A new backdoor takes its orders from files on GitHub

On 17 August 2026 Zscaler ThreatLabz described a new malware family it calls C2Looper. The backdoor is written in Rust, and its newest version uses GitHub for all command and control instead of talking to a server of its own. Zscaler states that the malware is likely used by a threat actor tied to ransomware, and that it is likely used to establish a foothold for further movement inside a network. The company also states that the code appears to be under active development.

What happens technically

According to Zscaler, C2Looper exists in two main variants. The older one talks to a fixed server over unencrypted HTTP, asks for new orders every second and supports five commands. The newest version has dropped those fixed endpoints, and uses a GitHub repository as its command channel instead. The malware creates a separate directory for each infected machine, and uses three files in it. The file cmd.json holds the command to be run, result.json holds the output, and beacon.json holds the machine identifier and a timestamp for the last successful request. Zscaler does not state how the malware authenticates to GitHub, and lists no accounts or repositories among its indicators.

The command set in the newest version has grown by four entries. The recon command collects information about the machine and the domain using six well known Windows commands, among them ipconfig /all, whoami /all, nltest /dclist and lookups against the domain computers and domain admins groups. The inject command loads the legitimate winspool.drv file, copies downloaded shellcode into its code section and starts a new thread pointing there. The older variant additionally has a command that drops a downloaded file as wtsapi32.dll in the OneDrive folder, terminates OneDrive and lets the legitimate OneDrive executable load it. That this is done to evade detection is Zscaler's assessment rather than an observation. Every variant encrypts text strings with a simple eight byte XOR key, and resolves Windows functions at runtime instead of naming them in the file. Zscaler lists three file hashes and two server addresses as indicators, and stresses that the link to ransomware and to initial access brokers is an assessment carrying caveats. That the malware is delivered through ClickFix campaigns is stated by Zscaler with low to medium confidence.

What this means for you if you allow GitHub through the firewall

Most organisations let GitHub out of the network without a second thought, because the developers need it and because the service is well known. That is precisely why it was chosen. Our assessment is that this is the most important lesson in the case, and it is not about C2Looper: a command channel living inside a service you have decided to trust does not look like a command channel in your logs. The traffic goes to the right name, with the right certificate, on the right port. If you built detection around unfamiliar addresses and odd ports, it will not catch this.

What remains to look for is the pattern rather than the destination. A machine that belongs to no developer and still talks to GitHub at regular intervals is worth a question. So is a machine that fetches and leaves small files at a steady rhythm. Zscaler lists no accounts or repositories you can block, so a name to blocklist does not exist in this case. If you are responsible for a Windows estate with domain controllers, the recon command deserves particular attention, because it runs exactly the lookups an attacker needs to understand your domain. Those lookups are also easy to alert on, because an ordinary workstation rarely asks for the list of domain administrators.

Berigo recommends

• Decide which machines genuinely need GitHub, and route the rest through a proxy that logs. The developers need the access, the finance workstation does not.
• Alert on lookups against domain admins and domain computers from ordinary workstations. The recon command in this backdoor uses exactly those lookups.
• Look for DLL files placed beside legitimate programs inside the user's own profile directory, and put the OneDrive folder on the list of watched locations.
• Add the three file hashes and two server addresses Zscaler publishes to your detection, and remember that indicators for a backdoor under active development go stale quickly.
• Treat a find of this backdoor as the start of a ransomware attack rather than as an isolated malware detection.