Third-party C3 channels
Synchronises control content over public code-hosting and paste services — no dedicated C2 host to stand up or burn.
← Store · // product
Arcticfox C3.
An async Rust command-and-control research framework that synchronises control content over ordinary web services — built to study, and to detect, covert channels that need no dedicated C2 host.
from $299support & customisation
⚠ Authorized use only — liability noticeThis is offensive-security software, published for lawful, authorized testing, research and education. You are solely responsible for how you use it, and you must hold explicit written authorization for any system you target. Provided as-is, without warranty; Cyber Sec accepts no liability for misuse.
// what it is
A C3 that hides in services you already trust
Arcticfox C3 is an asynchronous networking and codec framework in Rust that carries command-and-control content over services you already trust — public code-hosting and paste services — instead of a dedicated, attacker-owned server. It exists to study a whole class of covert channels, and to test whether your detection actually sees them.
The framework builds to an arcticfox-mcp binary, so it plugs straight into an AI-driven engagement — it is one of the C3 backends bundled with OpenHack — as well as running standalone for red-team and detection-validation work.
Treat it as a detection-validation instrument: stand it up in a lab or an authorized engagement, run traffic through the third-party channels, and confirm your monitoring flags the pattern — or find out that it doesn’t.
// capabilities
What it does
Purpose-built to make covert-channel behaviour reproducible, so your defence can be measured against it.
Async Rust core
A non-blocking networking and codec framework built for throughput and resilience.
Detection validation
Purpose-built to check whether your SOC and tooling actually catch covert-channel traffic in the wild.
MCP-ready
Builds an arcticfox-mcp binary — one of the C3 backends behind OpenHack, or run it entirely on its own.
// under the hood
Specifications
- Language
- Rust
- Binary
- arcticfox-mcp
- Channels
- Public code-hosting and paste services
- Integrates with
- OpenHack (as a C3 backend) and standalone use
- Intended use
- Authorized red-team and detection-engineering work only
// what you pay for
Support, not a paywall
What you pay for is the engineer who wrote it — setup, tuning and custom channels.
- Installation & configuration help — stood up in your environment, tuned to your setup and rules of engagement, not left as a README you fight alone.
- Bug fixes & improvements, prioritised for you — issues you hit move to the front of the queue.
- Customisation — new channels, integrations, or behaviour built for your targets and workflow. You keep the source.
- A direct line to the engineer who wrote it — no support tier relaying questions to a team you never meet.
// the fine print
Terms & liability
Authorized, lawful use only. This software is published for legitimate security testing, research and education. You alone are responsible for how you use it, and you must have explicit written authorization for any system, network or application you test.
No liability. To the maximum extent permitted by law, Cyber Sec and Stephan Botes accept no liability for any direct, indirect, incidental or consequential damage, data loss, service disruption or legal consequence arising from the use — or misuse — of this tool. Everything is provided as-is and without warranty of any kind.
What the fee buys. The price shown is a starting point and covers the engineer’s time — setup, fixes, improvements and customisation. Where the source is public, you are paying for the work and the time, not for access.
Questions about scope, licensing, or authorization? Get in touch first.