Loading malware…
Adaptix C2 is an open-source command-and-control and post-exploitation framework used by malicious actors to control compromised systems. Its agent ecosystem includes Windows and Linux implementations. JITTERLY, a Linux implant, uses a protocol, registration process, configuration structure, and command structure closely aligned with Adaptix C2's Linux agent.
UNC7017 deployed Adaptix C2 as a follow-on payload on selected systems already infected with the SHINYROAD backdoor during a 2026 compromise of AOMEI Backupper's update infrastructure. The Adaptix-based payload, tracked as ADAPTAGENT, masqueraded as Nitro PDF software. Its execution chain used DLL side-loading, hidden PowerShell execution, and scheduled-task persistence. The broader campaign affected organizations in IT services, telecommunications, and higher education across multiple countries.
Adaptix C2 also appeared in Operation DUPEHIKE, which targeted Russian human-resources personnel with bonus-themed lures and delivered DUPERUNNER. That operation deployed Adaptix C2 through process injection. These deployments demonstrate adoption by distinct intrusion operations rather than an exclusive association with a single threat actor.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
ADAPTAGENT (post-exploitation, Stage 4) : Framework Adaptix C2 masqué en outils Nitro PDF.
JITTERLY's protocol, configuration fields, registration process, and command structure closely match the Linux agent used by the Adaptix C2 framework.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Hidden PowerShell execution ( -WindowStyle Hidden ) executing the Nitro PDF / Adaptix C2 payload.
Operation DUPEHIKE Hits Russian HR: Bonus Lure Delivers DUPERUNNER and Adaptix C2 via Process Injection
ADAPTAGENT ... Framework Adaptix C2 masqué en outils Nitro PDF (NitroPromotion.exe, Eztwain4.dll)
Operation DUPEHIKE Hits Russian HR: Bonus Lure Delivers DUPERUNNER and Adaptix C2 via Process Injection
“CVE-2020-1472, also known as ZeroLogon, allows for compromising a vulnerable operating system and executing commands as a privileged user.” | “CVE-2021-34527, also known as PrintNightmare… enabling remote access to a vulnerable OS and high-privilege command execution.”
“Top 10 C2 frameworks… Metasploit… Sliver… Mythic… Empire… Adaptix C2… vulnerabilities were used to launch them and subsequently move within the victim’s network.”
JITTERLY supports more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling, interactive terminal access, and internal pivoting.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.