{"id":2494,"date":"2026-08-21T20:58:52","date_gmt":"2026-08-21T20:58:52","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2494"},"modified":"2026-08-21T20:58:52","modified_gmt":"2026-08-21T20:58:52","slug":"14-trojanized-npm-packages-drop-redc2-4-0-linux-backdoor-with-ai-assisted-c2","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2494","title":{"rendered":"14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgvZpEOpS6_M3zQlIDwvD1wMhESnRAMTCz1nW2JFP__pGSVWOw28REaDTZ5lI7sdwvcRKSSUHI4sm1CUuWs6_gvOXE1c5BbvKnR75iyBl9Er1SckweDAxBEotnOlSikBeOE5WEBIIGlS74w4b85pvznpr3c4mj88LzLt-3pGr1HHXHQDg5v7T9FxdBSWSlK\/s1700-e365\/linux-npm.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0.<\/p>\n<p>\u00abWhen the module loads, it\u202flocates\u202fthe bundled binary, marks it executable, and launches it as a detached background process,\u00bb TrendAI, Trend Micro&#8217;s enterprise cybersecurity business, <a href=\"https:\/\/www.trendaisecurity.com\/en-us\/resources-insights\/trendai-security-blog\/redc2-ai-powered-linux-implant\" target=\"_blank\">said<\/a> in a report published Thursday. \u00abNo install hook function call\u202fis needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.\u00bb<\/p>\n<p>The list of identified packages is below &#8211;<\/p>\n<ul>\n<li>streak-metrics-math@1.0.0,1.0.1<\/li>\n<li>kit-map-vim@1.0.0<\/li>\n<li>streak-map-cache@1.0.0<\/li>\n<li>streak-map-kit@1.0.0<\/li>\n<li>map-streak-kit@1.0.0<\/li>\n<li>streak-cache-map@1.0.0<\/li>\n<li>streak-calc-metrics@1.0.0<\/li>\n<li>streak-calc-math@1.0.0<\/li>\n<li>streak-math-abz@1.0.0<\/li>\n<li>streak-metricsaz@1.0.0<\/li>\n<li>streak-math-metrics@1.0.0<\/li>\n<li>streak-metricazbd@1.0.0<\/li>\n<li>streak-metricsazb@1.0.0<\/li>\n<li>streak-kit-map@1.0.0<\/li>\n<\/ul>\n<p>What&#8217;s notable about these packages is that they are functional and offer the promised functionality. But beneath that garb of date utilities is code designed to drop a Linux backdoor by framing it as a native math accelerator. The name of the file varies across the packages: math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin,\u202fcalc.bin,\u202fcalc-mapping.bin.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zero-trust-claude-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8iAp2j8rqTq6aptj6yiYHC-B73UxnWI2NQMt0azp6OVLq9JkO8cpYokLWa8t_IKqrHKPsaM5D_lQ9Ip7kZTi3at4oYfzN1m1b_T4b6MuzBWtmlhdLcQ0nZHicD94rliREFDRewsKBQCTYrAAVNzYKj84_0EZskDUxvkc972s9fYAqcQGEQjVZTc0cr7TB\/s728-e100\/ThreatLocker-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>It&#8217;s located either directly within the \u00abdist\/\u00bb or under \u00abdist\/internal\/,\u00bb, but what it contains is the same: the\u202fRedShell\u202fLinux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>\u00abDelivery is handled by the package entry file,\u202fdist\/index.mjs, which acts as a trojan loader,\u00bb security researcher Aliakbar Zahravi said.\u202f\u00bbIt\u202fre-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function\u202frequired.\u00bb<\/p>\n<p>RedC2 4.0, marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux, offers surveillance, credential theft, payload loading, and mass-operation capabilities. The version was advertised by a threat actor named \u00abMarlboroMan\u00bb on Hack Forums in early June 2026, describing it as a command-and-control (C2 or C&amp;C) framework \u00abbuilt for evasion.\u00bb<\/p>\n<p>Version 3.0 of RedC2 was sold earlier this January, while version 2.0 was released in August 2025, indicating the framework has been under active development for at least a year. The\u202fRedShell\u202fLinux beacon was introduced in version 4.0. <\/p>\n<p>The C2 framework is also feature-rich, supporting terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.<\/p>\n<table cellpadding=\"0\" cellspacing=\"0\" class=\"tr-caption-container\" style=\"float: left;\">\n<tbody>\n<tr>\n<td style=\"text-align: center;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjlHCLJlXhU8AcLg7JSdDErd_fLrMesEfNfedrzh1Lz4G3BBdG010Z-_HCGWEVVwUPgTsOBPvYEQLzdJC18Kwe10a-KKAngzQjsnnW6RiBJ_gyvus9IoXpAcERDcwfmPIjP3Hz9WXY8o8P5Ee58uocwewQ6_ZO91UJpLcBjzXhyaDTKc7BhbabCKrOitnJT\/s1700-e365\/endpoint.png\" style=\"clear: left; display: block; margin-left: auto; margin-right: auto;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjlHCLJlXhU8AcLg7JSdDErd_fLrMesEfNfedrzh1Lz4G3BBdG010Z-_HCGWEVVwUPgTsOBPvYEQLzdJC18Kwe10a-KKAngzQjsnnW6RiBJ_gyvus9IoXpAcERDcwfmPIjP3Hz9WXY8o8P5Ee58uocwewQ6_ZO91UJpLcBjzXhyaDTKc7BhbabCKrOitnJT\/s1700-e365\/endpoint.png\" alt=\"\" border=\"0\" data-original-height=\"1417\" data-original-width=\"1885\"\/><\/a><\/td>\n<\/tr>\n<tr>\n<td class=\"tr-caption\" style=\"text-align: center;\">RedShell Linux execution flow<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Linux variant of the beacon, once deployed, provides an interactive shell through \u00ab\/bin\/sh\u00bb\u202fand exposes Linux-specific commands to enable system discovery, file operations, data collection (e.g., SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting.