building-c2-redirector-infrastructure

SUSPICIOUS: the skill is internally coherent, but its purpose is to help an agent build covert C2 redirector infrastructure and evade analysis. Install sources are mostly legitimate, yet the offensive capability, traffic concealment, firewall/proxy changes, and disabled TLS verification make this a high-risk skill rather than benign documentation.

This fragment provides deployment-ready infrastructure to support command-and-control: it conditionally proxies matching HTTP requests (User-Agent + URI patterns) to a C2 “team server,” diverts other traffic to a decoy via HTTP 302, disables backend TLS certificate verification, and optionally forwards/redirects TCP/443 traffic at the network layer (socat/iptables) to the same backend. It also references tooling to generate the routing rules from a Cobalt Strike malleable profile, strongly indicating adversary intent. Treat as extremely high security risk for any software supply-chain context.

This code is a generator/validator for an nginx redirector configuration tailored to proxy/handle attacker-controlled “C2” URI patterns to a teamserver backend while diverting non-C2 traffic to a decoy, using an “implant” User-Agent criterion. It includes live probing logic with TLS verification disabled to confirm redirect behavior. Even though the actual NGINX_TEMPLATE content is not present in the snippet, the implemented data flows and operational checks strongly indicate malicious C2 support/deception tooling rather than legitimate functionality.

The provided material contains no executable code—only adversary-oriented documentation describing how to build/operate C2 redirector infrastructure (proxy/CDN, domain fronting, encrypted web-protocol tunneling). While this strongly increases the likelihood that the package is related to offensive C2 concepts, the excerpt does not demonstrate any actual runtime malware behavior. Additional module files are required to confirm whether the dependency performs malicious actions beyond documentation.