Zscaler ThreatLabz has identified a new Rust-based backdoor called C2Looper that appears tied to ransomware activity and has evolved from direct HTTP command-and-control into a second version that uses GitHub repositories for tasking, beaconing, and result storage.

That shift is the important part. GitHub is a normal business destination in many environments, especially for software teams, MSPs, startups, and government contractors supporting technical programs. When malware can blend command traffic into a trusted developer platform, defenders cannot rely on simple “block unknown C2” logic.

Source: Zscaler ThreatLabz — C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

What Zscaler found

ThreatLabz reports that C2Looper is a Windows backdoor written in Rust. Earlier variants used plaintext HTTP endpoints for beaconing, command retrieval, and result submission. The malware collected basic host details, generated a bot identifier from the username and hostname, and repeatedly checked in for operator instructions.

The command set is practical rather than flashy: run commands, execute shell commands and return output, download payloads, and use DLL sideloading through a legitimate OneDrive executable. That is enough capability to support staging, discovery, follow-on tooling, and persistence inside a ransomware intrusion.

Zscaler also observed a newer C2Looper version that moves command-and-control into GitHub. Instead of traditional C2 endpoints, the backdoor creates per-victim repository paths and uses JSON files for command data, command output, and beacon status. The newer version adds file listing, drive enumeration, recon commands, payload execution, upload functionality, and shellcode injection behavior.

Why GitHub C2 is hard for SMBs to spot

For many smaller organizations, GitHub is either explicitly allowed or buried inside broad web-access categories. Developers need it. Vendors need it. Automation tools may need it. Security teams are often hesitant to block it because doing so can break legitimate work.

That creates a useful hiding place for attackers. A workstation or server reaching GitHub is not suspicious by itself. A process using GitHub as a task queue, writing result files back to a repository, or pulling payloads into temporary paths is a different story—but defenders need endpoint and proxy telemetry detailed enough to separate normal developer activity from malware operations.

The ransomware connection

C2Looper should be treated as an intrusion-enablement tool, not just another malware sample. Its capabilities line up with the steps ransomware affiliates need before encryption: host discovery, domain reconnaissance, command execution, payload staging, output collection, and follow-on code execution.

The suspected ClickFix delivery chain is also worth attention. ClickFix-style lures train victims to run commands or scripts under the pretense of fixing a browser, CAPTCHA, meeting, document, or application problem. That blends social engineering with hands-on-keyboard execution and can bypass organizations that only focus on attachment detonation.

Defensive takeaways

  • Monitor GitHub usage by process, not just by domain. Browser access from a developer workstation is normal. Repeated GitHub API or raw-content access from unusual binaries, scripts, Office child processes, temporary directories, or user profile app-data paths deserves review.
  • Hunt for suspicious OneDrive sideloading. Pay attention to unexpected OneDrive process termination, DLL loads from user-writable folders, and files named like legitimate Windows libraries appearing under profile paths.
  • Detect ClickFix behavior. Alert on users pasting commands into Run dialogs, PowerShell, terminal windows, or browser-promoted clipboard workflows immediately after visiting untrusted pages.
  • Baseline developer-platform destinations. If GitHub is required, define which teams, machines, tools, and repositories normally use it. Exceptions are where investigations start.
  • Correlate recon commands with identity risk. Commands such as domain group enumeration, host inventory, and drive listing should raise priority when seen on non-admin endpoints or shortly after a suspicious web lure.
  • Do not ignore “trusted cloud” traffic during ransomware triage. Cloud storage, code repositories, paste sites, and collaboration platforms can all become staging or C2 infrastructure.

Bulwark Black assessment

C2Looper is a good example of where commodity and ransomware-adjacent tradecraft is headed: less bespoke infrastructure, more abuse of platforms defenders are uncomfortable blocking. The practical answer is not to ban every developer service. It is to get sharper about process lineage, destination context, user role, and timing.

For SMBs and government contractors, the priority is simple: make trusted-platform abuse visible. If a non-developer endpoint suddenly starts using GitHub like a command channel, that should not be lost in generic web logs. It should become an incident queue item before the same intrusion turns into data theft or ransomware deployment.

Original source: Zscaler ThreatLabz — C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2.