Full research report
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Executive assessment
The RedC2 4.0 campaign illustrates how commercially distributed C2 frameworks are being weaponised through npm supply chain attacks that circumvent standard safeguards. The core innovation is loader execution at import time rather than via lifecycle hooks, making --ignore-scripts ineffective and rendering any transitive dependency a potential attack vector for the millions of Node.js projects that do not audit indirect dependencies. RedShell's SOCKS5 and TCP forwarding capabilities make compromised developer machines and CI/CD runners particularly attractive as pivot points into otherwise air-gapped or internally accessible services. The Red Agent AI layer signals a market trend toward lowering the operator skill threshold for post-exploitation activity, broadening the buyer pool for commercial C2 tools. The suspected link between this npm campaign and North Korean-attributed Rust crate poisoning is unverified and should not be treated as established attribution without further evidence.
What happened
Between June and August 2026, 14 trojanized npm packages posing as calendar and streak utility libraries were published to the public registry. Each embedded a native Linux ELF binary (the RedShell implant, part of the commercially sold RedC2 4.0 framework) and a malicious module loader in dist/index.mjs that executes the binary as a detached background process on any import, including transitive ones. TrendAI Research identified and disclosed the campaign publicly around 21 August 2026. RedC2 4.0 was marketed by the actor 'MarlboroMan' on Hack Forums from approximately 1 June 2026 and sold via the Red Offsec marketplace for $99.99.
Affected scope
Any Node.js project or CI/CD research process that directly or transitively imported one of the 14 listed packages on a Linux host. The RedShell implant targets Linux; the broader RedC2 framework supports Windows and macOS. No specific victim organisations have been named publicly.
Technical assessment
The malicious loader in dist/index.mjs re-exports legitimate date-helper functionality while asynchronously writing and executing a bundled ELF binary, bypassing npm's --ignore-scripts safeguard because no lifecycle hook is involved. The binary establishes a TLS channel to a hardcoded C2 server using custom XOR/ROR1 obfuscation, supports interactive shell access, credential harvesting (SSH keys, browser data, databases), fileless in-memory ELF execution via memfd_create, and SOCKS5 proxy creation enabling operators to pivot into internal networks. The AI-assisted Red Agent component translates natural-language operator commands into beacon actions, lowering the skill threshold for post-exploitation activity.
Recommended defensive actions
- Audit package-lock.json and run npm ls to identify all 14 named packages across direct and transitive dependencies, then remove them immediately
- Block outbound connections to 217.60.77.63 on ports 8792, 8060, and 8888 at the network perimeter
- Hunt for the RedShell binary SHA-256 (4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466) across build hosts, CI/CD runners, and developer workstations
- Inspect cron jobs, ~/.bashrc, systemd unit files, and XDG autostart directories on affected Linux hosts for RedShell persistence artefacts
- Rotate all credentials and SSH keys accessible from any host on which the packages were imported
- Enforce software composition analysis tooling in CI pipelines to flag newly published packages from accounts with no prior publication history
Uncertainties and evidence gaps
- No victim organisations or confirmed post-compromise impact have been publicly disclosed; download counts and install telemetry for the malicious packages are not reported
- The THN article references suspected infrastructure overlaps between the concurrent Rust crate poisoning (arrayref, internment, append-only-vec) and prior North Korean-linked attacks, but no technical evidence for this attribution link was independently corroborated in the sources reviewed
- It is unclear whether the npm registry has formally removed all 14 packages or published a security advisory; no advisory URL could be verified
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation of specific victim organisations has been disclosed; the 14 malicious packages were live on the npm registry and fully functional, but no post-compromise victim telemetry has been reported publicly.
The investigation began with the THN article attributing the campaign to TrendAI Research. Fetching the primary source confirmed key technical detail, after which the original TrendAI blog was located and fetched directly, providing the authoritative IoC set. GBHackers independently corroborated the SOCKS5 pivoting and fileless execution claims. Attempts to directly verify the Hack Forums actor posting and a Socket.dev package analysis both returned HTTP 403, so MarlboroMan attribution is treated as credible but indirectly verified. A GitHub repository surfaced under the name 'RedC2' was fetched and confirmed to be an unrelated educational project, preventing false attribution.
- What does the primary press report state about this campaign?Fetched The Hacker News article to establish factual baselinethehackernews.com ↗
Confirmed 14 package names, RedShell binary filenames, C2 IP 217.60.77.63, MarlboroMan actor attribution, version timeline (v2.0 Aug 2025 through v4.1.3 Aug 2026), Red Agent AI component, and mention of a concurrent Rust crate campaign with unverified North Korea overlap
why THN was citing TrendAI Research as the originating source; establishes the event's confirmed factual baseline and directs research toward the primary report
- Where is the original TrendAI research and what IoCs does it provide?Searched for TrendAI Security blog on RedC2 Linux implant, then fetched the resulttrendaisecurity.com ↗
Full 14-package list and binary filenames confirmed; SHA-256 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466 confirmed; additional C2 ports 8060 (exfiltration) and 8888 (payload delivery) confirmed; persistence mechanisms enumerated; detection signatures Trojan.JS.REDSHELL.A and Backdoor.Linux.REDSHELL.A confirmed
why Primary source provides the highest-confidence IoC and technical data; establishes the evidence base from the team that discovered the campaign
- Does an independent source corroborate the SOCKS5 pivoting capability and defensive guidance?Fetched GBHackers article on RedC2 4.0 Linux implantgbhackers.com ↗
Independently confirmed SOCKS5 proxy command, TCP port forwarding, fileless ELF execution via memfd_create, and TLS certificate validation bypass; defensive recommendations aligned with TrendAI findings
why A second independent domain confirming technical specifics raises confidence; GBHackers corroborated without simply republishing the press release
- Can the MarlboroMan Hack Forums listing be directly verified?Attempted to fetch Hack Forums thread tid=6318418hackforums.net ↗
HTTP 403 returned; content not accessible
why Attribution to MarlboroMan is referenced consistently across multiple independent reporting sources; treated as credible but indirectly verified; noted as an uncertainty
- Do any package-security tools provide independent analysis of the named packages?Attempted to fetch Socket.dev analysis of streak-math-metricssocket.dev ↗
HTTP 403 returned; content not accessible
why A formal third-party registry advisory would strengthen the confidence rating; its absence means npm takedown status remains an open uncertainty
- Is the GitHub 'compr00t/RedC2' repository the commercial RedC2 4.0 framework?Fetched GitHub repository README to determine if this is the same productgithub.com ↗
Unrelated educational .NET/C# project for a Zero Point Security course; no Linux implant, no AI features, no commercial distribution
why Confirming this is a different product prevents false attribution and erroneous cross-referencing in the report
PoC & exploit code1
Primary technical report with full IoC set, binary hashes, C2 infrastructure, and detection signatures
Analysis & research2
Primary press coverage summarising TrendAI findings with full package list and campaign context
Independent technical analysis corroborating SOCKS5 pivoting capability, fileless execution, and defensive guidance