Threats Tagged 't1124'

C2Looper is a Rust-based backdoor malware identified in mid-2026, likely linked to ransomware threat actors. It is delivered via multi-stage ClickFix infection chains and provides remote shell execution, reconnaissance, and payload deployment capabilities. The malware uses dynamic Windows API resolution and XOR string encryption. It initially communicates over plaintext HTTP but evolved versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds commands for reconnaissance, drive enumeration, shellcode injection, and file listing. C2Looper is actively developed and likely serves initial access brokers facilitating data theft and ransomware attacks.

A long-running campaign compromised the QuickFox VPN application, primarily used by Chinese users to access Chinese resources and improve gaming experiences. Active since August 2025, the attack involved trojanized Windows installers (versions 3.0.51.0 through 3.59.5) that deployed malicious JavaScript through modified Electron renderer HTML files. The JavaScript loader fingerprinted victim endpoints using process-based guardrails, checking for specific applications including administrative tools, cryptocurrency wallets, and Chinese translation software while avoiding Steam users. Successfully profiled targets received an FDMTP implant through DLL sideloading techniques using legitimate Microsoft Azure binaries. The infrastructure demonstrates active development with multiple staging domains masquerading as legitimate services. QuickFox removed malicious components from version 3.59.6 following responsible disclosure. Technical overlaps suggest possible connections to Twill Typhoon, though attribution remain