C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.
In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.
- Rust-based backdoor tracked as C2Looper identified in July 2026
- Uses GitHub for command-and-control communications
- Supports arbitrary command execution, reconnaissance, and second-stage payload delivery
- Delivery assessed as multi-stage ClickFix infection chain with low-to-medium confidence
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | payloads.in | ands, performing reconnaissance, and deploying second-stage payloads.In this blog post, ThreatLabz provides a technical analysis of |
IntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.In this blog post, ThreatLabz provides a technical analysis of the identified C2Looper variants, including their network communication protocols and capabilities. Key TakeawaysIn July 2026, ThreatLabz identified C2Looper, a…
This source does not provide full text. Read it at zscaler.com.