Loading story…
Unit 42 researchers observed multiple real-world attacks in May 2025 involving the AdaptixC2 post-exploitation framework. Threat actors gained initial access through Microsoft Teams phishing and deployed AdaptixC2 beacons using PowerShell loaders, including AI-generated scripts with advanced persistence techniques. The framework's modularity, fileless execution, and support for custom payloads make it a growing threat, with evidence of use alongside ransomware such as Fog.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptixC2, an open-source post-exploitation framework, has been increasingly leveraged by threat actors for sophisticated cyberattacks. Security researchers discovered that AdaptixC2 was distributed through a malicious npm package named 'https-proxy-utils,' which masqueraded as a legitimate HTTPS proxy utility. This package, now removed from the npm registry, contained a post-install script that downloaded and executed the AdaptixC2 agent, adapting its installation method based on the victim's operating system and architecture. On Windows, the agent was executed via DLL sideloading into msdtc.exe, while on macOS, it was installed as an executable with a plist autorun configuration, and on Linux, it was placed in the /tmp/.fonts-unix directory with execute permissions. The malicious package mimicked legitimate proxy packages with millions of weekly downloads, increasing the likelihood of accidental installation by unsuspecting developers. AdaptixC2 provides a comprehensive suite of command-and-control features, including beaconing, command execution, file management, data exfiltration, credential harvesting, lateral movement, and custom payload deployment through modular plugins called 'extenders.' Researchers have also observed AdaptixC2 being deployed via social engineering attacks, such as impersonating help desk staff on Microsoft Teams, and through AI-generated PowerShell scripts that enable fileless execution and persistence via DLL hijacking and registry run keys. The framework's encrypted configuration, stored in the PE file’s .rdata section and protected with RC4 encryption, poses challenges for defenders but can be analyzed with specialized tools. Recent incidents have linked AdaptixC2 to attacks on financial institutions in Asia, where it was used in conjunction with Fog ransomware, highlighting its role in multifaceted campaigns. The framework's support for SOCKS4/5 proxies and port forwarding enables covert network communication, further complicating detection. Its modular architecture allows attackers to tailor payloads and evasion techniques to specific environments, making it a significant threat to organizations. AdaptixC2's low profile and customizable features have contributed to its growing popularity among both penetration testers and malicious actors. Security teams are urged to strengthen defenses against such advanced post-exploitation tools, as their evolving tactics can bypass traditional security measures. The discovery of AdaptixC2 in a widely used software supply chain underscores the ongoing risks posed by malicious packages in open-source ecosystems. Organizations should monitor for suspicious npm packages and implement robust endpoint detection to mitigate the threat posed by frameworks like AdaptixC2. The incident demonstrates the increasing sophistication of supply chain attacks and the need for vigilance in software dependency management.
Jun 29, 2026
Security researchers from Silent Push have identified that the open-source command and control (C2) framework AdaptixC2, originally designed for penetration testing and adversary emulation, is being actively abused by Russian-linked cybercriminals. The tool, which is freely available on GitHub and supports Linux, Windows, and macOS, has been leveraged to deliver malicious payloads in global ransomware campaigns. The investigation into AdaptixC2's misuse began during research into the CountLoader malware loader, where AdaptixC2 was observed being used to deploy additional threats, including ransomware and information stealers. Further analysis revealed that a threat actor known as “RalfHacker” is likely the developer behind AdaptixC2 and operates a Russian-language Telegram channel to promote and sell the tool within the criminal underground. The cross-platform nature and extensibility of AdaptixC2 make it attractive for both legitimate security testing and malicious activity, enabling attackers to target a wide range of systems. Security teams have responded by developing detection signatures for both CountLoader and AdaptixC2 infrastructure to help mitigate the threat posed by this dual-use tool.
Jun 29, 2026
Sophos X-Ops reported that a threat actor built and tested an AI-assisted post-exploitation framework designed to evade endpoint detection and response tools, using a mix of malicious files, Cobalt Strike profiles, Python shellcode-injection scripts, a Telegram Bot API command-and-control channel, and a Cloudflare Worker redirector. Investigators found a supporting Git repository that automated Active Directory discovery and maintained a malware-testing lab with multiple virtual machines to evaluate bypass techniques against **Sophos**, **CrowdStrike**, and **Microsoft Defender** environments; many scripts appeared partly AI-generated and included Russian-language elements. The framework used a Python payload generator to create **Rust**- and **Go**-based payloads with encryption, evasion, and alternate execution methods, ultimately producing nearly 80 modules that tested more than 70 techniques. Sophos said the operators used tools including **Cursor**, **Claude Opus 4.5**, and **Model Context Protocol** to coordinate workflows, ingest public research, and map activity to `MITRE ATT&CK`, but found no clear evidence that AI independently invented new malware capabilities; the company also linked the development activity to known ransomware deployment and data-theft operations and urged organizations to maintain layered defenses including patching, MFA, passkeys, and strong EDR coverage.
Jun 29, 2026