Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It's located either directly within the "dist/" or under "dist/internal/," but what it contains is the same: the RedShell Linux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Each package also ships a Linux ELF binary, framed in the source as a native math accelerator.
Windows commands ... /redshell bin -inject < process > < filename > Injects shellcode into given process
PRIORITY_DELETE Deletes the configuration file and executable, then exits
RedC2 EXT as well as a large language model (LLM)-driven component called Red Agent, the latter of which lets operators orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands.
Many commands, such as /sysinfo, /whoami, /ps, and /netstat, are translated directly into hardcoded shell commands.
Notable capabilities include: System, process, user, environment, interface, and network discovery.
Many commands, such as /sysinfo, /whoami, /ps, and /netstat, are translated directly into hardcoded shell commands.
v4.1 (July 19, 2026): Added cross-network shell tunnelling, driven from the Network Map. An operator links a relay beacon to a target beacon on a different network and opens a shell brokered through the C&C server
The C2 framework is also feature-rich, supporting terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.
SOCKS5 proxying and TCP port forwarding. ... /socks start < port > Starts a SOCKS5 proxy on the specified port
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The Linux beacon component of RedC2 4.0. Once deployed, it provides an interactive shell through /bin/sh, performs system discovery, file operations, data collection such as SSH keys and browser credentials, execution, persistence, in-memory ELF execution, SOCKS5 proxying, network pivoting, and C2 communications.
A native Linux implant/backdoor used by RedC2 that daemonizes, connects to a hardcoded C2 over TLS, gathers host identity data, executes shell commands, steals SSH keys and browser credentials, performs fileless ELF and shellcode execution, enables persistence, and supports SOCKS5 proxying, port forwarding, and tunneling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.