RedC2 4.0: the AI-Powered C2 Framework Hiding in Your npm Dependencies

The interesting part of the RedC2 4.0 campaign is not the fourteen malicious npm packages, or the Linux implant they drop, or even that it exfiltrates SSH keys and browser credentials. It is a feature called Red Agent: an LLM-backed layer inside the command-and-control framework that takes an operator's plain-English intent — "dump credentials," "find the databases" — and turns it into an ordered chain of beacon commands. The tradecraft used to be the barrier to entry. Now it costs $99.99 on a forum, and the framework writes the commands for you.

On August 20, 2026, TrendAI (Trend Micro's research arm) published its analysis of a set of trojanized npm packages delivering an AI-powered Linux implant it calls RedC2 4.0, with follow-on coverage from The Hacker News the next day. Researcher Aliakbar Zahravi traced the packages back to a commercial C2 framework advertised on Hack Forums since 2025. This is what the commoditization of offensive AI actually looks like in the wild — not a lab demo, a product with a price tag.

The delivery: one transitive npm import is enough

The fourteen packages masquerade as calendar and streak-tracking utilities — streak-metrics-math, kit-map-vim, streak-map-cache, and eleven near-identical siblings. They are not empty shells. Each one re-exports the real date-helper functions it advertises, so it works exactly as a developer expects. That is the point: a package that does its job draws no attention.

Underneath, a bundled binary sits disguised as a "native math accelerator," with names that vary across packages — math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin. When the module loads, it locates that binary, marks it executable, and launches it as a detached background process.

Note what is not required: no postinstall hook, no exported function you have to call. From TrendAI's analysis:

A single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.

That sentence is the whole threat model. You do not have to npm install streak-metrics-math. You have to install anything, anywhere in your tree, that eventually pulls it in — a fourth-order dependency of a build tool you have never heard of. The blast radius is the entire graph, and postinstall-blocking policies (npm install --ignore-scripts, the default many hardened CI pipelines now enforce) do nothing here, because there is no install script to block. The payload fires at require() time.

RedShell: an evasion-first implant with a shopping list

The Linux payload, RedShell, is a full-featured beacon. TrendAI documents the capability set:

• Reconnaissance — sysinfo, whoami, ps, netstat, ifconfig
• Credential theft — SSH private keys and browser credential stores
• Discovery — database enumeration across the host
• Exfiltration — file transfer and bulk staging out
• Fileless execution — ELF via memfd, shellcode via mmap (nothing touches disk)
• Pivoting — SOCKS5 proxying, TCP port forwarding, cross-network tunneling
• Persistence — cron @reboot entries, ~/.bashrc edits, user-level systemd services, XDG autostart, double-fork daemonization

The Windows and macOS variants add UAC bypass, AV/EDR tampering, WMI/SMB lateral movement, and JXA execution on macOS. The framework's forum listing describes it in two words: "built for evasion." That is not marketing. Fileless execution, endpoint-tooling tampering, and a beacon that speaks TLS mean the endpoint is the worst place to try to catch this. By design, the artifacts that AV and EDR key on are either never written to disk or actively removed.

That leaves one surface the implant cannot hide from: the network.

The C2 that has to talk to the wire

An implant built for endpoint evasion still has to reach its controller, and RedShell's traffic pattern is where it stops being invisible. TrendAI's IOCs lay the channel bare:

Channel	Port	Purpose
TLS command channel	8792	Beacon check-in and command delivery
File download	8888	Second-stage / tool ingress
Exfiltration	8060	Bulk data staging out

Primary C2 is hardcoded at 217.60.77.63, with api.ipify.org used for external-IP discovery and litterbox.catbox.moe as a public file host for staging. The mapped MITRE ATT&CK techniques read like a network-detection checklist: T1071 (application-layer protocol), T1105 (ingress tool transfer), T1570 (lateral tool transfer), T1041 (exfiltration over C2), and T1021 (remote services — SSH/SMB/WMI).

A beacon that checks in on a fixed TLS port to a never-before-seen ASN, opens a SOCKS5 tunnel, and then stages a sustained outbound transfer on a different port produces a behavioral signature that has nothing to do with the binary's hash. You cannot polymorph your way out of "this host, which historically only pulls packages, is now holding a long-lived encrypted session to an IP nobody in the environment has ever contacted, and pushing volume out on port 8060."

Why "the framework writes the commands" changes the math

RedC2 is not the first commodity C2 — Cobalt Strike clones and Mythic forks have been rented for years. What is new is the Red Agent layer, exposed via an /ra interface, that collapses the skill gap. Historically, the thing that limited a low-tier operator was not access to tooling; it was knowing what to run in what order once you had a shell. Red Agent removes that. "Dump credentials and find the databases" becomes an executable, multi-stage command chain without the operator understanding a single underlying technique.

