Threats Tagged 'lactrodectus'

C2Looper is a Rust-based backdoor malware identified in mid-2026, likely linked to ransomware threat actors. It is delivered via multi-stage ClickFix infection chains and provides remote shell execution, reconnaissance, and payload deployment capabilities. The malware uses dynamic Windows API resolution and XOR string encryption. It initially communicates over plaintext HTTP but evolved versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds commands for reconnaissance, drive enumeration, shellcode injection, and file listing. C2Looper is actively developed and likely serves initial access brokers facilitating data theft and ransomware attacks.