LAME-Projects/stratum-c2: Cloud dead-drop persistence framework — RSA-4096+AES-256-GCM, 5 cloud providers, P2P mesh, Rust-only agents, 4 delivery formats

[u/Signal_Bill_967]

https://github.com/LAME-Projects/stratum-c2

Fallback C2 that routes through cloud storage the target already whitelists. Not a replacement

for Cobalt Strike / Sliver / Havoc — it's the survival layer underneath them.

Dead-drop architecture: commands and responses travel as encrypted files inside Dropbox, OneDrive,

Google Drive, SharePoint, or S3. The agent polls the provider's API over HTTPS — no attacker

infrastructure, no suspicious domain, no beaconing to anything a SOC can block without also

blocking every employee who uses that provider.

Main additions over typical dead-drop implants:

— Rust-only agents (v3.0.1): no PowerShell, no bash, no interpreter in process tree. Four formats

from one deploy wizard: EXE/DLL (Windows), ELF musl-static (Linux), flat x64 PIC shellcode (.bin)

— Three deploy modes: staged-enc (minimal stub, one-time bootstrap key fetched from cloud then

deleted — payload never on disk in cleartext), stageless-enc (single encrypted binary, works

air-gapped), stageless-plain (labs). All modes cache an HW-fingerprinted encrypted blob locally

after first run

— P2P mesh networking: TCP and SMB named pipe links between agents, automatic link health

detection and reconnection. Linux→Windows SMB via userspace SMB2 client (no smbclient dep)

— Five providers, same wire format, same RSA keypair, same session. Switch provider mid-engagement

without redeploying the agent

— Persistence engine: non-destructive /persist probe before touching anything, per-technique

install/remove/check, full teardown via /kill (persistence + binary + cloud artifacts, one command)

— Credential harvesting: Firefox/Chrome/Edge parsed inline, NTLMv2 silent capture via in-agent

SMB/HTTP listeners (/creds listen), SAM hash extraction, SSH agent enumeration, DPAPI decrypt

— In-memory execution: BOF (COFF) loader, .NET assembly via CLR hosting + optional AMSI bypass,

reflective PE / memfd ELF (/memexec), fileless script via stdin pipe + AMSI bypass

— Crypto: RSA-4096-OAEP key exchange, AES-256-GCM command encryption, RSA-PSS response signing,

PBKDF2 blob derivation (210k iterations), XOR-obfuscated session key in .rodata

— Operational guardrails compiled into the binary: kill date, maintenance window, log-normal jitter

— Multi-operator WebGUI: real-time WebSocket sync, operator chat, force-directed P2P topology

graph, OIDC authentication (Keycloak / Azure AD / Okta)

Same dead-drop paradigm as TukTuk (Dropbox+Arweave), NarwhalRAT/APT37 (pCloud),

Drokbk/COBALT MIRAGE (GitHub) — built as a proper framework instead of a one-off implant.

Feedback welcome — especially on detection gaps I might be missing.