This is the same trend line researchers flagged all year: LLM-assisted offense is moving from capability demos to production tooling. The npm delivery channel makes it worse, because the supply-chain surface is already at record volume. By one industry count, cumulative malicious npm packages passed 1.2 million in 2026 — roughly a 75% year-over-year jump — with over 99% of open-source malware landing on npm specifically. A cheap, AI-driven C2 riding the busiest malware-distribution channel in software is not an edge case; it is the median 2027 incident, arriving early.

Remediation

There is no CVE and no patch here — this is a malware campaign, so the runbook is detection, eradication, and hardening, not "upgrade to version X." Ground everything below in the TrendAI IOC set.

1. Am I affected? — audit the dependency graph, not just direct deps.

# Any of the 14 known packages, direct OR transitive:
npm ls streak-metrics-math kit-map-vim streak-map-cache streak-map-kit \
       map-streak-kit streak-cache-map streak-calc-metrics streak-calc-math \
       streak-math-abz streak-metricsaz streak-math-metrics streak-metricazbd \
       streak-metricsazb streak-kit-map 2>/dev/null

# Hunt the dropped binary by name on any Linux build host / dev laptop:
find / -type f \( -name 'math-core.bin' -o -name 'math-calc.bin' \
  -o -name 'calc-math.dat' -o -name 'calc-cache.bin' -o -name 'calc.bin' \
  -o -name 'calc-mapping.bin' \) 2>/dev/null

# Confirm by hash:
# SHA-256 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466

2. Can't rebuild everything right now? — compensating controls.

• Block egress to 217.60.77.63 and to ports 8792/8888/8060 at the firewall; alert on any host initiating them.
• Treat outbound connections to litterbox.catbox.moe from servers or CI runners as an incident, not noise.
• Enforce --ignore-scripts in CI knowing it is insufficient here — RedShell fires at import time, so pair it with an egress-deny default on build runners.

3. Hunt for compromise (map to ATT&CK).

• T1071 / T1041 — long-lived TLS sessions to unfamiliar ASNs, and sustained outbound volume from hosts that historically only ingest.
• T1547 — new cron @reboot entries, unexpected ~/.bashrc additions, unfamiliar user-level systemd units, new XDG autostart .desktop files.
• T1105 / T1570 — SOCKS5 listeners and port-forwards you did not create; ss -tlnp for unexpected local proxies.
• T1021 — SSH/SMB/WMI activity originating from a build host that has no business doing lateral movement.

4. Eradicate and verify.

1. Isolate the host from the network before killing the process (so the operator cannot react).
2. Kill the detached daemon and remove every persistence artifact from step 3.
3. Rotate what it could have taken — SSH private keys, browser-stored credentials, any secret readable by the compromised build identity, and cloud tokens minted on that runner.
4. Rebuild from a clean image. A fileless implant leaves little on disk; do not trust a "cleaned" host.
5. Re-verify egress: no beacon should re-establish to the C2 ports after remediation.

Where Zero Hunt fits

The defining property of RedC2 is that it is engineered to be silent on the endpoint — fileless execution, EDR tampering, a beacon that only shows itself on the wire. That is precisely the case Zero Hunt's AI Traffic Analysis was built for. Our proprietary deep-learning model runs four parallel inference heads — suspicious traffic, malware classification, attack-type identification, and application fingerprinting — trained on billions of PCAP sequences and running locally on the appliance GPU at 2.7+ Gbit/s. A RedShell beacon's fixed-port TLS check-in to a never-seen ASN, its SOCKS5 tunnel, and its port-8060 exfiltration burst are behavioral signatures the model flags while the session is live — no hash, no signature, no morning-after SIEM digest required. Against an implant designed to defeat the endpoint, the network is the detection surface, and it is watched in real time.

The second half of the problem is offensive: RedC2's Red Agent is a low-grade version of exactly the technique Zero Hunt runs at production quality. Our 10-agent AI swarm generates per-target exploit chains from a local LLM — never pulled from a public repo — and every skill is backtested in the AI Gym before it touches a customer environment. Pointed at your own estate, that engine surfaces the transitive-import-at-require-time delivery path, the exposed build-runner egress, and the credential blast radius before a $99 framework and its AI operator find them for you. Continuous, change-triggered campaigns re-run the moment a new dependency lands, and every finding is ECDSA-signed for the audit trail. When offensive AI becomes a commodity, the only durable answer is defensive AI that got there first — on your own hardware, with no data leaving the building.