<\/p>\n<p>It also establishes communication with a C2 server and registers the infected system by gathering basic system information and transmitting it in the form of a \u00abcheck-in message,\u00bb after which it enters a command-processing loop to process incoming instructions from the operator, execute them via \u00ab\/bin\/sh,\u00bb and send the results back.<\/p>\n<p>The Windows and macOS counterparts cover a similar ground, allowing file operations, host and network reconnaissance, user enumeration, and data harvesting. The Windows beacon also incorporates User Account Control (UAC) bypass, antivirus and endpoint detection, antivirus tampering, in-memory execution, and lateral movement that the macOS version lacks.<\/p>\n<p>On a clearnet website branded Red Offsec, the threat actor claims, \u00abRed C2 is a multi-language, multi-OS command and control framework designed for Windows, Linux, and macOS. The entire framework was built with evasion as a core principle, utilizing the latest developments and techniques in the offensive security field.\u00bb It&#8217;s available for purchase for $99.99.<\/p>\n<p>Red Offsec&#8217;s Terms of Service expressly prohibit its customers from using the tool for \u00abunauthorized computer access,\u00bb \u00abhacking without explicit permission,\u00bb and \u00ababuse, exploitation, or damage of systems you do not own or are not authorized to test.\u00bb <\/p>\n<p>\u00abRed Offsec provides tools intended for red team professionals and users who understand external offensive security tooling within legal and ethical boundaries,\u00bb the terms read.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>RedC2 extends its control layer with a command-line extension referred to as RedC2 EXT as well as a large language model (LLM)-driven\u202fcomponent\u202fcalled Red Agent, the latter of which lets operators orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands. <\/p>\n<p>\u00abRedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into\u202fframework\u202fbeacon commands,\u00bb Zahravi said. Red Offsec has characterized it as an \u00abAI-powered command execution system specialized for penetration testing.\u00bb<\/p>\n<p>The findings underscore how previously undocumented AI-integrated C2 frameworks are being distributed via malicious npm packages, while simultaneously lowering the barrier to entry.<\/p>\n<p>\u00abBy interacting with a model tuned for red-team operations, an operator inputs natural-language prompts, and the framework translates them into actionable command sequences,\u00bb TrendAI said. \u00abThis abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently.\u00bb<\/p>\n<p>The development comes close on the heels of a coordinated supply chain attack affecting three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9), compromising them with a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds.<\/p>\n<p>The malware is designed to profile the infected device, catalog Chromium-based browsers, establish persistence, and beacon to attacker-controlled infrastructure for tasking and downloading additional payloads.<\/p>\n<p>It&#8217;s suspected that the maintainer&#8217;s publishing credentials were compromised to push the poisoned versions to the package repository. Evidence points to infrastructure overlaps with prior software supply chain attacks targeting Mastra and Axios, both linked to North Korean threat actors.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2495,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[170,179,3128,181,39,35,3129,259],"class_list":["post-2494","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-aiassisted","tag-backdoor","tag-drop","tag-linux","tag-npm","tag-packages","tag-redc2","tag-trojanized"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2494"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2494\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2495"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}