Threat Actors Leveraging Open-Source AdaptixC2 in Real-world Attacks

In early May 2025, Unit 42 researchers observed multiple instances of AdaptixC2 being deployed to infect enterprise systems.

Unlike many high-profile command-and-control (C2) platforms, AdaptixC2 has flown under the radar, with scant public documentation demonstrating its use in live adversary operations.

Our research dissects AdaptixC2’s capabilities, deployment techniques, and evasion mechanisms to equip security teams with the knowledge needed to defend against this evolving threat.

AdaptixC2 is a newly identified, open-source post-exploitation and adversarial emulation framework originally created for penetration testers.

Palo Alto Networks customers benefit from protection via Advanced DNS Security, Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Cortex XDR, and XSIAM. For incident response assistance, contact the Unit 42 Incident Response team.

AdaptixC2 Overview and Capabilities

AdaptixC2 is a modular, open-source adversarial framework designed for red team operations.

The AdaptixC2 interface shows linked agents and sessions in a graphical view.

Its functionality spans command execution, file transfer, data exfiltration, and session management.

Agents support both x86 and x64 architectures and can be generated as standalone executables, DLLs, service binaries, or raw shellcode.

Core features include filesystem manipulation (directory listings, file creation, modification, deletion), process enumeration and control, and execution of arbitrary binaries.

For covert communications, AdaptixC2 supports SOCKS4/5 proxying, port forwarding, and configurable chunk sizes to blend exfiltration traffic into legitimate network flows.

Extenders—plugin-style modules—enable custom payloads and detection-evasion strategies, while Beacon Object Files (BOFs) allow C payloads to run within the agent’s process.

Configuration is encrypted with RC4, embedding a size field, encrypted data block, and 16-byte key multiple incidents where threat actors installed AdaptixC2 beacons.

Three beacon profiles—HTTP, SMB, and TCP—offer flexibility under varied network restrictions. The HTTP profile, most prevalent in the observed campaigns, configures servers, ports, SSL settings, HTTP methods, URIs, headers, and user-agent strings.

Real-World Attack Scenarios

Two distinct AdaptixC2 infections were investigated. The first relied on social engineering via counterfeit Microsoft Teams messages impersonating IT support, luring victims into Quick Assist sessions.

A multi-stage PowerShell loader downloaded an XOR-encoded shellcode payload from a legitimate hosting service, decrypted it in memory, and launched it using .NET’s dynamic invocation to avoid writing to disk.

Persistence was achieved by dropping a startup shortcut. Post-infection reconnaissance invoked nltest.exe, whoami.exe, and ipconfig.exe before establishing C2 connectivity.

The second incident involved a PowerShell script assessed to be AI-generated. It downloaded a Base64-encoded AdaptixC2 beacon, allocated unmanaged memory, copied and executed shellcode via VirtualProtect, and implemented dual persistence: DLL hijacking in the Templates folder and a Run-key registry entry.

Stylistic cues—verbose numbered comments and check-mark output messages—alongside AI detector flags, indicated the use of generative tools. This case underscores how AI assistance accelerates the development of sophisticated, fileless loaders.

The emergence of AdaptixC2 in live attacks signals a shift toward adversaries customizing red-team frameworks for illicit operations.

Monitor for anomalous memory-only execution behaviors indicative of dynamic invocation.
Extract and analyze RC4-encrypted configurations from suspect binaries to uncover C2 infrastructure.
Leverage endpoint protections to detect proxying and port-forwarding tunnels.

Indicators of Compromise

Here is the data in a structured table format:

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!