portbuster1337/ArachneC2

What it is

ArachneC2 is a public GitHub project (GPLv3) implementing a fully decentralized C2 framework over libp2p. Beyond the summary's capability list, the page exposes the concrete detection surface a defender would hunt on — transport choices, on-disk artifacts, and the specific evasion behavior — because there is no server or domain to block.

How it works

Operator and implants are equal peers. On first run the operator generates ~/.arachne/operator.key and ~/.arachne/operator.pub. Implants embed the operator's public key and a unique persistent keypair, so each implant keeps the same libp2p PeerID across restarts. Discovery is via DHT; commands ride per-implant PubSub topics; shell and port-forward use direct libp2p streams (PTY on Linux/macOS, hidden ConPTY on Windows). Messages are Protocol Buffers with deliberately opaque identifiers — package apb with Z-series message types, RPC service S, methods M0–M13.

Preconditions / Affected

Cross-platform (Linux, macOS, Windows), amd64/arm64. Notably, transport is WebSocket + TCP only — UDP/multicast-free, explicitly for sandbox compatibility, so purely UDP-focused network detection will miss it. Relay nodes see only encrypted bytes.

What to do

This is offensive tooling with no patch. Defensive/hunting angles the page hands you:

• Host artifacts: the operator directory ~/.arachne/ containing operator.key/operator.pub.
• Persistent PeerID per implant survives restarts — a stable pivot for tracking a known sample.
• Sandbox/VM evasion: the --antivm build runs 65+ checks (CPUID signatures, MAC prefixes, DMI/SMBIOS, PCI vendor IDs, registry keys, container detection) with VMAware-compatible scoring and exits cleanly when the score exceeds 50% — detonation environments must score below that threshold to observe behavior.
• Default hardening: implants ship UPX-packed (--upx default true), optionally garble-obfuscated.

Caveats

"No IPs to block" is real for takedown but not for endpoint detection — implants still run local processes, spawn shells, and touch ~/.arachne. Cover traffic masks beacon timing, not the existence of libp2p/WebSocket connectivity.