C2Looper v2 GitHub C2 tasking file retrieval (cmd.json/result.json/beacon.json)

Duo Tech@duotech

•updated Aug 18, 2026•0•0•0

Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.