C2Looper Backdoor Uses GitHub for C2

C2Looper is a remote-access backdoor analyzed in this report: older variants use plaintext HTTP beacons and JSON endpoints for command-and-control, while version 2 migrates C2 to GitHub repositories (cmd.json/result.json/beacon.json). The malware uses XOR string encryption and dynamic Windows API resolution, supports commands for running shells, file upload/download (including DLL sideloading via OneDrive), process injection, and host reconnaissance. The report documents protocol formats, command sets for both versions, a fixed parsing bug in v2, and notable persistence/evasion techniques, providing actionable technical details and IOCs for detection and mitigation.