Zscaler ThreatLabz disclosed C2Looper in July 2026 — a Rust-based backdoor assessed with low-to-medium confidence to be a foothold tool for a ransomware-affiliated actor, delivered through a multi-stage ClickFix infection chain. The first version was unremarkable: string-encrypted, dynamic API resolution via LoadLibrary/GetProcAddress, and a plaintext HTTP POST beacon that shipped host recon data as JSON to a hardcoded C2 server. Version 2 changed the interesting part. It dropped the dedicated HTTP infrastructure entirely and moved the whole command-and-control loop into GitHub — creating a per-victim directory inside an attacker-controlled repository and using the GitHub API as the transport for tasking, output, and heartbeat.

This is a textbook example of T1102.002 (Web Service: Bidirectional Communication): the C2 channel rides on a domain (github.com, api.github.com, raw.githubusercontent.com) that is on every allowlist, wrapped in TLS that proxies won’t inspect, and indistinguishable from developer traffic at the DNS layer. The detection opportunity isn’t in the domain — it’s in who is talking to it, how often, and what the request pattern looks like.

Why This Beats Domain-Based Blocking

Blocking or alerting on github.com outright is a non-starter in most environments — it breaks CI/CD, package managers, and every developer’s day. The reliable signal is process lineage and polling behaviour: C2Looper’s persistence loop polls the GitHub API on a fixed interval from a process that is not git.exe, not a browser, not an IDE, and not a known package manager. A Rust binary using the reqwest HTTP client also leaves a distinctive default User-Agent unless the operator bothered to spoof it.

Sigma Rule: Non-Developer Process Beaconing to GitHub Infrastructure

title: Suspicious Process Establishing Repeated Connections to GitHub API/Raw Content
id: 7f1a2c3e-9b4d-4a6f-8e21-3d5c9f0b1a44
status: experimental
description: Detects non-developer-tooling processes making repeated outbound HTTPS connections to github.com, api.github.com, or raw.githubusercontent.com, consistent with GitHub-as-C2 techniques such as C2Looper v2.
references:
    - https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2
author: SOC Analyst Hub
date: 2026-08-19
tags:
    - attack.command-and-control
    - attack.t1102.002
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'api.github.com'
            - 'raw.githubusercontent.com'
            - 'github.com'
    filter_known_tools:
        Image|endswith:
            - '\git.exe'
            - '\GitHubDesktop.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\Code.exe'
            - '\winget.exe'
            - '\node.exe'
    condition: selection_domain and not filter_known_tools
falsepositives:
    - Custom internal tooling that legitimately polls GitHub (CI runners, bots) — baseline and allowlist by process path/hash.
level: high

Sigma Rule: ClickFix Delivery Chain Preceding the Beacon

C2Looper’s observed delivery relies on the ClickFix pattern — a fake CAPTCHA or error page that tricks the user into pasting and running a command via the Run dialog.

title: ClickFix-Style Run Dialog Execution Followed by Outbound Process
id: 4b6e8d0a-1f3c-4e77-9a5b-2c0d7e4f8b19
status: experimental
description: Detects the ClickFix pattern where explorer.exe spawns a shell interpreter with clipboard-derived, heavily-encoded arguments — a common precursor to C2Looper and similar loaders.
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
    selection_args:
        CommandLine|contains:
            - '-w hidden'
            - '-windowstyle hidden'
            - 'IEX'
            - 'DownloadString'
    condition: selection_parent and selection_child and selection_args
falsepositives:
    - Legitimate admin scripts launched via Run dialog with hidden windows (rare; investigate context).
level: medium

Hunting Query: Microsoft Sentinel (KQL)

This hunts for beacon-like regularity — a strong signal that HTTP requests to GitHub are automated tasking rather than a developer browsing or cloning.

let AllowedProcesses = dynamic(["git.exe","GitHubDesktop.exe","chrome.exe","msedge.exe","firefox.exe","Code.exe","node.exe","winget.exe"]);
DeviceNetworkEvents
| where RemoteUrl has_any ("api.github.com", "raw.githubusercontent.com")
| where InitiatingProcessFileName !in~ (AllowedProcesses)
| summarize ConnectionCount = count(),
            DistinctMinutes = dcount(bin(Timestamp, 1m)),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| extend DurationMin = datetime_diff('minute', LastSeen, FirstSeen)
| where ConnectionCount >= 10 and DurationMin > 0
| extend AvgIntervalMin = round(1.0 * DurationMin / ConnectionCount, 1)
| where AvgIntervalMin between (0.5 .. 15.0)
| order by ConnectionCount desc

Hunting Query: Splunk (SPL)

For environments relying on proxy or Sysmon EventID 22 (DNS query) telemetry rather than EDR network events:

index=proxy OR index=sysmon (dest_host="api.github.com" OR dest_host="raw.githubusercontent.com")
| eval known_tool=if(match(process_name, "(?i)(git\.exe|githubdesktop|chrome|msedge|firefox|code\.exe|node\.exe)"), "yes", "no")
| where known_tool="no"
| bin _time span=1h
| stats count as req_count, dc(_time) as active_hours by src, process_name, process_path, user
| where req_count >= 10
| sort - req_count

Triage Guidance

If either query surfaces a hit, pivot immediately to:

  1. Process ancestry — is the beaconing binary spawned from a script host, or does it descend from a ClickFix-style Run dialog execution (explorer.exe → powershell.exe/mshta.exe)?
  2. File reputation — C2Looper binaries are typically unsigned, dropped in %TEMP% or %APPDATA%, and lack version metadata consistent with legitimate dev tooling.
  3. Repository content — where feasible via threat intel enrichment, check whether the target GitHub repo is newly created, has near-zero stars/forks, and contains directory names resembling hostnames or GUIDs rather than source code.
  4. Lateral movement precursors — C2Looper is a foothold tool; treat any confirmed hit as a precursor to ransomware staging and prioritize isolating the host and hunting for credential access activity (LSASS access, DCSync, RDP/WinRM lateral movement) on adjacent systems.

Domain trust is not a detection control. As more toolkits move C2 into GitHub, Slack, Discord, and other “living-off-trusted-services” platforms, the durable detections are the ones anchored to process lineage and request cadence — not the hostname in the SNI field.