Zscaler uncovers new C2Looper backdoor linked to ransomware

Zscaler ThreatLabz has identified a new Rust-based backdoor family, C2Looper, which it assesses with low to medium confidence is linked to ransomware activity and may be delivered via a multi-stage ClickFix infection chain. The malware supports commands for executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads.

C2Looper communicates with its command-and-control server over plaintext HTTP, sending host information as a JSON object and polling for commands. A newer variant, C2Looper v2, uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output, and adds features such as drive enumeration and shellcode injection.