Loading malware…
AdaptixC2 is an open-source command-and-control and post-exploitation framework whose agents are used as remote-access implants in malicious intrusions. Its architecture includes listeners and beacon agents that communicate with operator-controlled infrastructure. Observed deployments run on Windows and in Linux environments, including concealed Alpine Linux virtual machines used by ransomware operators.
AdaptixC2 supports hands-on post-exploitation activity, including host and Active Directory reconnaissance, credential dumping, access-token duplication, and lateral movement. In an education-sector intrusion originating from exploitation of PaperCut MF, attackers embedded an AdaptixC2 implant in a trojanized Microsoft Copilot executable, relaunched it under a domain-privileged service account, and deployed it to a domain controller. Customized implants have used encrypted configuration and communications, control-flow obfuscation, API hashing, and dynamic import resolution to hinder analysis. These modifications are deployment-specific rather than universal framework characteristics.
Delivery mechanisms include phishing emails, fake certificate installers, ClickFix-derived footholds, malicious installers, and loaders such as TriBack Loader and Cruciferra. An AdaptixC2 variant has also been delivered through a compromised software package. Observed users include SLIME88, the China-nexus JadeProx intrusion cluster, and Payouts King ransomware operators. Deployments span education, technology, financial technology, and energy targets; use of this publicly available framework alone does not establish threat-actor attribution.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SLIME88 has targeted Taiwan’s energy sector through phishing emails and fake certificate installer, attempting to deploy backdoor programs such as AdaptixC2 and CobaltStrike.
The adversary deployed a standard AdaptixC2 framework, including stock listeners, beacon agents, and the base demo agent.
The guest is Alpine Linux 3.22.0 carrying AdaptixC2, Chisel, Rclone, BusyBox and a custom WireGuard traffic obfuscator, and on boot it opens a reverse SSH tunnel out through AdaptixC2 or OpenSSH.
Stage 5: RAT Analysis The final Remote Access Trojan (RAT) is fully import-less. It dynamically resolves both API imports and strings at runtime... This RAT is a variant of AdaptixC2. The AdaptixC2 framework identifies its C2 traffic through the custom HTTP header X-Content-ID, which is part of its default communication profile.
Two observed variants deliver AdaptixC2... Debugging the final payload leads us to AdaptixC2 beacon, an open-source post-exploitation framework.
A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent... The loader then decrypts and runs the main payload, an AdaptixC2 agent codenamed AZUREVEIL owing to the use of Microsoft Azure Blob Storage for command-and-control (C2).
+2 more in the app. View in Mallory
38 distinct techniques documented for this family, organized by ATT&CK tactic.
k0t has been observed using Namecheap to acquire domains for their campaigns.
k0t have been observed utilising BitLaunch (AS399629), an anonymous VPS provider that accepts cryptocurrency to acquire servers used in their operations.
Threat actors exploited an internet-facing PaperCut MF print server running a vulnerable version of PaperCut MF, using SQL injection through the card/ID lookup field.
PowerShell scripts were used extensively to result in installation of AdaptixC2 agent/beacon.
Several supported commands allow arbitrary JavaScript to be evaluated in-memory, a capability the threat actors used to download and execute an AdaptixC2 implant.
Attackers obtained initial access through the ClickFix social engineering technique, using fake CAPTCHA or error-fix prompts that instruct users to copy and paste a command into Windows Run or Windows Terminal.
Threat actors executed the implant on the domain controller by hijacking the built-in PlugPlay service's binary path and starting the service with sc.exe.
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
The in-memory Java loader deployed a web shell; threat actors issued commands to it through the X-Quad HTTP header.
It then temporarily changed the Windows PlugPlay service configuration to start the payload, stopped the service after launch, and restored the legitimate service path.
The evasion loader... employs standard evasion techniques: AES-128-CBC decryption via hardcoded keys/IVs, AMSI/ETW patching, indirect syscalls, anti-sandbox/debugging mechanisms, process injection, and automated self-deletion.
