Villain: The Open-Source C2 That Makes Reverse Shells Behave

Villain is an open-source command-and-control and backdoor framework for managing and enhancing reverse shells, built by Panagiotis Chartas (“t3l3machus”). Its stated purpose is authorized penetration testing, red-team work and CTF use: it handles multiple concurrent reverse shells, makes them more stable, and federates sessions across cooperating instances. It is dual-use because the same session-management, payload-generation and HTTP-beacon capabilities serve an intruder on an unauthorized host, and its inclusion in Kali Linux lowers the barrier to adoption. No named criminal or APT campaign has been publicly attributed specifically to Villain — treat it as a widely available dual-use capability rather than a campaign-proven threat.

Overview

Villain is written primarily in Python, generates PowerShell and shell payloads, and is distributed through GitHub and Kali. It integrates the author’s HoaxShell project, which uses ordinary HTTP and HTTPS request-and-response as the C2 channel — traffic that blends with web browsing and evades controls tuned for raw TCP shells. The author notes the inter-instance encryption is intentionally modest, since the tool targets pentest use.

Capabilities

• Manages TCP-socket shells and HoaxShell HTTP beacons simultaneously, with payload generation from templates for Windows and Linux. T1071.001 T1059.001
• A “Session Defender” that checks operator commands for mistakes, try/catch-wrapped PowerShell for reliability, and automatic upgrade to a fully interactive Windows shell. T1059.004
• Built-in HTTP file upload and fileless script injection into live sessions. T1105
• Multiplayer mode: multiple instances federate and share sessions, each acting as an encrypted proxy. T1572

MITRE ATT&CK Mapping

Detection & Mitigation

• Enable PowerShell script-block and module logging and AMSI; alert on encoded commands and long-lived outbound HTTP loops with small request bodies from powershell.exe, especially when spawned by Office or script interpreters.
• Apply egress filtering through an authenticated web proxy and flag unknown destinations receiving regular small-body HTTP beacons.
• Hunt for the default handler ports on internal hosts and apply application control to constrain unsigned PowerShell execution.