security1 distinct publisher
C2Looper puts its C2 inside GitHub, and domain-reputation stacks will not care
Zscaler says a Rust backdoor tied to ransomware activity moved its command channel onto GitHub. The first version beaconed once a second to a bare HTTP endpoint. The second one does not need a domain at all.
Publishers:zscaler.com
Reality
- Evidence58
- Adoption24