C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.
In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.
- Rust-based backdoor tracked as C2Looper identified in July 2026
- Uses GitHub for command-and-control communications
- Supports arbitrary command execution, reconnaissance, and second-stage payload delivery
- Delivery assessed as multi-stage ClickFix infection chain with low-to-medium confidence
- Vendors
- Zscaler ThreatLabz
- Products
- C2Looper
- Malware
- C2Looper
- Organizations
- Zscaler ThreatLabz
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | payloads.in | ands, performing reconnaissance, and deploying second-stage payloads.In this blog post, ThreatLabz provides a technical analysis of |
From the original article
IntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain.
By ThreatLabz (Zscaler) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.