Rogue Botnet: Building and Understanding a Modular RAT w/C2 Framework
Share
Written By: Ek0m Savior
Instagram: @ek0ms.is.my.savior
Rogue is an educational command-and-control (C2) botnet framework built for ethical hackers, red team operators, and defensive researchers. Version 3.2 introduces cloud‑aware implants, provider‑specific payloads (AWS, Azure, GCP, Kubernetes), a full web administration panel, and destructive file encryption modules. This is not a toy; it’s a professional grade testing platform that exposes the inner workings of modern botnets.
The project prioritizes clarity over obfuscation. Every encrypted packet, every persistence mechanism, and every cloud detection routine is laid bare so you can learn, adapt, and defend.
>_ Disclaimer – Read Before Touching Code
Rogue is provided strictly for educational and authorized testing purposes.
The file encryption payload (fileransom.py) is destructive – it permanently removes original files during encryption.
Cloud exploitation modules (AWS/Azure/GCP credential harvesters, container escapes) must only be used on environments you own or have explicit written permission to test.
You assume full liability for misuse. The author grants no warranty and accepts no responsibility for data loss, legal consequences, or system damage.
>_ What’s New in v3.2 – Cloud Warfare
- Cloud‑Aware Implant – automatic detection of AWS, Azure, GCP, Docker, Kubernetes
- Cloud‑Specific Tactics – persistence and evasion adapted to each cloud provider
- Cloud Operations Tab – dedicated web interface for cloud exploitation
- 5 New Cloud Payloads – credential stealers for AWS/Azure/GCP, container escape, K8s secret stealer
- Advanced Payload Suite – process injection, advanced file hiding, cron persistence, competitor cleaner
- File Encryption Payload – AES‑256 encryption/decryption (destructive)
-
Compound Operations -
trigger_full_recon,trigger_harvest_all,trigger_clean_sweep -
Ngrok Integration – automatic tunnel for C2 behind NAT