Github C2

Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq

• Cybercriminals

Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq

Do Son October 8, 2026 0

The Blinder Tunnel campaign used a fake Dubai Airports coding test to drop ShelbyLoader V2 on an Iraqi target. See how it works and how to defend.

C2Looper: Rust Backdoor Uses GitHub for C2 Control

• Malware

C2Looper: Rust Backdoor Uses GitHub for C2 Control

Do Son August 24, 2026 0

Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.

Tropic Trooper Weaponizes GitHub and VS Code for East Asian Espionage

• Cybercriminals

Tropic Trooper Weaponizes GitHub and VS Code for East Asian Espionage

Do Son April 24, 2026 0

Tropic Trooper's 2026 campaign uses trojanized SumatraPDF and VS Code tunnels for stealthy East Asian espionage. Learn how to defend your infrastructure.

New Phishing Campaign Abuses GitHub to Target South Korea

• Cybercriminals

New Phishing Campaign Abuses GitHub to Target South Korea

Do Son April 9, 2026 0

FortiGuard Labs unmasks a South Korean espionage wave abusing the GitHub API for C2 and using LNK files to stay invisible. Protect your network from LotL.

“Gopher Strike”: New Pakistan-Linked Cyber Campaigns Target Indian Government

• Cyber Security
• Malware

“Gopher Strike”: New Pakistan-Linked Cyber Campaigns Target Indian Government

Do Son January 28, 2026 0

New "Gopher Strike" & "Sheet Attack" campaigns hit Indian govt. Linked to Pakistan, attackers use GitHub C2 & GenAI malware to evade detection.

APT-C-60 Targets Japan: New SpyGlace Malware Uses VHDX LNK and GitHub Tasking for Persistent Espionage

• Cyber Security
• Malware

APT-C-60 Targets Japan: New SpyGlace Malware Uses VHDX LNK and GitHub Tasking for Persistent Espionage

Do Son November 6, 2025 0

JPCERT exposed APT-C-60 targeting Japan via VHDX LNK files in phishing emails. The SpyGlace malware uses GitHub to fetch encrypted commands and statcounter for victim telemetry.

Astaroth Malware Uses Steganography in GitHub Images for Covert C2 Backup and Brazilian Bank Theft

• Malware

Astaroth Malware Uses Steganography in GitHub Images for Covert C2 Backup and Brazilian Bank Theft

Do Son October 14, 2025 0

McAfee uncovered the Astaroth banking Trojan using GitHub for C2 backup, hiding encrypted configuration data via steganography in images to target Brazilian financial and crypto users.

OLE Object Offensive: FlowerPower APT’s Novel Attack Vector

• Cyber Security
• Malware

OLE Object Offensive: FlowerPower APT’s Novel Attack Vector

Do Son November 30, 2023 0

The FlowerPower campaign ingeniously masquerades as interview requests from foreign news channels, leveraging the widely used Korean HWP