C2Looper HTTP beacon to /api/beacon with JSON id/user/host/pid

Emiliano Mema@Nosalva

•updated Aug 19, 2026•0•0•7

Detects periodic (beaconing) HTTP POST requests directed to '/api/beacon' from endpoints. The detection logic monitors for consecutive connections occurring within a 3-second interval, specifically searching for JSON payloads containing identification fields (id, user, host, pid) characteristic of C2Looper backdoor traffic.