BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundation for red team operations and adversary emulation drawing from related simulation research in the APT Attack Simulation Repository. It supports defense evasion techniques and multiple encryption options for accurate representation of real world intrusion scenarios.
Caution
It's essential to note that this project is for educational and research purposes only, and any unauthorized use of it could lead to legal consequences.
git clone https://github.com/S3N4T0R-0X0/BEAR-C2.git
cd BEAR-C2
chmod +x requirements.sh && ./requirements.sh
./BEAR-C2Accurately replicating APT techniques requires a flexible environment capable of mimicking connection protocols, encryption methods, exfiltration techniques, and C2 Channels/Profiles used in modern intrusions. However, achieving this level of precision has always been a challenge.
Every time an operator needs to test a specific encryption scheme with a particular exfiltration profile, a separate C2 script must be built to match the attack scenario. For example, one simulation might require AES encryption with OneDrive exfiltration, while another might need a different encryption method combined with Dropbox exfiltration to reflect the techniques observed in real world attacks. This lack of flexibility makes the process inefficient and time consuming.
This is why BEAR C2 was developed to provide adversary simulation with full customization through the new listener, allowing seamless configuration of connection protocols, encryption, exfiltration, and automated loading techniques. This ensures that simulations can accurately reflect real APT intrusions without the need to build custom scripts for every scenario.
The Listeners Table provides a centralized overview of all active and configured C2 listeners. It displays essential details such as listener name, address, network protocol, encryption method, exfiltration profile, and current status (Active or Stopped/Disconnected). From this interface, operators can start, stop, rename, or remove listeners with ease. It also offers quick access to encryption keys and authentication IDs for managing beacon communication. This table serves as the command hub for orchestrating and monitoring your C2 infrastructure.
This version features a full GUI that streamlines adversary simulation operations through centralized listener management, real-time session tracking, customizable communication profiles, integrated exfiltration workflows, and flexible operator controls for efficient engagement management.
⚠️ NOTE: This project is under active development. Features are continuously added and improved.
| Feature | Description |
|---|---|
| Multi-Protocol Listeners | DoH, HTTPS, HTTP, QUIC, Reverse TCP |
| Per-Listener Encryption | AES, XOR, RC4, DES, ChaCha20, RSA |
| Exfiltration Profiles | Google Drive, OneDrive, Dropbox |
| Integrated C2 Channels | Integrated Telegram, Discord C2 communication channel |
| Proxy Support | SOCKS4, SOCKS4a, and SOCKS5 proxy and redirector support |
| Dynamic Domain Generation Algorithm | DGA support for resilient infrastructure simulation |
| JA3S Fingerprinting | Customizable JA3S fingerprints for traffic simulation and network profile tuning |
| Malleable C2 Profiles | Support for community Malleable C2 profiles for flexible network traffic simulation |
| Stagers & Loaders | Automated stager and loader techniques designed for APTs adversary simulation |
| Integrated Tooling | Built-in script obfuscator, phishing toolkit, and file hosting |
| TLS Certificate Generation | Self-signed TLS certificates mimicking trusted vendors |
| HTTP Customization | Base64 URL encoding and custom HTTP headers for both client and server communication |
| Real-time Session Manager | Live status tracking, session monitoring, and real‑time update capabilities |
| Custom Naming & URI Paths | User‑defined campaign names and configurable URI paths for operational flexibility |
| Reconnect & Timeout Controls | Configurable reconnect delays and adjustable timeout thresholds per session |
| Authentication Identifiers | Unique authentication tokens with built‑in expiration controls for enhanced security |
| Session Hardening Utilities | History cleaner, session limiter, and authentication timeout management for active sessions |
Configure per-session exfiltration settings for supported cloud storage providers such as Google Drive, OneDrive, and Dropbox. The Exfiltration Profile interface allows you to define API access tokens and destination folder paths, enabling you to customize data collection workflows for each session. Each session can use its own exfiltration profile, making it easy to route collected data to different cloud storage providers or destinations depending on the operation.
The Telegram communication layer uses a Telegram bot as the intermediary between the C2 server and the payload. The C2 server authenticates to the Telegram account using the configured API ID, API Hash, and Phone Number, then connects to the previously created Telegram bot through that account
The bot's Bot Token is embedded in the payload, allowing the payload to communicate with the bot through the Telegram API. Commands are sent from the C2 server to the bot, and the bot forwards them to the payload, which executes the received tasking and returns the results through the same communication path. This creates a bidirectional command and control channel using Telegram as the communication layer.
This stage replaces the traditional command and control communication channel with a Discord-based communication layer using the Discord Gateway API. Instead of relying on dedicated servers, fixed IP addresses, or custom domains, operators communicate with the simulated implant through a private Discord channel.
The Discord communication layer uses two Discord bots connected through the same Discord channel. One bot is connected to the C2 server, while the second bot is assigned to the payload. The two bots communicate through the shared Discord channel, allowing tasking and communication between the C2 server and payload through Discord.
Since Discord does not allow bots to directly communicate with other bots, using a shared channel provides the communication path between the two sides.
Simulate spear-phishing campaigns through a dedicated interface for configuring and managing phishing scenarios during authorized adversary simulation exercises. The module provides campaign controls such as victim submission limits, configurable phishing parameters, and session management, allowing operators to control campaign behavior and evaluate user interaction with simulated phishing scenarios. It is designed to support controlled phishing assessments while providing operators with greater visibility and control over campaign execution.
Host and distribute files through a dedicated Host File interface with configurable server settings and automated file delivery. Hosted files are automatically loaded when accessed, without requiring user interaction or a manual download prompt. The interface provides centralized file hosting and delivery management for controlled adversary simulation and authorized security testing workflows.
The Script Obfuscator provides a comprehensive obfuscation engine supporting PS1, BAT, HTML, VBS, JS, and PY payloads with multiple configurable obfuscation layers. It includes variable and function renaming, string encryption, junk code insertion, multi-layer obfuscation, anti-debugging techniques, and XOR-based payload encryption. These features increase analysis complexity, reduce script readability, and make reverse engineering significantly more difficult while helping payloads better withstand static analysis.
The complete list of APT groups simulated by BEAR-C2 throughout its development
 |
 |
 |
 |
| Telegram | Twitter/X |