Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
14 trojanized NPM packages have been masquerading as legitimate calendar modules and utility modules while secretly delivering a Linux backdoor powered by artificial intelligence (AI) known as RedC2 4.0.
Through /bin/sh, the Linux beacon provides an interactive shell and allows for a wide range of system operations
Upon importation of the malicious packages... they execute the payload bundled with the module without any installation hooks required.
When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process. No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.
This implant also has the capability of searching for sensitive information, including SSH keys
This implant also has the capability of searching for sensitive information, including SSH keys
The Windows component also offers capabilities such as bypassing UAC
14 trojanized NPM packages have been masquerading as legitimate calendar modules and utility modules while secretly delivering a Linux backdoor
The version was advertised by a threat actor named "MarlboroMan" on Hack Forums in early June 2026, describing it as a command-and-control (C2 or C&C) framework "built for evasion."
execution of BOFs, .NET assemblies and shellcode in memory
The Windows component also offers capabilities such as bypassing UAC, tampering with security tools, and lateral movement.
This implant also has the capability of searching for sensitive information, including SSH keys and browser credentials.
RedC2 EXT as well as a large language model (LLM)-driven component called Red Agent, the latter of which lets operators orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands.
RedC2 EXT as well as a large language model (LLM)-driven component called Red Agent, the latter of which lets operators orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands.
Prior to entering a command-processing LO, they collect basic information about the host.
allows for a wide range of system operations, including system discovery, file management, collection of data
The C2 framework is also feature-rich, supporting terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.
its Linux component facilitates data collection, including the theft of sensitive information such as SSH keys
The network pivoting capabilities further enable an attacker to use compromised systems as an entry point into other environments.
In addition to persistence and in-memory ELF execution, it also supports SOCKS5 proxying.
There are several features in this framework, including access to terminals, file transfers, staged payload delivery
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.