The specialists of Zscaler discovered a new backdoor C2Looper, which intruders are likely to use before attacks with ransomware. The malicious program allows you to discreetly fix yourself in the network, collect information about computers, execute commands and download additional malicious files. The analysis showed that the developers have already significantly expanded the capabilities of C2Looper.
The ThreatLabz team discovered C2Looper in July 2026. The backdoor is written in Rust, hides the strings with the XOR operation and downloads the necessary Windows functions only during operation. Zscaler with low or medium confidence links the spread of C2Looper with ClickFix campaigns, during which the victim is deceived by the victim to execute a malicious command on his own.
The first version found was associated with the control server on the usual HTTP. Every second, C2Looper sent a request, passing the username, computer name, and process ID. The server could order the program to execute a system command, open the command shell, or download an additional file.
To update, C2Looper uploaded the malicious library wtsapi32.dll to the OneDrive directory, completed the application process, and forced the legitimate OneDrive executable file to connect the swapped library. This method helps to run malicious code through a trusted program and makes it difficult to detect.
Later, the specialists found C2Looper v2. The new version completely abandoned a separate control server and moved the exchange of commands to GitHub. For each infected computer, the malware creates a separate directory in the repository and works with three JSON files. In cmd.json, the operator leaves commands, result.json receives the results of their execution, and beacon.json stores the identifier of the infected system and the time of the last contact.
C2Looper v2 is able to view files and disks, collect detailed information about the system and domain Windows, run programs and download new components. To carry out exploration, the malware causes full-time teams ipconfig, whoami, nltest, net and wmic. Another command allows you to place the downloaded machine code in the memory area of the legitimate winspool.drv library and execute it in a separate stream.
The developers also corrected the error of the first version, due to which C2Looper incorrectly processed the task IDs. In the code of the second version, the debugging lines with the mark “v2” remained, which confirms that the family is actively being finalized.
Zscaler suggests that C2Looper could serve as an initial penetration tool. Having gained access, intruders are able to study the corporate network, steal sensitive data and then deploy the ransomware. The direct communication of C2Looper with a specific group has not yet been established.
The ThreatLabz team discovered C2Looper in July 2026. The backdoor is written in Rust, hides the strings with the XOR operation and downloads the necessary Windows functions only during operation. Zscaler with low or medium confidence links the spread of C2Looper with ClickFix campaigns, during which the victim is deceived by the victim to execute a malicious command on his own.
The first version found was associated with the control server on the usual HTTP. Every second, C2Looper sent a request, passing the username, computer name, and process ID. The server could order the program to execute a system command, open the command shell, or download an additional file.
To update, C2Looper uploaded the malicious library wtsapi32.dll to the OneDrive directory, completed the application process, and forced the legitimate OneDrive executable file to connect the swapped library. This method helps to run malicious code through a trusted program and makes it difficult to detect.
Later, the specialists found C2Looper v2. The new version completely abandoned a separate control server and moved the exchange of commands to GitHub. For each infected computer, the malware creates a separate directory in the repository and works with three JSON files. In cmd.json, the operator leaves commands, result.json receives the results of their execution, and beacon.json stores the identifier of the infected system and the time of the last contact.
C2Looper v2 is able to view files and disks, collect detailed information about the system and domain Windows, run programs and download new components. To carry out exploration, the malware causes full-time teams ipconfig, whoami, nltest, net and wmic. Another command allows you to place the downloaded machine code in the memory area of the legitimate winspool.drv library and execute it in a separate stream.
The developers also corrected the error of the first version, due to which C2Looper incorrectly processed the task IDs. In the code of the second version, the debugging lines with the mark “v2” remained, which confirms that the family is actively being finalized.
Zscaler suggests that C2Looper could serve as an initial penetration tool. Having gained access, intruders are able to study the corporate network, steal sensitive data and then deploy the ransomware. The direct communication of C2Looper with a specific group has not yet been established.
