AdaptixC2

AdaptixC2 is an open-source post-exploitation command-and-control framework used both for legitimate red-team/adversarial emulation and in real-world intrusions. The content describes it as a Go-based teamserver with Beacon and Gopher agents for Windows, Linux, and macOS, supporting command execution, file transfer and exfiltration, process control, SOCKS4/5 proxying, port forwarding, Beacon Object Files, and multiple transports including HTTP/S, DNS/DoH, SMB named pipes, and raw TCP. Beacon payloads can be generated as EXEs, DLLs, service executables, and raw shellcode, and configurations are RC4-encrypted. Default unauthenticated HTTP responses expose distinctive headers such as "Server: AdaptixC2" and "Adaptix-Version: v1.2," and default 404 content includes "AdaptixC2 404," making some deployments identifiable via passive scanning. Reported default or observed network artifacts include URIs such as /updates/check.php, /api/v1/status, /content.html, and in one documented default configuration /uri.php.

The framework has been observed in multiple malicious campaigns. In July 2025 Akira ransomware intrusions, BumbleBee delivered an AdaptixC2 beacon by injecting shellcode into AdgNsy.exe, a renamed WAB.exe, establishing persistent C2 to 172.96.137[.]160:443. In those intrusions, AdaptixC2 supported follow-on reconnaissance, credential theft from NTDS.dit, Veeam, and LSASS, RDP and SSH-based lateral movement, persistence alongside RustDesk, and data exfiltration via FileZilla/SFTP before Akira deployment. In a May 2026 phishing intrusion, payloads were staged from cloudpre-005[.]online using payload.zip and stub.zip; binaries including ms-op.exe, stub1.exe, and payload.exe beaconed to 23[.]20[.]229[.]225:443 and 98[.]81[.]111[.]167:443 and used the static user agent "Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0." Unit 42 also documented early May 2025 cases where AdaptixC2 was deployed via Microsoft Teams/Quick Assist social engineering and PowerShell-based loaders using in-memory shellcode execution, DLL hijacking with msimg32.dll, startup-folder persistence, and a Run key named "Updater." One observed C2 in that reporting was tech-system[.]online over HTTPS on port 443 using POST requests to /endpoint/api and the X-App-Id parameter.

The content further links AdaptixC2 to diverse threat activity: Operation Dragon Weave used an AdaptixC2 agent named AZUREVEIL with Microsoft Azure Blob Storage dead-drop C2 against targets in the Czech Republic and Taiwan across government, research, academic, technology, and financial sectors; pro-Ukrainian hacktivist-linked campaigns associated with 4BID/Hakerskii Kit/C.A.S./Goffee deployed AdaptixC2 alongside Sliver, Havoc, Mythic Apollo, BlackSalt, and ransomware after ProxyShell exploitation of Exchange; GOLD ENCOUNTER/PayoutsKing used AdaptixC2 or OpenSSH to establish SSH backdoors; Cisco Talos observed AdaptixC2 deployed post-compromise on exploited Cisco SD-WAN infrastructure; Sophos reported a March 2026 fake Claude-themed malware sample culminating in AdaptixC2-related shellcode; and Ctrl-Alt-Intel reported AdaptixC2 use after exploitation of CVE-2026-41940 against Southeast Asian government, military, MSP, and hosting targets. Additional infrastructure and indicators directly mentioned in the content include 194[.]163[.]175[.]135:4445 and :31337 in Talos cluster activity, 2.26.229[.]254 serving AdaptixC2 payloads and listeners on ports 4433, 4455, and 7000, and default agent watermarks be4c0149 for Beacon and 904e5493 for Gopher.