14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers at Trend Micro’s TrendAI have uncovered a set of 14 trojanized npm packages that masquerade as legitimate calendar and streak utilities but secretly deliver an AI-powered Linux backdoor called RedC2 4.0. The packages, including streak-metrics-math, kit-map-vim, and streak-map-cache, are fully functional but contain a hidden binary that executes upon module import, with no install hook required.

The malicious binary, named math-core.bin or similar, is a Linux beacon for the RedC2 4.0 command-and-control (C2) framework. RedC2 is marketed on cybercrime forums by a threat actor known as ‘MarlboroMan’ and is sold on a clearnet website called Red Offsec for $99.99. The framework supports Windows, macOS, and Linux, and includes features such as terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.

The Linux beacon provides an interactive shell via /bin/sh and exposes commands for system discovery, file operations, data collection (e.g., SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting. It communicates with a C2 server, sends a check-in message with system information, and enters a command-processing loop.

RedC2 also includes an LLM-driven component called Red Agent, which allows operators to orchestrate complex post-exploitation tasks using natural language commands. This AI-assisted capability lowers the barrier to entry for less skilled attackers.

The discovery follows a coordinated supply chain attack on three Rust crates (arrayref, internment, append-only-vec) that executed cross-platform malware during Cargo builds, with suspected links to North Korean threat actors. The findings highlight the growing trend of AI-integrated C2 frameworks distributed via open-source package repositories.