Cybersecurity articles tagged #C2 on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2https://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2Aeternum botnet uses Polygon blockchain smart contracts for C2, making it resilient to takedowns. Security professionals must understand its decentralized operations.Tue, 11 Aug 2026 01:00:31 GMTBotnetMalwareAeternumPolygon BlockchainC2https://runtimerebel.com/blog/direct-to-ip-malware-c2-bypass-threat-landscape-and-zt-ip-mitigationhttps://runtimerebel.com/blog/direct-to-ip-malware-c2-bypass-threat-landscape-and-zt-ip-mitigationNearly half of malware samples use hard‑coded IPs for C2, evading DNS defenses; learn detection and mitigation with ZT‑IP.Thu, 06 Aug 2026 01:58:07 GMTPhorpiexDirect to IPC2Zero Trust IPMalwarehttps://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2HollowGraph malware leverages Microsoft Graph API calendar features for covert command-and-control and data exfiltration from Microsoft 365 environments.Mon, 20 Jul 2026 18:05:43 GMTHollowGraphMicrosoft GraphMicrosoft 365C2Data ExfiltrationAPI Abusehttps://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2HollowGraph, a new espionage malware, hides C2 commands and exfiltrates data via legitimate Microsoft 365 calendar events, mimicking normal Graph API traffic.Mon, 20 Jul 2026 18:05:24 GMTHollowGraphMicrosoft 365Microsoft Graph APIEspionageC2Data ExfiltrationGroup IBhttps://runtimerebel.com/blog/modbeacon-rat-silver-fox-uses-grpc-for-stealthy-c2https://runtimerebel.com/blog/modbeacon-rat-silver-fox-uses-grpc-for-stealthy-c2A new Rust-based MODBEACON RAT, linked to the Silver Fox cybercrime group, employs gRPC streaming for encrypted C2, propagated via SEO poisoning.Fri, 10 Jul 2026 14:30:03 GMTMODBEACONRATSilver FoxgRPCC2RustSEO Poisoninghttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkhttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkGoogle, in coordination with the FBI and Lumen, has significantly disrupted the NetNut residential proxy network, impacting millions of compromised devices.Fri, 03 Jul 2026 07:31:53 GMTNetNutResidential ProxyBotnetC2Google Play ProtectMalwareIPIDEACybercrimeEspionagehttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attackshttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attacksMustang Panda, a China-aligned APT, targets Indian government and hydropower entities, leveraging Zoho WorkDrive as a C2 channel and deploying new malware.Mon, 29 Jun 2026 17:06:24 GMTMustang PandaAPTZoho WorkDriveIndian GovernmentEspionageC2Cloud Securityhttps://runtimerebel.com/blog/gopherwhisper-apt-abuses-outlook-and-slack-for-stealthy-c2https://runtimerebel.com/blog/gopherwhisper-apt-abuses-outlook-and-slack-for-stealthy-c2Newly discovered GopherWhisper APT group uses a Go-based toolkit and legitimate SaaS platforms like Slack and Outlook to conduct espionage against governments.Thu, 23 Apr 2026 12:29:29 GMTGopherWhisperAPTC2OutlookSlackDiscordGo Malwarehttps://runtimerebel.com/blog/systembc-c2-analysis-1570-victims-of-the-gentlemen-ransomwarehttps://runtimerebel.com/blog/systembc-c2-analysis-1570-victims-of-the-gentlemen-ransomwareAnalysis of a SystemBC C2 server linked to The Gentlemen ransomware reveals over 1,570 victims and the use of SOCKS5 tunnels for persistent access.Tue, 21 Apr 2026 20:22:49 GMTSystemBCThe GentlemenRansomwareBotnetCheck PointC2https://runtimerebel.com/blog/emoji-based-c2-threat-actors-adopt-covert-communication-tacticshttps://runtimerebel.com/blog/emoji-based-c2-threat-actors-adopt-covert-communication-tacticsThreat actors are increasingly using emojis for covert Command and Control communications to evade security filters. Learn how to detect these obfuscated TTPs.Thu, 09 Apr 2026 00:35:54 GMTEmojiCovert CommunicationC2Threat Actor TTPsEvasionObfuscationhttps://runtimerebel.com/blog/snappyclient-c2-implant-targets-crypto-wallets-for-data-thefthttps://runtimerebel.com/blog/snappyclient-c2-implant-targets-crypto-wallets-for-data-theftA new C2 implant, SnappyClient, is actively targeting crypto wallets, facilitating remote access, extensive data theft, and persistent spying on victims.Thu, 19 Mar 2026 00:37:20 GMTSnappyClientC2Crypto WalletsData TheftRemote AccessMalwarehttps://runtimerebel.com/blog/tag-poisoning-compromises-xygeni-github-action-c2-implant-activehttps://runtimerebel.com/blog/tag-poisoning-compromises-xygeni-github-action-c2-implant-activeAttackers compromised the `xygeni/xygeni-action` GitHub Action using tag poisoning, deploying a C2 implant for up to a week. Users must verify integrity and review logs.Thu, 12 Mar 2026 00:30:26 GMTGitHub ActionsSupply Chain AttackTag PoisoningXygeniC2https://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewhttps://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewNorth Korean actors published 26 malicious npm packages using Pastebin as a C2 dead drop resolver in a new Contagious Interview campaign iteration.Mon, 02 Mar 2026 12:18:05 GMTNPMLazarus GroupContagious InterviewSupply Chain AttackPastebinC2Node Jshttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyGoogle disrupts GRIDTIDE, a novel backdoor used by PRC-nexus UNC2814 for global cyber espionage against telecommunications and government entities.Wed, 25 Feb 2026 16:34:59 GMTUNC2814GRIDTIDEPRC NexusCyber EspionageTelecommunicationsGovernmentGoogle Sheets APISoftEther VPNC2Linux MalwareTTPshttps://runtimerebel.com/blog/kimwolf-botnet-integration-impairs-i2p-network-infrastructurehttps://runtimerebel.com/blog/kimwolf-botnet-integration-impairs-i2p-network-infrastructureThe Kimwolf IoT botnet has weaponized the Invisible Internet Project (I2P) to harden its C2 infrastructure, leading to widespread peer instability and network-wide…Mon, 23 Feb 2026 08:21:39 GMTIoTBotnetI2PC2DDoSAnonymization