Loading story…
Security researchers from Silent Push have identified that the open-source command and control (C2) framework AdaptixC2, originally designed for penetration testing and adversary emulation, is being actively abused by Russian-linked cybercriminals. The tool, which is freely available on GitHub and supports Linux, Windows, and macOS, has been leveraged to deliver malicious payloads in global ransomware campaigns. The investigation into AdaptixC2's misuse began during research into the CountLoader malware loader, where AdaptixC2 was observed being used to deploy additional threats, including ransomware and information stealers.
Further analysis revealed that a threat actor known as “RalfHacker” is likely the developer behind AdaptixC2 and operates a Russian-language Telegram channel to promote and sell the tool within the criminal underground. The cross-platform nature and extensibility of AdaptixC2 make it attractive for both legitimate security testing and malicious activity, enabling attackers to target a wide range of systems. Security teams have responded by developing detection signatures for both CountLoader and AdaptixC2 infrastructure to help mitigate the threat posed by this dual-use tool.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Silent Push reported that AdaptixC2 has been weaponized by multiple threat actors and identified “RalfHacker” as a likely developer or key figure behind the framework. The research further tied the tool’s development and distribution to the Russian criminal ecosystem.
Palo Alto Networks Unit 42 associated AdaptixC2-related activity with intrusions involving Akira and Fog ransomware. This connected the framework to real-world ransomware operations rather than only red-team or commodity abuse.
Researchers reported AdaptixC2 being delivered in social-engineering attacks conducted over Microsoft Teams and involving Quick Assist. The technique demonstrated active operational use of the framework for initial access and follow-on compromise.
Reporting indicated that AdaptixC2 was concealed inside a malicious npm package masquerading as an HTTPS proxy utility. This showed the framework being distributed through software supply chain-style deception.
Researchers identified a persona known as “RalfHacker” operating a Russian-language Telegram channel used to sell or promote AdaptixC2. This activity linked the framework’s ecosystem to the Russian-speaking cybercriminal underground.
AdaptixC2 emerged as a free, actively maintained open-source red-teaming and post-exploitation framework with modular, cross-platform capabilities. Its design lowered the barrier for threat actors to access enterprise-grade post-exploitation tooling.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesilentpush.com
Open sourcehackread.com
Open sourcesecurityboulevard.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptixC2, an open-source post-exploitation framework, has been increasingly leveraged by threat actors for sophisticated cyberattacks. Security researchers discovered that AdaptixC2 was distributed through a malicious npm package named 'https-proxy-utils,' which masqueraded as a legitimate HTTPS proxy utility. This package, now removed from the npm registry, contained a post-install script that downloaded and executed the AdaptixC2 agent, adapting its installation method based on the victim's operating system and architecture. On Windows, the agent was executed via DLL sideloading into msdtc.exe, while on macOS, it was installed as an executable with a plist autorun configuration, and on Linux, it was placed in the /tmp/.fonts-unix directory with execute permissions. The malicious package mimicked legitimate proxy packages with millions of weekly downloads, increasing the likelihood of accidental installation by unsuspecting developers. AdaptixC2 provides a comprehensive suite of command-and-control features, including beaconing, command execution, file management, data exfiltration, credential harvesting, lateral movement, and custom payload deployment through modular plugins called 'extenders.' Researchers have also observed AdaptixC2 being deployed via social engineering attacks, such as impersonating help desk staff on Microsoft Teams, and through AI-generated PowerShell scripts that enable fileless execution and persistence via DLL hijacking and registry run keys. The framework's encrypted configuration, stored in the PE file’s .rdata section and protected with RC4 encryption, poses challenges for defenders but can be analyzed with specialized tools. Recent incidents have linked AdaptixC2 to attacks on financial institutions in Asia, where it was used in conjunction with Fog ransomware, highlighting its role in multifaceted campaigns. The framework's support for SOCKS4/5 proxies and port forwarding enables covert network communication, further complicating detection. Its modular architecture allows attackers to tailor payloads and evasion techniques to specific environments, making it a significant threat to organizations. AdaptixC2's low profile and customizable features have contributed to its growing popularity among both penetration testers and malicious actors. Security teams are urged to strengthen defenses against such advanced post-exploitation tools, as their evolving tactics can bypass traditional security measures. The discovery of AdaptixC2 in a widely used software supply chain underscores the ongoing risks posed by malicious packages in open-source ecosystems. Organizations should monitor for suspicious npm packages and implement robust endpoint detection to mitigate the threat posed by frameworks like AdaptixC2. The incident demonstrates the increasing sophistication of supply chain attacks and the need for vigilance in software dependency management.
Jun 29, 2026Unit 42 researchers observed multiple real-world attacks in May 2025 involving the AdaptixC2 post-exploitation framework. Threat actors gained initial access through Microsoft Teams phishing and deployed AdaptixC2 beacons using PowerShell loaders, including AI-generated scripts with advanced persistence techniques. The framework's modularity, fileless execution, and support for custom payloads make it a growing threat, with evidence of use alongside ransomware such as Fog.
Jun 29, 2026
Threat actors have begun using the open-source **Havoc** post-exploitation framework in real-world attacks, positioning it as an alternative to tools such as **Cobalt Strike**, **Sliver**, and **Brute Ratel**. Researchers observed a targeted intrusion against an unnamed government organization in which attackers delivered a ZIP archive containing a decoy document and a malicious `.scr` file that installed the **Havoc Demon** implant. Once deployed, the malware enabled remote command execution, collection of command output, encryption of results, and exfiltration to attacker-controlled command-and-control infrastructure. Analysis cited in multiple reports said Havoc includes evasion features such as **indirect syscalls** and **sleep obfuscation**, helping it bypass fully updated **Windows 11 Defender** protections. The framework was also linked to a malicious npm package, `aabquerys`, which triggered a three-stage infection chain to fetch the Demon payload before the package was removed. The activity reflects a broader trend of offensive security frameworks escaping legitimate red-team use and being repurposed by attackers for stealthy post-compromise operations.
Jul 12, 2026