GitHub RadarRed team tool

S3N4T0R-0X0/BEAR-C2

BEAR-C2 is an adversary simulation and emulation framework built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. Primary language: Python. 594 stars.

Python594 stars128 forkspushed Sep 10, 2026NOASSERTION

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

BEAR-C2 Adversary Simulation Framework

--- ![Project Status]() ![verigen: 2.0](https://img.shields.io/badge/verigen-2.0-green?style=flat-square) ![Adversary Simulation]() ![TTPs]() ![APT Simulation]() ![MITRE ATT&CK]() ![Linux](https://img.shields.io/badge/Platform-Linux-black?style=flat-square)

BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundation for red team operations and adversary emulation drawing from related simulation research in the APT Attack Simulation Repository. It supports defense evasion techniques and multiple encryption options for accurate representation of real world intrusion scenarios.

---

[!CAUTION]

It's essential to note that this project is for educational and research purposes only, and any unauthorized use of it could lead to legal consequences.

🏗 Install dependencies and Usage:

git clone https://github.com/S3N4T0R-0X0/BEAR-C2.git && cd BEAR-C2

chmod +x requirements.sh && ./requirements.sh

./BEAR-C2

---

🧠 The Challenge with Adversary Simulation:

Accurately replicating APT techniques requires a flexible environment capable of mimicking connection protocols, encryption methods, exfiltration techniques, and C2 Channels/Profiles used in modern intrusions. However, achieving this level of precision has always been a challenge.

Every time an operator needs to test a specific encryption scheme with a particular exfiltration profile, a separate C2 script must be built to match the attack scenario. For example, one simulation might require AES encryption with OneDrive exfiltration, while another might need a different encryption method combined with Dropbox exfiltration to reflect the techniques observed in real world attacks. This lack of flexibility makes the process inefficient and time consuming.

This is why BEAR C2 was developed to provide adversary simulation with full customization through the new listener, allowing seamless configuration of connection protocols, encryption, exfiltration, and automated loading techniques. This ensures that simulations can accurately reflect real APT intrusions without the need to build custom scripts for every scenario.

Reaper Node Payload Samples

Reaper Node provides C++ payload samples /Stagers-Loaders/Reaper Node Samples/ that can be used as customizable templates for environments where a pre-generated payload is not required. The samples contain the core configuration fields required to establish communication with the corresponding Reaper Node instance.

Before compiling the payload, the required connection and transport parameters must be configured to match the Reaper Node configuration.

Payload Configuration

The payload configuration should provide input fields for the following parameters:

Authentication ID

The identifier used to associate the payload with the configured Reaper Node instance.

Server Host

The IP address or hostname of the Reaper Node endpoint.

Server Port

The network port exposed by the Reaper Node for the selected communication protocol.

Encryption Key

Required when the selected transport uses encryption. The value must match the encryption configuration used by the Reaper Node. If encryption is disabled, this field is not required.

User-Agent

The HTTP client identification value used when establishing the initial HTTP/HTTPS communication. The payload should use a User-Agent supported by the corresponding Reaper Node configuration.

The User-Agent does not need to be identical across different Reaper Node configurations. A payload can use any User-Agent defined as supported by the selected Reaper Node profile, as long as the resulting configuration is compatible with the server-side transport settings.

Example Configuration

The following example shows a sample HTTPS transport configuration with authentication, server addressing, encryption, and User-Agent parameters:

const string AUTH_ID = "YOUR_AUTH_ID";
const string SERVER_HOST = "YOUR_SERVER_HOST";
const int SERVER_PORT = YOUR_SERVER_PORT;
const string KEY = "YOUR_ENCRYPTION_KEY";
const string DEFAULT_USER_AGENT = "YOUR_USER_AGENT";
bool VERIFY_SSL = true;

This configuration represents an HTTPS transport with encryption enabled. The values shown above are placeholders and should be replaced with the parameters defined by the corresponding Reaper Node configuration.

The C++ sample is intended to provide a starting point for customization. Users can modify the configuration and transport-related parameters according to the Reaper Node profile they are testing, then compile the customized payload for their authorized simulation environment.

