Loading today’s stories
Security1 distinct publisher3 min readUpdated
Zscaler says a Rust backdoor tied to ransomware activity moved its command channel onto GitHub. The first version beaconed once a second to a bare HTTP endpoint. The second one does not need a domain at all.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Zscaler ThreatLabz says it identified a Rust-based malware family it tracks as C2Looper in July 2026, likely used by a ransomware-related threat actor to establish a foothold for lateral movement [1][2]. The operationally interesting part is not the language choice: a newer variant uses GitHub for all command-and-control operations, including storing exfiltrated data and reporting command output [3].
Compare the two generations. The earlier variant talks to its C2 over plaintext HTTP, posting a JSON object with the username, DNS hostname, the malware's own process ID, and a bot ID built by concatenating hostname and username [4][5]. It hits the endpoint `/api/beacon` once every second to ask for work [6]. At that interval, a single infected host generates roughly 86,400 beacons a day [7]. Fixed-interval, plaintext, unfamiliar destination: that is the shape most proxy and network detection content was written to catch, and it is the shape that goes away in version 2.
The handover is deliberate. ThreatLabz observed the older variant being used to download the newer one via its `upload` command [8]. The noisy implant is the delivery vehicle for the quiet one. Version 2 also trims its beacon down to the host's username and a timestamp drawn from local time [9], which leaves less structure in the request body to fingerprint.
If your C2 detection logic leans on domain age, registration anomalies, or reputation, GitHub traffic is not going to trip it, and there is no reason to expect an allowlist entry for a developer platform to be scoped by repository or account in most environments. That is the control gap this family exercises. Treating github.com as an egress destination that needs per-org or per-repo policy is a different project from blocking newly registered domains, and it lands on platform and developer-experience teams rather than the SOC.
The rest of the tradecraft is unremarkable and, in one respect, sloppy. C2Looper resolves Windows APIs at runtime through `LoadLibrary` and `GetProcAddress`, and decrypts strings with a bitwise XOR against an 8-byte key [10][11]. ThreatLabz notes the same XOR key is reused throughout the code even though there is no single decryption routine [11]. Reused static keys are how families get clustered. Version 2 also ships debug strings including `!!! v2 !!! pongv2 from`, used as the response to a `ping` command [12], which is a usable hunting string until the developer notices.
On origins, ThreatLabz assesses with only low to medium confidence that C2Looper is distributed through multi-stage ClickFix campaigns [13]. It also flags, as an analyst note rather than attribution, that Oyster malware uses similar API endpoints, and that Oyster is likely related to the actor behind Latrodectus [14]. Take that as a lead, not a lineage.
Watch whether GitHub-hosted C2 spreads across affiliate loaders rather than staying in one family, and whether the next revision drops the plaintext HTTP path entirely, since the source notes C2Looper appears to be under active development [15]. Watch, too, whether anyone in your organisation can currently answer which GitHub organisations your endpoints are permitted to reach.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family it tracks as C2Looper, likely leveraged by a ransomware-related threat actor.
ThreatLabz assesses that C2Looper is likely used in ransomware attacks to establish a foothold for lateral movement, and supports backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.
C2Looper version 2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output.
ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain.
In an analyst note, ThreatLabz observes that Oyster malware, which is likely related to the threat actor behind Latrodectus, uses similar API endpoints for C2 communication.
C2Looper uses plaintext HTTP to communicate with its C2 server, first collecting host information and sending it as a JSON object in an HTTP POST request.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed first-party reverse engineering, no external corroboration
The technical core is specific and checkable: exact beacon JSON schema, the /api/beacon path and one-second interval, an 8-byte XOR key reused across the binary, LoadLibrary/GetProcAddress resolution, the '!!! v2 !!! pongv2 from' debug string, and the per-bot GitHub directory design. That is strong for a malware-analysis claim. It is capped by structure rather than quality: one publisher, which is also the discovering vendor, with Tables 1-5 and the IOC list referenced but not reproduced in the supplied body, no second researcher or platform confirmation, and the two most consequential framings (ransomware use, ClickFix delivery) carried as explicit assessments rather than demonstrated facts.
Confirmed in-the-wild use, prevalence entirely undisclosed
There is real-world activity, not just a lab curiosity: ThreatLabz says it observed the older variant pulling down version 2 through the upload command, and version 2 was found operating its GitHub channel. But nothing in the supplied source quantifies spread - no victim count, no sector or geography, no telemetry volume, no named intrusion or ransomware deployment tied to it. Scoring stays low because observed existence in the wild is all that is evidenced; no prevalence is inferred.
Vendor text is hedged; the cluster framing is one step ahead of it
Zscaler's own writeup is notably restrained - 'likely' ransomware-related, low-to-medium confidence on ClickFix, an analyst note that merely flags endpoint similarity to Oyster/Latrodectus, and a conclusion that stresses 'code simplicity'. The cluster headline and dek push further, asserting that domain-reputation stacks will not care. That is a plausible inference from endpoints and domains being removed in version 2, but no source tests it, and the absence of any prevalence data means the practical exposure is unquantified. Mildly positive: the technical substance is real, the strategic conclusion runs ahead of the evidence.
Discovering vendor publishes its own detection coverage
The sole source is a commercial security vendor naming and branding a malware family it discovered, and the post closes with a Zscaler Coverage section, a Cloud Sandbox detection figure, threat names, and IOCs. Threat-research marketing of this kind rewards novelty framing - a new named family, a novel GitHub C2 twist, a ransomware association - even where the underlying assessments are hedged. This does not imply the technical findings are wrong; the analysis is specific and falsifiable. It does mean the salience and severity framing carries a commercial pull, with no independent publisher in the cluster to counterweight it.
Solid technical floor, single interested source, hedged conclusions
Confidence is moderate. The protocol and evasion mechanics are described precisely enough to be actionable and later falsifiable, which supports the narrow reading: a Rust backdoor exists, version 2 runs C2 through GitHub, and it was seen in the wild. Confidence drops for everything wider - who uses it, how it arrives, how many hosts are affected, and whether the Oyster/Latrodectus resemblance means anything - because there is one publisher, that publisher is the vendor selling detection for it, key tables and IOCs are not reproduced in the supplied body, and the vendor itself labels the delivery assessment low to medium confidence.
security
Akrites switches on in September with 20-odd members and a one-to-10 engineer donation band1 distinct publisher
security
Bring Your Own Runtime: Sophos MDR maps a repeatable Deno-based intrusion chain1 distinct publisher
build
AI-written code fails the same four ways, and every gate you own reports green1 distinct publisher
build
Grok 4.6 lands in Copilot two days after launch, and the model picker becomes a procurement problem1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 17, 2026