Full Report
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's
Analysis Summary
# Tool/Technique: RedC2 4.0 (RedShell Linux Beacon)
## Overview
RedC2 4.0 is a sophisticated, AI-powered cross-platform Command and Control (C2) framework marketed for "red team" use but utilized by threat actors for malicious activities. It is designed with evasion as a core principle. In this specific campaign, the framework’s Linux implant, known as "RedShell," was delivered via trojanized npm packages that masquerade as legitimate calendar and streak-tracking utilities.
## Technical Details
- **Type:** Malware Family / C2 Framework
- **Platform:** Linux (RedShell), Windows, and macOS
- **Capabilities:** Surveillance, credential theft, payload loading, in-memory execution (BOFs, .NET, shellcode), and network pivoting.
- **First Seen:** August 2025 (Version 2.0); June 2026 (Version 4.0 with RedShell).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1620 - Reflective Code Loading]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0009 - Collection]**
- [T1555 - Credentials from Web Browsers]
- [T1552.004 - Unsecured Credentials: Private Keys]
- **[TA0011 - Command and Control]**
- [T1090.003 - Proxy: Multi-hop Proxy]
- [T1572 - Protocol Tunneling]
## Functionality
### Core Capabilities
- **Stealthy Loader:** The `dist/index.mjs` file in the npm packages acts as a trojan loader, executing the implant as a detached background process upon module import without requiring install hooks.
- **Interactive Shell:** Provides a full interactive shell via `/bin/sh` on Linux systems.
- **Data Harvesting:** Specialized commands to collect SSH keys, browser credentials, and basic system metadata.
- **File Management:** Full capabilities for file transfers, uploads, and downloads between the host and C2.
### Advanced Features
- **In-Memory Execution:** Supports executing ELF binaries in-memory on Linux and Beacon Object Files (BOFs) or .NET assemblies on Windows.
- **Evasion Suite:** Features UAC bypass, antivirus tampering (Windows), and detached process execution to avoid detection by monitoring tools.
- **Network Pivoting:** Built-in SOCKS5 proxying and host-to-host tunneling to facilitate lateral movement within a compromised network.
## Indicators of Compromise
- **File Names:**
- `math-core.bin`, `math-calc.bin`, `calc-math.dat`, `calc-cache.bin`, `calc.bin`, `calc-mapping.bin`
- **npm Packages:**
- `streak-metrics-math`, `kit-map-vim`, `streak-map-cache`, `streak-map-kit`, `map-streak-kit`, `streak-cache-map`, `streak-calc-metrics`, `streak-calc-math`, `streak-math-abz`, `streak-metricsaz`, `streak-math-metrics`, `streak-metricazbd`, `streak-metricsazb`, `streak-kit-map`
- **Network Indicators:**
- Red Offsec Clearnet Site (C2 purchase point) [defanged]: `redoffsec[.]com`
- **Behavioral Indicators:**
- Launching of detached background processes from Node.js `node_modules` directories.
- Unexpected outbound connections to unknown C2 servers immediately after an `npm install` or package import.
## Associated Threat Actors
- **MarlboroMan:** The threat actor/developer advertising the framework on Hack Forums and the "Red Offsec" website.
## Detection Methods
- **Signature-based detection:** Scanning for the specific RedShell binary (often hidden in `dist/` or `dist/internal/` folders of npm packages).
- **Behavioral detection:** Monitoring for Node.js processes spawning shell commands (`/bin/sh`) or marking non-standard binary files as executable (`chmod +x`).
- **Supply Chain Analysis:** Auditing the dependency graph for "transitive" imports of the 14 identified malicious packages.
## Mitigation Strategies
- **Dependency Pinning:** Use `package-lock.json` and verify checksums of all third-party libraries.
- **Software Composition Analysis (SCA):** Employ tools to scan `node_modules` for known malicious packages or suspicious binaries.
- **Least Privilege:** Run npm installs and application processes in restricted environments (containers/sandboxes) to limit the impact of a backgrounded implant.
- **Network Filtering:** Block outbound traffic to unverified or newly registered domains from production servers.
## Related Tools/Techniques
- **Cobalt Strike:** Similar functionality regarding Beacons and BOF execution.
- **Sliver / Havoc C2:** Open-source frameworks often compared to RedC2 for their cross-platform capabilities and evasion techniques.