C2Looper Backdoor Evolves with OneDrive DLL Sideloading and GitHub C2
The C2Looper backdoor has been updated with sophisticated evasion techniques, including DLL sideloading via Microsoft OneDrive and command-and-control infrastructure hosted on GitHub.
A sophisticated backdoor known as C2Looper, first identified in July 2026, has evolved its tactics to enhance stealth and evade detection. This malware provides attackers with a covert method to control compromised Windows systems, enabling them to execute commands, conduct network reconnaissance, and deploy additional malicious payloads, posing a significant threat to organizations susceptible to ransomware attacks. Its relatively simple functionality is sufficient for establishing a persistent foothold within a target environment, often initiated through multi-stage social engineering lures designed to trick users into executing commands under the guise of system fixes.
Security researchers at Zscaler observed the malware's development and expansion, assessing with moderate confidence that it is linked to a ransomware-affiliated threat actor. The primary goal of C2Looper appears to be establishing initial access and facilitating lateral movement within victim networks. The identity of the operators remains unconfirmed, leaving defenders vigilant for potential ransomware campaigns.
One of the key advancements in C2Looper is its use of DLL sideloading through Microsoft OneDrive for self-updating. In older variants, the backdoor would download a portable executable disguised as a DLL into the user's local OneDrive folder. It would then terminate the legitimate OneDrive process, relying on the trusted OneDrive executable to load the malicious DLL when it restarted. This technique exploits the Windows mechanism where applications load supporting libraries from their working directories, allowing attackers to execute malicious code under the guise of legitimate software.
This DLL sideloading mechanism is believed to serve as C2Looper's update routine, enabling operators to refresh or replace the backdoor discreetly. It underscores the importance for security teams to monitor for unusual child processes, unexpected DLL files, and abrupt restarts of legitimate applications like OneDrive, rather than solely relying on executable names for threat identification. This method aligns with a broader trend of attackers leveraging trusted software to conceal their malicious activities.
Further enhancing its evasion capabilities, newer versions of C2Looper have shifted their command-and-control (C2) infrastructure to GitHub. Unlike earlier versions that communicated over unencrypted HTTP, the updated variant utilizes GitHub repositories to manage communications. Each infected machine is assigned a dedicated directory, with specific JSON files (cmd.json, result.json, beacon.json) used for receiving commands, reporting results, and maintaining bot identification. This move to a mainstream code-hosting platform makes malicious traffic significantly harder to distinguish from legitimate network activity.
Version 2 of C2Looper also introduces enhanced functionalities, including file listing capabilities, expanded host discovery features, and a code-injection mechanism. The reconnaissance phase gathers critical system information such as domain details, account information, installed software, and drive configurations, which aids attackers in mapping valuable targets before deploying further payloads, such as ransomware. The malware's upload command now retrieves files from a dedicated repository into the Windows temporary directory, and its run command executes a file before deleting it, further reducing forensic artifacts.
Refinements in the newer variant also include the use of Windows pipes for capturing command output, replacing the older method of using local output files. These improvements suggest that the developers are actively addressing operational weaknesses and enhancing the tool's resilience and stealth. While the initial ClickFix delivery vector highlights the importance of user awareness, robust technical controls remain critical.
Organizations are advised to implement measures such as restricting unnecessary script execution, monitoring for suspicious DLL loads within OneDrive directories, and scrutinizing alerts related to fake verification prompts. The evolving nature of C2Looper, with its sophisticated evasion techniques, necessitates continuous vigilance and adaptation of defensive strategies.