OctoC2 — a GitHub-native C2 framework

OctoC2 leverages GitHub as both C2 server and exfiltration channel. Every operator command and beacon response travels exclusively through GitHub's public API using legitimate features.

Advantages: • Zero infrastructure — no servers, domains, or open ports required. • Strong OPSEC — network traffic resembles routine developer or CI/CD activity on GitHub. • High resilience — 11 covert channels with configurable priority and automatic fallback. • Robust encryption — end‑to‑end encryption with libsodium crypto_box (X25519 + XSalsa20-Poly1305). • Production-ready — GitHub App auth with rotating 1-hour tokens, encrypted runtime key delivery. • One‑command setup — an interactive wizard handles key generation, repository validation, configuration, and beacon agent build.

Compared to Havoc and Mythic, OctoC2 stands out by requiring no dedicated C2 infrastructure and relying exclusively on GitHub's native mechanisms. This design improves OPSEC but makes the tool dependent on API rate limits and potential GitHub behavior changes.

Tool: https://github.com/dstours/OctoC2