Loading story…
Zscaler ThreatLabz disclosed a new Rust-based backdoor dubbed C2Looper that it assesses is likely tied to a ransomware-related threat actor and used to establish footholds for lateral movement. Older samples beaconed every second over plaintext HTTP using JSON-formatted traffic and supported arbitrary shell execution, file download, and an update mechanism that abused OneDrive DLL sideloading through a malicious wtsapi32.dll. Researchers said the malware may be delivered through a multi-stage ClickFix infection chain, though that link is assessed with low to medium confidence.
A newer internally labeled version 2 moves command-and-control activity to GitHub, where beacon, tasking, and result data are stored in JSON files, and expands the malware's capabilities with directory listing, drive enumeration, host reconnaissance, and shellcode injection. ThreatLabz observed older C2Looper variants downloading the newer build through their upload functionality, indicating active development and iterative refinement, while the latest version also changes command handling and fixes a task ID parsing bug present in earlier releases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz identified a new Rust-based malware family named C2Looper and assessed that it is likely used by a ransomware-related threat actor. The report also assessed with low to medium confidence that the malware may be delivered through a multi-stage ClickFix infection chain.
ThreatLabz published a public analysis of C2Looper covering its variants, command sets, and GitHub-based C2 design. The publication included indicators of compromise such as SHA-256 hashes and command-and-control addresses.
ThreatLabz identified a newer C2Looper variant that shifted all command-and-control operations to GitHub, using JSON files for beaconing, commands, and results. The newer version also added reconnaissance, directory listing, drive enumeration, and shellcode injection capabilities while modifying upload, run, and shell behavior.
ThreatLabz observed the older C2Looper variant using its upload command to download the latest C2Looper version, indicating active development and in-the-wild upgrading. Debug strings showed the newer sample was internally referred to as version 2.
ThreatLabz analyzed older C2Looper variants that used plaintext HTTP for command-and-control, beaconed host metadata every second, and supported commands including ping, run, shell, upload, and download. The analysis noted an update mechanism abusing OneDrive DLL sideloading and a task ID parsing bug in the older variant.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026
Researchers detailed **MLTBackdoor**, a newly identified backdoor assessed as likely linked to a ransomware-related threat actor, delivered through a multi-stage **ClickFix** social-engineering chain. Victims are lured from an automotive-themed webpage into running commands that fetch a disguised archive from a **DGA-generated domain**, decrypt an `RC4`-protected payload, and install the malware through **DLL sideloading** with the signed Microsoft Defender binary `mpextms.exe`. Zscaler said one generated domain, `hrs2y15sungu[.]com`, was used for both payload delivery and command-and-control traffic. The malware is built to resist detection and analysis, using heavy LLVM-based obfuscation, mixed boolean-arithmetic, control-flow flattening, stack-built strings, API hashing, and Hell's Gate-style indirect system calls; researchers said roughly **95%** of the code consists of junk mathematical operations. Rather than exiting when it detects analysis environments, MLTBackdoor performs **10 anti-analysis checks** for virtualization, sandboxing, debugging, and limited system resources, then reports the resulting bitmask to its operators. It communicates over **TLS** on port `443` using a custom binary protocol at `/api/v1/telemetry` with a `Microsoft-Delivery-Optimization/10.1` user agent, derives `AES-256-GCM` session keys via `ECDH` on `NIST P-256`, and includes file-management features plus a **Beacon Object File loader** that expands post-exploitation capability in memory.
Jun 29, 2026
A malware loader linked to a **TrickBot-associated intrusion crew** was observed fetching an encoded payload from GitHub files disguised as images, decoding the data into shellcode, and launching a 64-bit **Cobalt Strike** beacon directly in memory. The sample used obfuscated strings, manually resolved APIs from `ntdll.dll` and `kernel32.dll`, and loaded `wininet.dll` to handle network communications, reflecting a stealth-focused delivery chain commonly associated with post-compromise ransomware activity. Analysis of the beacon configuration tied command-and-control traffic to `rainbowmango.info` subdomains over **HTTPS/443**, with `gpupdate.exe` configured as the **spawn-to** process for execution. One GitHub account previously used to host the payload was later deleted, indicating likely operational cleanup by the actor as defenders and researchers tracked the infrastructure and tooling behind the campaign.
Aug 15, 2026