Loading malware…
AdaptixC2 is an open-source post-exploitation command-and-control framework increasingly observed in real-world intrusions. It is used as a beaconing and remote-access platform after initial compromise, supporting command execution, file transfer, data exfiltration, SOCKS and port-forwarding, and in-memory execution of Beacon Object Files. The framework includes multiple transport options, including HTTP/S, SMB named pipes, DNS/DoH, and raw TCP, and has been described as supporting agents across Windows, Linux, and macOS. Public reporting also notes distinctive default network characteristics in some deployments, making exposed teamservers identifiable when operators do not sufficiently customize them.
In intrusion activity, AdaptixC2 has commonly appeared as a second-stage or post-compromise payload rather than an initial access tool. Observed delivery chains include phishing and spearphishing lures, SEO-poisoning leading to trojanized software installers, malicious package and software supply-chain compromises, and loader chains using DLL sideloading, shellcode loaders, and reflective in-memory execution. It has been delivered by other malware and loaders including BumbleBee, TriBack Loader, Cruciferra-protected chains, PowerShell-based loaders, and staged shellcode injection workflows.
On Windows, reported AdaptixC2 deployments have used process injection, import-less payloads with runtime API and string resolution, named-pipe IPC, RC4-encrypted configuration data, and shellcode-based execution inside legitimate processes. Some campaigns compiled or staged payloads on-host, while others used DLL hijacking or sideloading for persistence and stealth. AdaptixC2 has also been observed in Linux-focused operations, including espionage activity using an AdaptixC2 agent with dead-drop command-and-control via cloud storage.
Threat actors have used AdaptixC2 in a wide range of operations, including cybercrime, ransomware intrusions, supply-chain compromises, and espionage campaigns. Reported associations include China-aligned activity such as SLIME88-linked targeting of Taiwan’s energy sector, the JadeProx espionage cluster, and Operation Dragon Weave targeting officials and citizens in the Czech Republic and Taiwan. It has also been seen in criminal intrusion chains involving BumbleBee followed by credential theft, lateral movement, and eventual Akira ransomware deployment, as well as in opportunistic phishing campaigns delivering XWorm and AdaptixC2 together.
Victim sectors and targets linked to AdaptixC2 activity include energy, government, research, academia, technology, finance, healthcare, manufacturing, hospitality, travel, and critical infrastructure. Because AdaptixC2 is an open-source framework used by multiple unrelated operators, its presence alone does not attribute an intrusion to a specific threat actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An AdaptixC2 malware payload was also identified, indicating active command-and-control operations. Analysis of exposed payloads shows the attacker used AdaptixC2 for command and control, along with a PowerShell reverse shell.
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
The tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Stage 5: RAT Analysis The final Remote Access Trojan (RAT) is fully import-less. It dynamically resolves both API imports and strings at runtime... This RAT is a variant of AdaptixC2. The AdaptixC2 framework identifies its C2 traffic through the custom HTTP header X-Content-ID, which is part of its default communication profile.
SLIME88 has targeted Taiwan’s energy sector through phishing emails and fake certificate installer, attempting to deploy backdoor programs such as AdaptixC2 and CobaltStrike.
Two observed variants deliver AdaptixC2... Debugging the final payload leads us to AdaptixC2 beacon, an open-source post-exploitation framework.
A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent... The loader then decrypts and runs the main payload, an AdaptixC2 agent codenamed AZUREVEIL owing to the use of Microsoft Azure Blob Storage for command-and-control (C2).
The group has also used a DLL sideloading technique to launch the Havoc C2 post-exploitation framework, and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
The March sample is markedly different... the decryption of a .log file culminating in the execution of AdaptixC2-related shellcode. (AdaptixC2 is an open-source red-teaming framework that we’ve seen used in ransomware attacks...)
46 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
The beacon agents in AdaptixC2... can be produced in various formats such as standalone executables, dynamic-link libraries, service executables, and raw shellcode.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
The executable spawns a child process using the COM surrogate (DLLHost.exe). It then allocates memory in the DLLHost.exe process, changes the memory protection to executable, and prepares the region to receive the payload... uses NtWriteVirtualMemory to write it into the allocated memory region within the DLLHost.exe child process.
The dropped msbuild.exe contains an embedded PNG image used to conceal an obfuscated payload... The PNG image conceals a shellcode, which is obfuscated using a repeating 0xFF pattern.
When executed, the malicious code in _client.py connects to the attacker’s Command-and-Control (C2) server and downloads a WAV file. This WAV file then drops msbuild.exe and attempts to execute it. The dropped msbuild.exe contains an embedded PNG image used to conceal an obfuscated payload.
The executable spawns a child process using the COM surrogate (DLLHost.exe). It then allocates memory in the DLLHost.exe process, changes the memory protection to executable, and prepares the region to receive the payload... uses NtWriteVirtualMemory to write it into the allocated memory region within the DLLHost.exe child process.
It then uses NtQueueApcThread to queue a user-mode Asynchronous Procedure Call (APC) containing the payload. Finally, it resumes the thread via NtResumeThread, transferring execution control to the next stage inside the DLLHost.exe process.
MITRE ATT&CK Mapping Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)
MITRE ATT&CK Mapping Defense Evasion: T1218 System Binary Proxy (certutil/bitsadmin); T1140 Deobfuscate/Decode; T1027 Obfuscated Files/Info (decimal-IP, base64); T1036 Masquerading (windowsupdate.exe); T1574.002 DLL Side-Loading (g2m.dll); T1070 Indicator Removal (transcript deletion)
MITRE ATT&CK Mapping Defense Evasion: T1218 System Binary Proxy (certutil/bitsadmin); T1140 Deobfuscate/Decode; T1027 Obfuscated Files/Info (decimal-IP, base64); T1036 Masquerading (windowsupdate.exe); T1574.002 DLL Side-Loading (g2m.dll); T1070 Indicator Removal (transcript deletion)
The Donut loader component of the shellcode performs reflective loading to execute the final payload entirely in memory... The Donut loader assumes control and carries out a highly sophisticated in-memory reflective loading sequence to inject and execute the RAT.
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
This control allows them to manipulate the file system... Moreover, they can enumerate running processes, terminate specific applications, and launch new programs.
It then gathers comprehensive machine and user telemetry before sending the collected data to the Command-and-Control (C2) server via an HTTP POST request
This control allows them to manipulate the file system, manage directories, and create, modify, or delete files and folders at will.
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
MITRE ATT&CK Mapping Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software
AdaptixC2 is a red teaming tool designed for adversarial actions... To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding.
The final payload is a Remote Access Trojan (RAT) that establishes a connection back to the attacker’s C2 server... sending the collected data to the Command-and-Control (C2) server via an HTTP POST request
To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding.
When executed, the malicious code in _client.py connects to the attacker’s Command-and-Control (C2) server and downloads a WAV file.
MITRE ATT&CK Mapping Command & Control: T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1572 Protocol Tunneling (trycloudflare); T1132 Data Encoding
228 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hands-on-keyboard post-compromise tooling/C2 framework compiled on-host from svc.cs into svc.exe, used for staging, credential access, discovery, lateral movement, and exfiltration.
Malware payload delivered in a campaign using Cruciferra.
A backdoor delivered by TriBack Loader as part of the described cyberespionage operation.
Malware delivered in campaigns using Cruciferra.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.