c2 framework
Matrix C2
An operator-built, AI-co-authored controller for a Mirai-derived botnet. Named by 1 report, 4 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: Matrix C2 (operator-built; AI-co-authored). These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)
MAL_Python_Matrix_C2_Framework_Family, MAL_Discord_Bot_DDoSasService_Customer_Interface, MAL_Python_Persistent_Bot_DualChannel_CNC, MAL_Python_StealthAgent_AntiDebug_AntiVM_AI_Authored
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-014: DDoS-for-hire operator running an AI co-authored C2 framework over a Pandora-Mirai botnet
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.