C2Looper v1 Plaintext HTTP Beacon to /api/beacon Endpoint

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•3

Detects C2Looper v1 malware communication patterns, specifically plaintext HTTP beaconing to /api/beacon or /api/result endpoints with characteristic JSON body fields (id, user, host, pid, cmd, arg, seq), as well as direct network connections to known C2Looper command-and-control infrastructure on TCP port 8888.