s3n4t0r-0x0/bear-c2The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a dashboard you control, and it gets whatever response you choose in return.
BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundation for red team operations and adversary emulation drawing from related simulation research in the APT Attack Simulation Repository. It supports defense evasion techniques and multiple encryption options for accurate representation of real world intrusion scenarios.
[!CAUTION] It's essential to note that this project is for educational and research purposes only, and any unauthorized use of it could lead to legal consequences.
git clone https://github.com/S3N4T0R-0X0/BEAR-C2.git && cd BEAR-C2
chmod +x Makefile && ./Makefile
./BEAR-C2
Accurately replicating APT techniques requires a flexible environment capable of mimicking connection protocols, encryption methods, exfiltration techniques, and C2 Channels/Profiles used in modern intrusions. However, achieving this level of precision has always been a challenge.
Every time an operator needs to test a specific encryption scheme with a particular exfiltration profile, a separate C2 script must be built to match the attack scenario. For example, one simulation might require AES encryption with OneDrive exfiltration, while another might need a different encryption method combined with Dropbox exfiltration to reflect the techniques observed in real world attacks. This lack of flexibility makes the process inefficient and time consuming.
This is why BEAR C2 was developed to provide adversary simulation with full customization through the new listener, allowing seamless configuration of connection protocols, encryption, exfiltration, and automated loading techniques. This ensures that simulations can accurately reflect real APT intrusions without the need to build custom scripts for every scenario.
payload generator of BEAR-C2. It automatically builds customized payloads / beacons according to the selected listener configuration, supporting Payload Types (EXE, DLL, BIN, HEX), Network Protocols (DoH, HTTPS, HTTP, QUIC, Reverse TCP), and Encryption types (AES, XOR, RC4, DES, ChaCha20, RSA, or none). The Auto Fills button opens a listener selector window that lists all previously configured listeners from the Listeners Table. When you select a listener, Tactical Load automatically populates the Listener Name, Operator Address + Port, Network Protocol, Encryption type + key, Beacon Auth ID, and URI path. This allows operators to quickly generate matching payloads without manually re-entering listener details.
The Listeners Table provides a centralized overview of all active and configured C2 listeners. It displays essential details such as listener name, address, network protocol, encryption method, exfiltration profile, and current status (Active or Stopped/Disconnected). From this interface, operators can start, stop, rename, or remove listeners with ease. It also offers quick access to encryption keys and authentication IDs for managing beacon communication. This table serves as the command hub for orchestrating and monitoring your C2 infrastructure.
⚠️ NOTE: This project is under active development. Features are continuously added and improved.
| Feature | Description |
|---|---|
| Multi-Protocol Listeners | DoH, HTTPS, HTTP, QUIC, Reverse TCP |
| Per-Listener Encryption | AES, XOR, RC4, DES, ChaCha20, RSA |
| Exfiltration Profiles | Google Drive, OneDrive, Dropbox |
| Integrated C2 Channels | Integrated Telegram, Discord C2 communication channel |
| Proxy Support | SOCKS4, SOCKS4a, and SOCKS5 proxy and redirector support |
| Dynamic Domain Generation Algorithm | DGA support for resilient infrastructure simulation |
| JA3S Fingerprinting | Customizable JA3S fingerprints for traffic simulation and network profile tuning |
| Malleable C2 Profiles | Support for community Malleable C2 profiles for flexible network traffic simulation |
Configure per-session exfiltration settings for supported cloud storage providers such as Google Drive, OneDrive, and Dropbox. The Exfiltration Profile interface allows you to define API access tokens and destination folder paths, enabling you to customize data collection workflows for each session. Each session can use its own exfiltration profile, making it easy to route collected data to different cloud storage providers or destinations depending on the operation.
The Telegram communication layer uses a Telegram bot as the intermediary between the C2 server and the payload. The C2 server authenticates to the Telegram account using the configured API ID, API Hash, and Phone Number, then connects to the previously created Telegram bot through that account
The bot's Bot Token is embedded in the payload, allowing the payload to communicate with the bot through the Telegram API. Commands are sent from the C2 server to the bot, and the bot forwards them to the payload, which executes the received tasking and returns the results through the same communication path. This creates a bidirectional command and control channel using Telegram as the communication layer.
Open @BotFather in Telegram and create a new bot using /newbot.