Loading malware…
RedShell is a native Linux implant associated with the RedC2 4.0 command-and-control framework. It functions as a post-exploitation backdoor and beacon, providing remote operators with interactive shell access, command execution, file operations, host and network reconnaissance, data collection, and network pivoting capabilities. Documented functionality includes theft of SSH keys, browser-stored credentials, and database-related files; reverse shell access; file transfer; SOCKS5 proxying; TCP port forwarding; tunneling; persistence through cron, shell startup files, user-level services, and desktop autostart mechanisms; and in-memory execution of ELF payloads and shellcode. The implant also gathers host metadata such as user, hostname, operating system details, network information, and privilege context before entering its command-processing loop.
RedShell has been observed delivered through software supply-chain compromises involving trojanized npm packages masquerading as legitimate date, calendar, and streak-calculation utilities. In these cases, the malicious packages preserved advertised functionality while using the module entry point to silently make an embedded Linux ELF payload executable and launch it as a detached background process when the package was imported, including via transitive dependencies. This execution path did not depend on npm lifecycle hooks, increasing the likelihood of unnoticed compromise in developer and build environments. The malware is positioned to expose source code, deployment secrets, cloud access, and internal services reachable from trusted Linux hosts.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
It's located either directly within the "dist/" or under "dist/internal/," but what it contains is the same: the RedShell Linux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
Researchers identified the activity as a software supply chain attack delivering RedShell, a Linux implant.
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings.
Through /bin/sh, the Linux beacon provides an interactive shell and allows for a wide range of system operations
The attack starts when an affected package is imported into an application.
The loader makes a bundled Linux executable runnable and launches it silently in the background.
/dlopen < path > [sym] Loads a shared library and optionally executes a symbol
The danger begins when an affected module is imported.
Delivery is handled by the package entry file, dist/index.mjs, which acts as a trojan loader. It re-exports the date helpers and launches the bundled implant as soon as the module loads.
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
This implant also has the capability of searching for sensitive information, including SSH keys
/adduser < user > < pass > Creates a new user and sets their password
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
Windows commands ... /redshell bin -inject < process > < filename > Injects shellcode into given process
This implant also has the capability of searching for sensitive information, including SSH keys
It can create persistence through cron, shell startup files, user-level services or desktop autostart entries.
14 trojanized NPM packages have been masquerading as legitimate calendar modules and utility modules while secretly delivering a Linux backdoor
Windows commands ... /redshell bin -inject < process > < filename > Injects shellcode into given process
PRIORITY_DELETE Deletes the configuration file and executable, then exits
This function executes the command via /bin/sh -c... The file or archive is uploaded using curl over HTTPS.
execution of BOFs, .NET assemblies and shellcode in memory
The report describes RedShell as capable of taking SSH keys, browser-stored credentials and database-related files.
The report describes RedShell as capable of taking SSH keys, browser-stored credentials and database-related files.
RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings.
RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings.
Notable capabilities include: System, process, user, environment, interface, and network discovery.
RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings.
Prior to entering a command-processing LO, they collect basic information about the host.
allows for a wide range of system operations, including system discovery, file management, collection of data
It supports SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems.
The C2 framework is also feature-rich, supporting terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.
its Linux component facilitates data collection, including the theft of sensitive information such as SSH keys
It supports SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems.
In addition to persistence and in-memory ELF execution, it also supports SOCKS5 proxying.
It supports SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems.
The loader makes a bundled Linux executable runnable and launches it silently in the background.
RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings.
Commands are received from the server over that connection, and command output, status messages, and errors are sent back over the same connection.
The implant uses separate plain HTTP paths for data theft and payload downloads.
/download < path > Outbound file or archive upload from the affected host to Litterbox over a separate HTTPS connection
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.