They duplicated the token of a process running as a domain-privileged service account and used it to respawn the implant via CreateProcessAsUser.
They identified a process running under a domain-privileged service account, copied its access token, and relaunched the implant with that account's rights.
It then temporarily changed the Windows PlugPlay service configuration to start the payload, stopped the service after launch, and restored the legitimate service path.
Their customized implant used encrypted settings and scrambled program logic to hinder analysis.
[Attackers] deploy[ed] an AdaptixC2 implant hidden inside a modified Microsoft Copilot binary.
The evasion loader... employs standard evasion techniques: AES-128-CBC decryption via hardcoded keys/IVs, AMSI/ETW patching, indirect syscalls, anti-sandbox/debugging mechanisms, process injection, and automated self-deletion.
They duplicated the token of a process running as a domain-privileged service account and used it to respawn the implant via CreateProcessAsUser.
They identified a process running under a domain-privileged service account, copied its access token, and relaunched the implant with that account's rights.
The implant established command-and-control with attacker infrastructure, then went dormant for roughly a day before the threat actors returned to conduct hands-on-keyboard activity.
A scheduled task named TPMProfiler launched qemu-system-x86_64.exe as SYSTEM against a disguised vault.db disk image; operators then worked from the hidden QEMU guest.
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
The evasion loader... employs standard evasion techniques: AES-128-CBC decryption... AMSI/ETW patching, indirect syscalls, anti-sandbox/debugging mechanisms, process injection, and automated self-deletion.
Threat actors began credential dumping through the implant, beginning with an attempt to dump the process memory of LSASS and saving a copy of the SAM registry hive.
Threat actors attempted to dump the process memory of LSASS and used an NTLM hash recovered during earlier credential dumping.
Threat actors saved a copy of the SAM registry hive during credential dumping.
Threat actors ran ntdsutil.exe to create a backup of the Active Directory database, writing a copy of NTDS.dit to C:\nbak\Active Directory\ntds.dit.
They identified a process running under a domain-privileged service account, copied its access token, and relaunched the implant with that account's rights.
net group "Domain Admins" /domain was used to enumerate Domain Admins.
It then gathers comprehensive machine and user telemetry before sending the collected data to the Command-and-Control (C2) server via an HTTP POST request
dsquery was used to enumerate active domain computers, while the attack targeted a domain-privileged service account and later collected hashes for domain accounts.
Threat actors issued nltest /domain_trusts /all_trusts to identify domain controllers/trust relationships for lateral movement purposes.
The implant established command-and-control with attacker infrastructure, then went dormant for roughly a day before the threat actors returned to conduct hands-on-keyboard activity.
Threat actors authenticated to the domain controller over RDP in a pass-the-hash attack.
Using those privileges, the group copied its payload to the domain controller through an administrative file share.
Using an NTLM hash recovered during credential dumping and leveraging Restricted Admin mode, the threat actors authenticated to the domain controller over RDP in a pass-the-hash attack.
Threat actors used the AdaptixC2 implant to drop 7-Zip to create an archive of the NTDS.dit database and the rest of the C:\nbak IFM output into a single archive for exfiltration.
“The attacker also harvested credential-related files and used AdaptixC2 to control at least two Windows server identities.”
The implant uses HTTP for command-and-control communication. The initial HTTP POST request sent to the C2 includes a customized Authorization header and User-Agent.
AdaptixC2... supports multiple communication protocols, including HTTP/S, DNS/DoH, and SMB.
The web shell was used to download a trojanized Microsoft Copilot binary carrying an AdaptixC2 implant from 47.79.64[.]225, then execute it.
Operators abused a wide array of remote access tools, these included: Atera, Teramind, AnyDesk, ngrok as well as MeshCentral/MeshAgents and AdaptixC2.
The QEMU guest forwarded host ports 32567 and 22022 to guest SSH and opened a reverse SSH tunnel through AdaptixC2 or OpenSSH.
The Authorization header contains Base64-encoded and RC4-encrypted victim device registration data; subsequent communications with the C2 are encrypted by a session key.
272 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
66 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.