The Listeners Table provides a centralized overview of all active and configured C2 listeners. It displays essential details such as listener name, address, network protocol, encryption method, exfiltration profile, and current status (Active or Stopped/Disconnected). From this interface, operators can start, stop, rename, or remove listeners with ease. It also offers quick access to encryption keys and authentication IDs for managing beacon communication. This table serves as the command hub for orchestrating and monitoring your C2 infrastructure.

📋 What's New in This Version

This version features a full GUI that streamlines adversary simulation operations through centralized listener management, real-time session tracking, customizable communication profiles, integrated exfiltration workflows, and flexible operator controls for efficient engagement management.

⚠️ NOTE: This project is under active development. Features are continuously added and improved.

| Feature | Description | |----------|-------------| | Multi-Protocol Listeners | DoH, HTTPS, HTTP, QUIC, Reverse TCP | | Per-Listener Encryption | AES, XOR, RC4, DES, ChaCha20, RSA | | Exfiltration Profiles | Google Drive, OneDrive, Dropbox | | Integrated C2 Channels | Integrated Telegram, Discord C2 communication channel | | Proxy Support | SOCKS4, SOCKS4a, and SOCKS5 proxy and redirector support | | Dynamic Domain Generation Algorithm | DGA support for resilient infrastructure simulation | | JA3S Fingerprinting | Customizable JA3S fingerprints for traffic simulation and network profile tuning | | Malleable C2 Profiles | Support for community Malleable C2 profiles for flexible network traffic simulation | | Stagers & Loaders | Automated stager and loader techniques designed for APTs adversary simulation | | Integrated Tooling | Built-in script obfuscator, phishing toolkit, and file hosting | | TLS Certificate Generation | Self-signed TLS certificates mimicking trusted vendors | | HTTP Customization | Base64 URL encoding and custom HTTP headers for both client and server communication | | Real-time Session Manager | Live status tracking, session monitoring, and real‑time update capabilities | | Custom Naming & URI Paths | User‑defined campaign names and configurable URI paths for operational flexibility | | Reconnect & Timeout Controls | Configurable reconnect delays and adjustable timeout thresholds per session | | Authentication Identifiers | Unique authentication tokens with built‑in expiration controls for enhanced security | | Session Hardening Utilities | History cleaner, session limiter, and authentication timeout management for active sessions |

---

📤 Exfiltration Profiles

Configure per-session exfiltration settings for supported cloud storage providers such as Google Drive, OneDrive, and Dropbox. The Exfiltration Profile interface allows you to define API access tokens and destination folder paths, enabling you to customize data collection workflows for each session. Each session can use its own exfiltration profile, making it easy to route collected data to different cloud storage providers or destinations depending on the operation.

💬 Integrated C2 Channels

(Telegram-based Agent)

The Telegram communication layer uses a Telegram bot as the intermediary between the C2 server and the payload. The C2 server authenticates to the Telegram account using the configured API ID, API Hash, and Phone Number, then connects to the previously created Telegram bot through that account

The bot's Bot Token is embedded in the payload, allowing the payload to communicate with the bot through the Telegram API. Commands are sent from the C2 server to the bot, and the bot forwards them to the payload, which executes the received tasking and returns the results through the same communication path. This creates a bidirectional command and control channel using Telegram as the communication layer.

How to Use the Telegram Agent

1. Create the Telegram Bot

Open @BotFather in Telegram and create a new bot using /newbot.

Start @BotFather
Send /newbot
Provide a display name for the bot
Provide a unique username ending with bot
Copy the generated Bot Token

The Bot Token is required by the Telegram Agent to authenticate with the Telegram Bot API.

2. Generate Telegram API Credentials

Open the official Telegram API development portal and create a new application.

Generate the following credentials: https://my.telegram.org/apps

API ID
API Hash

These credentials are used by BEAR-C2 to authenticate the Telegram account used to manage the bot communication.

3. Configure the Telegram Payload

Open Telegram Agent.cpp and configure the Telegram communication settings.

The Bot Token generated by BotFather must be placed in `/Stagers-Loaders/C2 Channel Agent Samples/Telegram Agent.cpp` before compiling the payload.

<img width="898" height="122" alt="630235299-2a92081e-6158-4174-846e-e908e1074255" src="ht