I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix
It's cool to play around with tons of Linux machines I own and send them commands and retrieve stats out of them with custom scripts at the ease of uploading them as a "payload" like execute this on all these machines. However, there's a few projects that I actually debug and I usually just plug and play those open source projects.
I don't know if there's a risk in this, I usually host and test all these stuff with GCP instances and so far I've had no issues nor detected malicious activity besides "mine", just that BYOB project that installs a cryptominer but it's easy to deactivate it on the source and on the README you are told about this.
So here's the question.
What are the dangers of using this kind of open source projects as my C2 for my machines?
I've even consider using this in a company as a private "Teamviewer" or an alternative for remote assistance for helpdesk and whatever.
Is it a possible breach? Does that makes my instances vulnerable?
I can only think about a "single point of failure" that would end up in a DISASTER as it would compromise everything easily lol but what other risks would this involve?