Loading malware…
AdaptixC2 is an open-source post-exploitation command-and-control framework used both for legitimate red-team/adversarial emulation and in real-world intrusions. The content describes it as a Go-based teamserver with Beacon and Gopher agents for Windows, Linux, and macOS, supporting command execution, file transfer and exfiltration, process control, SOCKS4/5 proxying, port forwarding, Beacon Object Files, and multiple transports including HTTP/S, DNS/DoH, SMB named pipes, and raw TCP. Beacon payloads can be generated as EXEs, DLLs, service executables, and raw shellcode, and configurations are RC4-encrypted. Default unauthenticated HTTP responses expose distinctive headers such as "Server: AdaptixC2" and "Adaptix-Version: v1.2," and default 404 content includes "AdaptixC2 404," making some deployments identifiable via passive scanning. Reported default or observed network artifacts include URIs such as /updates/check.php, /api/v1/status, /content.html, and in one documented default configuration /uri.php.
The framework has been observed in multiple malicious campaigns. In July 2025 Akira ransomware intrusions, BumbleBee delivered an AdaptixC2 beacon by injecting shellcode into AdgNsy.exe, a renamed WAB.exe, establishing persistent C2 to 172.96.137[.]160:443. In those intrusions, AdaptixC2 supported follow-on reconnaissance, credential theft from NTDS.dit, Veeam, and LSASS, RDP and SSH-based lateral movement, persistence alongside RustDesk, and data exfiltration via FileZilla/SFTP before Akira deployment. In a May 2026 phishing intrusion, payloads were staged from cloudpre-005[.]online using payload.zip and stub.zip; binaries including ms-op.exe, stub1.exe, and payload.exe beaconed to 23[.]20[.]229[.]225:443 and 98[.]81[.]111[.]167:443 and used the static user agent "Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0." Unit 42 also documented early May 2025 cases where AdaptixC2 was deployed via Microsoft Teams/Quick Assist social engineering and PowerShell-based loaders using in-memory shellcode execution, DLL hijacking with msimg32.dll, startup-folder persistence, and a Run key named "Updater." One observed C2 in that reporting was tech-system[.]online over HTTPS on port 443 using POST requests to /endpoint/api and the X-App-Id parameter.
The content further links AdaptixC2 to diverse threat activity: Operation Dragon Weave used an AdaptixC2 agent named AZUREVEIL with Microsoft Azure Blob Storage dead-drop C2 against targets in the Czech Republic and Taiwan across government, research, academic, technology, and financial sectors; pro-Ukrainian hacktivist-linked campaigns associated with 4BID/Hakerskii Kit/C.A.S./Goffee deployed AdaptixC2 alongside Sliver, Havoc, Mythic Apollo, BlackSalt, and ransomware after ProxyShell exploitation of Exchange; GOLD ENCOUNTER/PayoutsKing used AdaptixC2 or OpenSSH to establish SSH backdoors; Cisco Talos observed AdaptixC2 deployed post-compromise on exploited Cisco SD-WAN infrastructure; Sophos reported a March 2026 fake Claude-themed malware sample culminating in AdaptixC2-related shellcode; and Ctrl-Alt-Intel reported AdaptixC2 use after exploitation of CVE-2026-41940 against Southeast Asian government, military, MSP, and hosting targets. Additional infrastructure and indicators directly mentioned in the content include 194[.]163[.]175[.]135:4445 and :31337 in Talos cluster activity, 2.26.229[.]254 serving AdaptixC2 payloads and listeners on ports 4433, 4455, and 7000, and default agent watermarks be4c0149 for Beacon and 904e5493 for Gopher.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An AdaptixC2 malware payload was also identified, indicating active command-and-control operations. Analysis of exposed payloads shows the attacker used AdaptixC2 for command and control, along with a PowerShell reverse shell.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent... The loader then decrypts and runs the main payload, an AdaptixC2 agent codenamed AZUREVEIL owing to the use of Microsoft Azure Blob Storage for command-and-control (C2).
The group has also used a DLL sideloading technique to launch the Havoc C2 post-exploitation framework, and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
83.142.209[.]11 is shown below, confirming ASN membership, TeamPCP attribution, and the AdaptixC2 malware classification.
The March sample is markedly different... the decryption of a .log file culminating in the execution of AdaptixC2-related shellcode. (AdaptixC2 is an open-source red-teaming framework that we’ve seen used in ransomware attacks...)
33 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor initiated execution via Windows Management Instrumentation (WMI). By using WMI to launch the binary, the threat actor ensured that AdgNsy.exe spawned under WmiPrvSE.exe .
The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom.
Analysis of the process telemetry revealed a series of living-off-the-land commands used to map the environment: Host/User Discovery: whoami , systeminfo , quser Domain/Network Reconnaissance: nltest , ping
Additionally, threat actors can modify and enhance the agent using custom obfuscation, anti-analysis and evasion techniques, making it a continuously evolving threat.
This fileless approach significantly reduces the attacker’s footprint on the system.
AdgNsy.exe (instance renommée de WAB.exe) ... win.exe ... ManageEngine_OpManager_64bit.exe (leurre légitime)
AdgNsy.exe (instance renommée de WAB.exe) est déployé et injecté avec le shellcode AdaptixC2
All Sliver instances uncovered during this investigation were configured to communicate with the C2 server at 185.221.153[.]121 over mTLS.
AdaptixC2 ... établissant un canal C2 persistant vers 172.96.137[.]160
AdaptixC2 supports the transmission of data and commands from C2 via both traditional DNS over UDP and DNS over HTTPS (DoH). This communication method enables the masking of the communication channel between the agent and the server.
171 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Post-compromise command-and-control framework/shellcode used for persistent access after initial infection, enabling continued operator control during the intrusion.
A command-and-control beacon/backdoor injected into a renamed legitimate Windows binary to establish persistent access, support internal reconnaissance, and enable lateral movement during the intrusion.
A command-and-control/backdoor framework used after initial access to support intrusion activity including post-compromise operations.
An open-source post-exploitation and adversarial emulation framework used here as an injected HTTP beacon inside a renamed WAB.exe process (AdgNsy.exe). It provided persistent command-and-control for discovery, internal scanning, and follow-on intrusion activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.