C2Looper v2 GitHub-based C2 via cmd/result/beacon JSON

Emiliano Mema@Nosalva

•updated Aug 19, 2026•0•0•6

Detects repeated network requests to specific JSON files hosted on GitHub (e.g., beacon.json) initiated by processes other than standard web browsers or git. This behavior is indicative of a C2 heartbeat mechanism where an agent periodically retrieves configuration or tasking files from a public repository.