Thorn C2 is a previously undocumented malware family referenced in an open directory listing in Frankfurt. The listing exposed operator tooling, including an SSH key comment and a web-content fuzzer, indicating ongoing development or use by the threat actor.