development.

zscaler threat labzNews

Aug 17, 2026

C2Looper Backdoor Uses GitHub for C2 | ThreatLabz

Backdoor malware that beacons to a C2 server over HTTP in older variants and via GitHub in v2, collects host information, executes system and shell commands, downloads additional payloads, lists files, performs reconnaissance, and can inject shellcode into winspool.drv for execution. It also uses DLL sideloading via a legitimate OneDrive executable to load a malicious wtsapi32.dll payload.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

C2Looper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

shell Executes a system shell command and returns the output to the C2 server.

T1059.003Windows Command ShellEvidence2

run executes a system command on the compromised host using cmd.exe. The output is ignored. shell Executes a system shell command and returns the output to the C2 server.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

T1055.003Thread Execution HijackingEvidence1

Then, C2Looper executes this section by creating a new thread that points to this section's address.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key.

T1027.007Dynamic API ResolutionEvidence1

T1055Process InjectionEvidence2

T1055.003Thread Execution HijackingEvidence1

Then, C2Looper executes this section by creating a new thread that points to this section's address.

Discovery

9 techniques

T1016System Network Configuration DiscoveryEvidence2

recon Collects additional host information using the following commands: ipconfig /all

T1033System Owner/User DiscoveryEvidence2

recon Collects additional host information using the following commands: whoami /all

T1046Network Service DiscoveryEvidence1

recon Collects additional host information using the following commands: ... nltest /dclist

T1069.002Domain GroupsEvidence2

recon Collects additional host information using the following commands: ... net group /domain "domain computers" net group /domain "domain admins"

T1082System Information DiscoveryEvidence2

T1083File and Directory DiscoveryEvidence2

ls Lists files in a specified directory.

T1120Peripheral Device DiscoveryEvidence2

drives Returns a list of drives on the compromised host.

T1482Domain Trust DiscoveryEvidence1

recon Collects additional host information using the following commands: ... nltest /dclist

T1518Software DiscoveryEvidence1

recon Collects additional host information using the following commands: ... wmic product get name, version

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol.

T1071.001Web ProtocolsEvidence1

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol.

T1102Web ServiceEvidence1

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output.

T1105Ingress Tool TransferEvidence2

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 17, 2026

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 - Malware News - Malware Analysis, News and Indicators

zscaler threat labzNews

Aug 17, 2026

C2Looper Backdoor Uses GitHub for C2 | ThreatLabz

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.