Threats Tagged 'lactrodectus'

C2Looper is a Rust-based backdoor malware identified in mid-2026, associated with ransomware threat actors. It provides remote shell execution, reconnaissance, and payload deployment capabilities. Initial versions communicate via plaintext HTTP, while later versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds features such as drive enumeration, shellcode injection, and file listing. Delivery is assessed with low to medium confidence to occur through multi-stage ClickFix infection chains. The malware is actively developed and likely used by initial access brokers to facilitate ransomware and data theft operations.