Loading malware…
AdaptixC2 is an open-source post-exploitation command-and-control framework comprising a Go-based teamserver, a Qt-based operator client, and cross-platform agents. Its Beacon and Gopher implants support Windows, Linux, and macOS, and the framework provides HTTP/S, DNS/DoH, SMB named-pipe, and raw TCP listener transports. Observed AdaptixC2 agents support command execution, file operations, process control, Beacon Object File execution, SOCKS forwarding, and data exfiltration. The framework has been used as a follow-on remote-access capability in intrusions involving ransomware, cyberespionage, and commodity cybercrime.
AdaptixC2 has been observed following phishing, ClickFix, SEO-poisoning, and DLL-sideloading infection chains. It was deployed in campaigns associated with the China-nexus JadeProx cluster through TriBack Loader, in intrusions leading to Akira ransomware, and in activity attributed with medium confidence to hacktivist clusters including 4BID. It has also been delivered through supply-chain compromise and by crypter-protected malware chains. Default deployments may expose distinctive AdaptixC2-branded HTTP response behavior, although discovery of a public-facing instance alone does not establish malicious use because the framework can be used in authorized red-team operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
An AdaptixC2 malware payload was also identified, indicating active command-and-control operations. Analysis of exposed payloads shows the attacker used AdaptixC2 for command and control, along with a PowerShell reverse shell.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Stage 5: RAT Analysis The final Remote Access Trojan (RAT) is fully import-less. It dynamically resolves both API imports and strings at runtime... This RAT is a variant of AdaptixC2. The AdaptixC2 framework identifies its C2 traffic through the custom HTTP header X-Content-ID, which is part of its default communication profile.
SLIME88 has targeted Taiwan’s energy sector through phishing emails and fake certificate installer, attempting to deploy backdoor programs such as AdaptixC2 and CobaltStrike.
Two observed variants deliver AdaptixC2... Debugging the final payload leads us to AdaptixC2 beacon, an open-source post-exploitation framework.
A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent... The loader then decrypts and runs the main payload, an AdaptixC2 agent codenamed AZUREVEIL owing to the use of Microsoft Azure Blob Storage for command-and-control (C2).
The group has also used a DLL sideloading technique to launch the Havoc C2 post-exploitation framework, and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
The March sample is markedly different... the decryption of a .log file culminating in the execution of AdaptixC2-related shellcode. (AdaptixC2 is an open-source red-teaming framework that we’ve seen used in ransomware attacks...)
45 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
The beacon agents in AdaptixC2... can be produced in various formats such as standalone executables, dynamic-link libraries, service executables, and raw shellcode.
Attackers obtained initial access through the ClickFix social engineering technique, using fake CAPTCHA or error-fix prompts that instruct users to copy and paste a command into Windows Run or Windows Terminal.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
The executable spawns a child process using the COM surrogate (DLLHost.exe). It then allocates memory in the DLLHost.exe process, changes the memory protection to executable, and prepares the region to receive the payload... uses NtWriteVirtualMemory to write it into the allocated memory region within the DLLHost.exe child process.
The dropped msbuild.exe contains an embedded PNG image used to conceal an obfuscated payload... The PNG image conceals a shellcode, which is obfuscated using a repeating 0xFF pattern.
When executed, the malicious code in _client.py connects to the attacker’s Command-and-Control (C2) server and downloads a WAV file. This WAV file then drops msbuild.exe and attempts to execute it. The dropped msbuild.exe contains an embedded PNG image used to conceal an obfuscated payload.
The executable spawns a child process using the COM surrogate (DLLHost.exe). It then allocates memory in the DLLHost.exe process, changes the memory protection to executable, and prepares the region to receive the payload... uses NtWriteVirtualMemory to write it into the allocated memory region within the DLLHost.exe child process.
It then uses NtQueueApcThread to queue a user-mode Asynchronous Procedure Call (APC) containing the payload. Finally, it resumes the thread via NtResumeThread, transferring execution control to the next stage inside the DLLHost.exe process.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Defense Evasion: T1218 System Binary Proxy (certutil/bitsadmin); T1140 Deobfuscate/Decode; T1027 Obfuscated Files/Info (decimal-IP, base64); T1036 Masquerading (windowsupdate.exe); T1574.002 DLL Side-Loading (g2m.dll); T1070 Indicator Removal (transcript deletion)
MITRE ATT&CK Mapping Defense Evasion: T1218 System Binary Proxy (certutil/bitsadmin); T1140 Deobfuscate/Decode; T1027 Obfuscated Files/Info (decimal-IP, base64); T1036 Masquerading (windowsupdate.exe); T1574.002 DLL Side-Loading (g2m.dll); T1070 Indicator Removal (transcript deletion)
The Donut loader component of the shellcode performs reflective loading to execute the final payload entirely in memory... The Donut loader assumes control and carries out a highly sophisticated in-memory reflective loading sequence to inject and execute the RAT.
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
This control allows them to manipulate the file system... Moreover, they can enumerate running processes, terminate specific applications, and launch new programs.
It then gathers comprehensive machine and user telemetry before sending the collected data to the Command-and-Control (C2) server via an HTTP POST request
This control allows them to manipulate the file system, manage directories, and create, modify, or delete files and folders at will.
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
AdaptixC2 is a red teaming tool designed for adversarial actions... To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding.
The final payload is a Remote Access Trojan (RAT) that establishes a connection back to the attacker’s C2 server... sending the collected data to the Command-and-Control (C2) server via an HTTP POST request
To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding.
Attackers downloaded the official Node.js installer from nodejs[.]org, while the implant was used to retrieve commands or tooling.
MITRE ATT&CK Mapping Command & Control: T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1572 Protocol Tunneling (trycloudflare); T1132 Data Encoding
236 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Command-and-control tooling whose agents were attempted during the intrusion before the attackers pivoted to using Node.js to run an implant.
A command-and-control agent/framework used by the attackers following ClickFix-based initial access.
Hands-on-keyboard post-compromise tooling/C2 framework compiled on-host from svc.cs into svc.exe, used for staging, credential access, discovery, lateral movement, and exfiltration.
Malware payload delivered in a campaign using Cruciferra.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.