The newest version of a backdoor that Zscaler ThreatLabz calls C2Looper does not phone home to a server anymore. It checks a folder in a GitHub repository, reads a file called cmd.json, does what the file says, and writes the answer back to result.json in the same folder. One directory per infected machine.
ThreatLabz identified the Rust-based family in July 2026 and published its analysis on August 17. Its assessment is that C2Looper is likely used in ransomware attacks, as the foothold an intruder establishes before moving through a network, and that the malware is probably delivered through a ClickFix chain, the fake error pages and copy-paste "fixes" that trick users into running commands themselves. ThreatLabz puts low to medium confidence on that delivery route.
A beacon every second
The earlier variants are straightforward. C2Looper collects the username, hostname, its own process ID and a bot identifier built from the first two, wraps them in JSON, and posts them over plain HTTP to an endpoint called /api/beacon once per second, asking for something to do. It decrypts its strings at runtime with a simple XOR operation and resolves the Windows functions it needs on the fly rather than declaring them up front, both of which make a sample harder to read.
The command set is small: run a shell command and ignore the output, run one and send the output back, fetch a second-stage payload, stay alive. One entry is worth dwelling on. The upload command saves what it downloads as wtsapi32.dll inside the OneDrive folder in the user's local AppData directory, kills the running OneDrive process, and lets Microsoft's own signed OneDrive binary load the malicious file on restart. ThreatLabz assesses this to be the update mechanism, hidden behind a legitimate program.
Version 2 moved into GitHub
ThreatLabz then found a newer build, tagged internally by its developer with the debug string "!!! v2 !!!", which the older variant downloads and installs through that same update command. A parsing bug that had made every result report against task zero is fixed. The HTTP endpoints are gone entirely, replaced by the per-bot GitHub directories, with beacon.json holding the time of the last check-in. ThreatLabz does not speculate about the operator's reasoning, but the practical effect is that the command channel now runs to github.com.
Version 2 also does more once it is inside. A recon command sweeps the host and the domain around it, running ipconfig, whoami, nltest to list domain controllers, net group queries for "domain computers" and "domain admins", and a wmic query for installed software. That is a map of what to attack next, and the sort of thing an intruder runs in the hour before deciding what a network is worth. A new inject command loads the legitimate winspool.drv, copies downloaded shellcode into its text section and starts a thread there.
Hunt for a fake wtsapi32.dll
The most useful detection here needs no indicators at all. A file named wtsapi32.dll appearing under the OneDrive directory in a user's local AppData path is not something Microsoft puts there, and an unexpected OneDrive restart alongside it is worth a look. So is a workstation running nltest and net group against domain admins when nobody is doing administration. ThreatLabz publishes these defanged indicators:
- 45[.]158[.]196[.]23:8888 and 45[.]158[.]196[.]184:8888, command and control for the pre-GitHub variants
- f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b, the latest variant
- f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6, an older variant
ThreatLabz adds one analyst note without drawing a conclusion from it: the Oyster malware family, likely connected to the actor behind Latrodectus, uses similar API endpoints for its own command traffic. That is a resemblance rather than an attribution, and Zscaler does not name an operator.
What the report does say plainly is that C2Looper is still being worked on, and a family that gained six commands and an entirely new control channel between two observed builds is one whose next version will not look like this one. The same research team recently found that ransomware crews are aiming at managers rather than administrators, and the suspected delivery route here is the same ClickFix technique that has been turning legitimate websites into malware delivery points. The foothold is the cheapest part of a ransomware attack to stop.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.