Loading malware…
Adaptix C2 Agent Beacon is a component of the open-source Adaptix C2 post-exploitation and adversarial emulation framework, described as an extensible tool designed for penetration testers and comparable to Cobalt Strike. In the referenced incident, it was deployed to provide command-and-control access on a victim network. Symantec reported its use during a May 2025 Fog ransomware attack against a financial institution in Asia, where attackers had maintained access for roughly two weeks before ransomware deployment and used an atypical mix of tools including GC2, Stowaway, and Syteca. The specific Adaptix variant observed in that intrusion contained an encrypted configuration blob. The broader attack context, including post-ransomware persistence and use of surveillance-oriented tooling, led researchers to assess possible espionage objectives in addition to financial motives. Published indicators for the overall incident included file indicators for the Adaptix C2 Beacon Agent and network IOCs such as 66.112.216[.]232, amanda[.]protoflint[.]com, and 97.64.81[.]119, though the content does not explicitly map those network indicators solely to Adaptix.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adaptix C2 Agent Beacon is a component of the Adaptix C2 post-exploitation and adversarial emulation framework, providing C2 access and remote control similar to Cobalt Strike. It was used for command and control in this attack.
Open source post-exploitation and C2 framework similar to Cobalt Strike, used for maintaining access and controlling compromised systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.