C2Looper Rust Backdoor Abuses OneDrive DLL Sideloading and GitHub C2 in Ransomware Delivery Chains

Zscaler discloses the Rust-written C2Looper backdoor, delivered via ClickFix infection chains, abusing OneDrive DLL sideloading and GitHub C2, likely tied to ransomware groups.

Zscaler ThreatLabz discovered C2Looper in July 2026 and publicly disclosed it on August 17. It is a next-gen Windows backdoor written in Rust, assessed as highly likely tied to ransomware groups (low-to-medium confidence). Delivered via multi-stage ClickFix social-engineering chains. Early versions used plaintext HTTP C2; v2 fully migrated to GitHub repositories as the command channel and abused Microsoft OneDrive DLL sideloading in its update mechanism, raising detection and blocking difficulty. Researchers assess the capability mix (remote command execution, lateral recon, second-stage delivery) as typical of an initial foothold in a ransomware delivery chain.

Incident Overview

C2Looper was found during Zscaler ThreatLabz tracking of ClickFix-style social-engineering campaigns. ClickFix is among the most scaled initial-access methods of 2025–2026: fake browser/OS error pages lure users into pasting and executing PowerShell, cmd, or curl in a terminal. C2Looper differs from classic ClickFix backdoors in two ways: (1) written in Rust with XOR string obfuscation and dynamic API resolution, raising the static-analysis bar; (2) older versions DLL-sideload via OneDrive's legitimate executable names to evade EDR process-reputation checks; newer versions hide all C2 traffic inside legitimate GitHub repository activity.

Technical Details

• Delivery: multi-stage ClickFix infection chain. Typical lures: fake browser errors, fake CAPTCHAs, tech-support prompt pages.
• Language and static analysis: written in Rust; 8-byte XOR key decrypts strings at runtime; dynamic Win32 API resolution via `LoadLibrary`/`GetProcAddress`.
• OneDrive DLL sideloading: on `upload` command, downloads a PE from C2, renames it `wtsapi32.dll`, writes it to `%LocalAppData%\Microsoft\OneDrive\`; then kills the OneDrive process so OneDrive.exe loads the malicious DLL on restart—malicious code running inside a legitimate process.
• GitHub C2 (v2): each victim host maps to a dedicated directory in the repo; `cmd.json` holds tasks, `result.json` returns results, `beacon.json` reports host identity and last heartbeat. Traffic matches legitimate Git operations; enterprise firewalls cannot simply block it.
• Capabilities: remote shell, command execution, file download/upload, directory listing, domain-account recon, disk and network-topology enumeration, shellcode injection (new thread via winspool.drv).
• Ransomware-chain fit: ClickFix for initial access → C2Looper foothold for arbitrary commands → OneDrive DLL sideloading for persistence → ransomware loader completes encryption.

Impact Assessment

C2Looper is a representative sample of ClickFix social-engineering chains evolving toward AI and SaaS abuse:

• Layered evasion: Rust + string obfuscation + dynamic API resolution defeat AV/EDR static signatures; OneDrive sideloading makes the process name fully legitimate; GitHub C2 blends malicious traffic into developer-required code-hosting traffic.
• Ransomware-fronting trend: assessed as highly likely an initial-access tool for ransomware groups. ClickFix is no longer limited to miners or stealers; it has entered industrial-scale ransomware delivery.
• Full Windows coverage: from home users to enterprise desktops. Windows 11 devices with default OneDrive installs are almost all in the attack surface.
• Supply-chain trust abused: Microsoft-signed, default-installed OneDrive process used as a sideload carrier. Aligns with the "trusted tools weaponized" trend (LiteLLM/.pth startup hooks, etc.) as a signature H2 2026 attack chain.

Remediation

• Endpoint hardening: WDAC/AppLocker to restrict non-essential script execution; EDR alert on presence of `%LocalAppData%\Microsoft\OneDrive\wtsapi32.dll`; monitor abnormal OneDrive.exe restarts and DLL load sources.
• Network detection: correlate alerts on `cmd.json`/`result.json`/`beacon.json` filenames in GitHub repos at the enterprise proxy; enable GitHub Enterprise audit logs; separate egress policy for dev environments.
• User education: include ClickFix social engineering in org-wide awareness training; employees must immediately report browser prompts such as "paste this command to fix your browser"; ban pasting unknown commands into terminals.
• OneDrive config: disable OneDrive auto-start via Intune/GPO in enterprise environments to cut sideload opportunities; constrain version and update source for required OneDrive deployments.
• Incident response: isolate hosts immediately on suspicious `wtsapi32.dll` or abnormal OneDrive behavior; review GitHub repo call history; reconstruct C2 directories and corresponding Bot IDs.

References

• Zscaler ThreatLabz: C2Looper technical report
• Cypro: C2Looper attack-chain analysis
• Hackers Radar: C2Looper OneDrive sideloading
• SBCSG: August 18 Windows Task Host ransomware + Copilot vulnerability briefing