Loading story…
Kaspersky detailed detection methods for the AdaptixC2 agent, publishing guidance for both network- and host-based visibility through its KATA and KEDR security products. The report focuses on identifying activity associated with the command-and-control framework, giving defenders a way to spot the malware agent through telemetry collected across endpoints and network traffic.
The publication provides practical detection coverage aimed at helping security teams hunt for AdaptixC2 behavior and improve monitoring for related intrusions. By mapping observable activity to Kaspersky’s detection stack, the guidance supports earlier identification of compromised hosts and C2 communications tied to the agent.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist published research on detecting the AdaptixC2 agent through network and host-based methods using KATA and KEDR. No earlier discrete real-world events are described in the provided reference content.
The Adaptix-Framework project published the AdaptixC2 repository on GitHub, describing it as a modular red-team and post-exploitation framework for authorized testing. The repository documented cross-platform agents, encrypted communications, multiple listener types, and plugin-based extensibility.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers from Silent Push have identified that the open-source command and control (C2) framework AdaptixC2, originally designed for penetration testing and adversary emulation, is being actively abused by Russian-linked cybercriminals. The tool, which is freely available on GitHub and supports Linux, Windows, and macOS, has been leveraged to deliver malicious payloads in global ransomware campaigns. The investigation into AdaptixC2's misuse began during research into the CountLoader malware loader, where AdaptixC2 was observed being used to deploy additional threats, including ransomware and information stealers. Further analysis revealed that a threat actor known as “RalfHacker” is likely the developer behind AdaptixC2 and operates a Russian-language Telegram channel to promote and sell the tool within the criminal underground. The cross-platform nature and extensibility of AdaptixC2 make it attractive for both legitimate security testing and malicious activity, enabling attackers to target a wide range of systems. Security teams have responded by developing detection signatures for both CountLoader and AdaptixC2 infrastructure to help mitigate the threat posed by this dual-use tool.
Jun 29, 2026
AdaptixC2, an open-source post-exploitation framework, has been increasingly leveraged by threat actors for sophisticated cyberattacks. Security researchers discovered that AdaptixC2 was distributed through a malicious npm package named 'https-proxy-utils,' which masqueraded as a legitimate HTTPS proxy utility. This package, now removed from the npm registry, contained a post-install script that downloaded and executed the AdaptixC2 agent, adapting its installation method based on the victim's operating system and architecture. On Windows, the agent was executed via DLL sideloading into msdtc.exe, while on macOS, it was installed as an executable with a plist autorun configuration, and on Linux, it was placed in the /tmp/.fonts-unix directory with execute permissions. The malicious package mimicked legitimate proxy packages with millions of weekly downloads, increasing the likelihood of accidental installation by unsuspecting developers. AdaptixC2 provides a comprehensive suite of command-and-control features, including beaconing, command execution, file management, data exfiltration, credential harvesting, lateral movement, and custom payload deployment through modular plugins called 'extenders.' Researchers have also observed AdaptixC2 being deployed via social engineering attacks, such as impersonating help desk staff on Microsoft Teams, and through AI-generated PowerShell scripts that enable fileless execution and persistence via DLL hijacking and registry run keys. The framework's encrypted configuration, stored in the PE file’s .rdata section and protected with RC4 encryption, poses challenges for defenders but can be analyzed with specialized tools. Recent incidents have linked AdaptixC2 to attacks on financial institutions in Asia, where it was used in conjunction with Fog ransomware, highlighting its role in multifaceted campaigns. The framework's support for SOCKS4/5 proxies and port forwarding enables covert network communication, further complicating detection. Its modular architecture allows attackers to tailor payloads and evasion techniques to specific environments, making it a significant threat to organizations. AdaptixC2's low profile and customizable features have contributed to its growing popularity among both penetration testers and malicious actors. Security teams are urged to strengthen defenses against such advanced post-exploitation tools, as their evolving tactics can bypass traditional security measures. The discovery of AdaptixC2 in a widely used software supply chain underscores the ongoing risks posed by malicious packages in open-source ecosystems. Organizations should monitor for suspicious npm packages and implement robust endpoint detection to mitigate the threat posed by frameworks like AdaptixC2. The incident demonstrates the increasing sophistication of supply chain attacks and the need for vigilance in software dependency management.
Jun 29, 2026Unit 42 researchers observed multiple real-world attacks in May 2025 involving the AdaptixC2 post-exploitation framework. Threat actors gained initial access through Microsoft Teams phishing and deployed AdaptixC2 beacons using PowerShell loaders, including AI-generated scripts with advanced persistence techniques. The framework's modularity, fileless execution, and support for custom payloads make it a growing threat, with evidence of use alongside ransomware such as Fog.
Jun 29, 2026