Microsoft: C2Looper Backdoor Uses GitHub C2 and Shellcode Injection to Establish Ransomware Footholds

New C2Looper Malware Emerges as Evolving Ransomware Threat

In July 2026, researchers uncovered C2Looper, a backdoor malware linked to ransomware operations, designed to establish initial access, conduct reconnaissance, and deploy additional payloads. The malware is likely distributed via ClickFix infection chains social engineering tactics that deceive victims into executing malicious commands through fake verification prompts, software errors, or CAPTCHA-style instructions.

C2Looper provides attackers with a robust set of capabilities, including remote command execution, system information gathering, file downloads, and secondary malware deployment. Recent versions have introduced GitHub-based command-and-control (C2) communications and shellcode injection, signaling active development by its creators. To evade detection, the malware employs basic obfuscation techniques, such as XOR-encrypted strings and dynamic API resolution via LoadLibrary and GetProcAddress, complicating static analysis.

Early variants communicated with C2 servers over plaintext HTTP, transmitting system details (username, hostname, process ID, and a bot identifier) to a /api/beacon endpoint every second. Commands were retrieved and executed, with results sent back to /api/result/BOT_ID/task_ID. Notably, the malware’s upload function downloads payloads as wtsapi32.dll, stored in *%LocalAppData%\Microsoft\OneDrive*, and abuses a legitimate OneDrive executable for DLL sideloading masking malicious activity behind a trusted process.

The latest iteration, C2Looper v2, abandons traditional HTTP C2 infrastructure in favor of GitHub repositories. Each infected device receives a dedicated directory, with three JSON files managing communications:

• cmd.json: Commands for the victim machine
• result.json: Command output
• beacon.json: Bot ID and check-in timestamps

While C2Looper shares C2 API patterns with Oyster malware potentially linked to the Lactrodectus threat actor no direct connection between the families has been confirmed. Indicators of compromise (IOCs) include specific file hashes, though associated domains and IPs remain defanged to prevent accidental resolution.

Source: https://cyberpress.org/c2looper-establishes-ransomware-footholds/

Microsoft Security cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security

"id": "MIC1787041566",
"linkid": "microsoft-security",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'attack_vector': 'Social Engineering (ClickFix infection chains, fake '
                  'verification prompts, software errors, CAPTCHA-style '
                  'instructions)',
 'data_breach': {'data_exfiltration': 'Possible (commands/results transmitted '
                                      'to C2)',
                 'sensitivity_of_data': 'Low to medium (system details, bot '
                                        'identifiers)',
                 'type_of_data_compromised': 'System information, potential '
                                             'secondary payloads'},
 'date_detected': '2026-07',
 'date_publicly_disclosed': '2026-07',
 'description': 'Researchers uncovered C2Looper, a backdoor malware linked to '
                'ransomware operations, designed to establish initial access, '
                'conduct reconnaissance, and deploy additional payloads. The '
                'malware is distributed via ClickFix infection chains using '
                'social engineering tactics. C2Looper provides remote command '
                'execution, system information gathering, file downloads, and '
                'secondary malware deployment. Recent versions use '
                'GitHub-based C2 communications and shellcode injection, with '
                'evasion techniques like XOR-encrypted strings and dynamic API '
                'resolution.',
 'impact': {'data_compromised': 'System information (username, hostname, '
                                'process ID, bot identifier), potential '
                                'secondary payloads',
            'operational_impact': 'Remote command execution, malware '
                                  'deployment, potential ransomware '
                                  'encryption'},
 'initial_access_broker': {'backdoors_established': 'C2Looper backdoor',
                           'entry_point': 'ClickFix infection chains (social '
                                          'engineering)'},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial gain (ransomware operations), data exfiltration',
 'post_incident_analysis': {'root_causes': 'Social engineering (ClickFix), '
                                           'lack of detection for '
                                           'XOR-encrypted strings/dynamic API '
                                           'resolution'},
 'ransomware': {'data_encryption': 'Potential (secondary payload deployment)',
                'data_exfiltration': 'Possible'},
 'references': [{'source': 'Researchers (unspecified)'}],
 'threat_actor': 'Likely Lactrodectus (unconfirmed)',
 'title': 'New C2Looper Malware Emerges as Evolving Ransomware Threat',
 'type': 'Malware (Backdoor/Ransomware)'}