14 npm Packages Drop RedC2 4.0 Linux Backdoor: AI-Assisted C2

Cybersecurity researchers have found 14 trojanized npm packages that can secretly install a Linux backdoor. These packages appear to be legitimate calendar and streak utilities. Here's the thing: they drop an AI-powered Linux implant called RedC2 4.0. Trend Micro's enterprise cybersecurity business, TrendAI, reports that when a module loads, it launches a bundled binary as a detached background process. No special function call is needed; a simple import is enough to execute the malicious code. The packages are functional, offering their promised features. However, they also contain code designed to install a Linux backdoor. This backdoor is framed as a native math accelerator. The file names vary, like math-core.bin or calc.bin. These files contain the RedShell Linux beacon for RedC2 4.0. This beacon communicates with a remote server to enable post-exploitation activities on a compromised host. RedC2 4.0 is marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux. It offers surveillance, credential theft, and payload loading. The RedShell Linux beacon, once deployed, provides an interactive shell. This discovery highlights the ongoing threat of malicious software hidden within seemingly useful tools.