AdaptixC2

attackers used phishing attacks to impersonate IT support personnel (using subject lines like “Help Desk (External) | Microsoft Teams”). This convinced employees to initiate legitimate remote assistance sessions using tools like the Quick Assist Remote Monitoring and Management (RMM) tool.

The activity entails distributing spear-phishing emails containing ZIP attachments to trigger an infection chain that uses a Rust loader to drop the final payload for data exfiltration and remote control.

Inside the VM, persistence and a command and control channel were established through the root crontab that launched two scripts at boot

In another case, threat actors deployed a PowerShell script that was designed to deploy AdaptixC2 beacons.

The attackers deployed the AdaptixC2 beacon using a multi-stage PowerShell loader that downloads an encoded and encrypted payload from a link to a legitimate service.

Inside the VM, persistence and a command and control channel were established through the root crontab that launched two scripts at boot... @reboot /bin/sh /sbin/syslogda.sh>/dev/null 2>&1 @reboot /bin/sh /sbin/syslogdb.sh>/dev/null 2>&1

Запускаемый файл расшифровывает встроенный шелл-код, после чего выделяет память и запускает вредоносную нагрузку с помощью WinAPI-функции CreateThread.

One infection sequence begins when the recipient of the ZIP archive opens a malicious Windows Shortcut (LNK) file that masquerades as a PDF document.

Of these, AdaptixC2 supports PsExec and WinRM.

This deployment was done both through in-memory shellcode injection and using a file-based DLL hijacking persistence mechanism... The script targets the APPDATA\Microsoft\Windows\Templates directory for DLL hijacking, using msimg32.dll.

Inside the VM, persistence and a command and control channel were established through the root crontab that launched two scripts at boot

The script creates a registry entry in the run key named “Updater,” with a PowerShell command that executes the loader.ps1 script. | To guarantee the malicious process automatically starts after reboot, the script creates a shortcut in the startup folder.

Inside the VM, persistence and a command and control channel were established through the root crontab that launched two scripts at boot

A common technique for achieving this is injecting malicious code into the address space of a legitimate process. Consequently, the payload executes under the identity of a trusted system or user process...

The script creates a registry entry in the run key named “Updater,” with a PowerShell command that executes the loader.ps1 script. | To guarantee the malicious process automatically starts after reboot, the script creates a shortcut in the startup folder.

Additionally, threat actors can modify and enhance the agent using custom obfuscation, anti-analysis and evasion techniques, making it a continuously evolving threat.

This fileless approach significantly reduces the attacker’s footprint on the system.

A common technique for achieving this is injecting malicious code into the address space of a legitimate process. Consequently, the payload executes under the identity of a trusted system or user process...

Once downloaded, the PowerShell script decrypts the payload using a simple XOR key.

adversaries leveraging QEMU, an open-source machine emulator and virtualizer typically used for development and testing, to deploy virtual machines that contained and executed malicious payloads. This approach enabled them to maintain covert access and bypass host-based detection from AV and EDR solutions.

This deployment was done both through in-memory shellcode injection and using a file-based DLL hijacking persistence mechanism... The script targets the APPDATA\Microsoft\Windows\Templates directory for DLL hijacking, using msimg32.dll.

Instead of writing the decrypted payload to disk... the script leverages .NET capabilities to allocate memory within the PowerShell process itself. The script then copies the decrypted payload, which is actually shellcode, into this allocated memory region.

In addition, to gain access to credentials, an attacker may attempt to extract sensitive information directly from the memory of the lsass.exe process.

The teamserver exposes a full REST and WebSocket API for operator control — credential management... /creds/list GET List harvested credentials

KEDR Expert detects this activity using the credentials_from_web_browsers rule.

Furthermore, credential acquisition also strongly relies on attacks on the Kerberos protocol... AdaptixC2 supports specialized modules designed to exploit specific features of the Kerberos protocol.

KEDR Expert detects this behavior via the possible_asreproasting_via_preauth_value rule.

This included discovery commands such as nltest.exe, whoami.exe and ipconfig.exe.

This included discovery commands such as nltest.exe, whoami.exe and ipconfig.exe.

This included discovery commands such as nltest.exe, whoami.exe and ipconfig.exe.

adversaries leveraging QEMU, an open-source machine emulator and virtualizer typically used for development and testing, to deploy virtual machines that contained and executed malicious payloads. This approach enabled them to maintain covert access and bypass host-based detection from AV and EDR solutions.

This convinced employees to initiate legitimate remote assistance sessions using tools like the Quick Assist Remote Monitoring and Management (RMM) tool.

To establish communication between agents via the SMB protocol, the framework utilizes named pipes.

The script syslogdb.sh maintained an SSH connection to the C2 server over TCP 443 and forwarded local port 33443 to the C2 server through this tunnel.

Let’s examine the lateral movement detection techniques using the exploitation of the WinRM (Windows Remote Management) service as a primary example.

The teamserver exposes a full REST and WebSocket API for operator control — credential management, agent tasking, screenshot capture... /screen/image GET Retrieve a screenshot image

AdaptixC2 is an open-source post-exploitation framework... The framework ships two agent families... listeners as loadable plugins (“extenders”) covering HTTP/S, DNS/DoH, SMB named pipes, and raw TCP transports. | BeaconHTTP : HTTP/S callback with configurable URIs, headers, and User-Agent rotation... BeaconDNS : DNS-based callback channel... BeaconTCP : Bind-style TCP channel for internal pivots

BEACON_HTTP for web-based communication... The beacon then established communication with a remote server, enabling the threat actors to obtain C2 on the infected machine.

AdaptixC2 supports the transmission of data and commands from C2 via both traditional DNS over UDP and DNS over HTTPS (DoH). This communication method enables the masking of the communication channel between the agent and the server.

the framework supports sophisticated tunneling capabilities, including SOCKS4/5 proxy functionality and port forwarding.

/tunnel/start/lportfwd POST Start a local port forward | /tunnel/start/socks5 POST Start a SOCKS5 proxy tunnel

the beacon’s local traffic was carried over the encrypted SSH channel to remote infrastructure, enabling command-and-control communication while blending into normal outbound traffic.

Internal (P2P): agents communicate with adjacent agents, establishing a chain back to a host that interfaces directly with the C2 server. This approach leverages TCP and SMB.

The script downloads a Base64-encoded shellcode payload from a remote server using Invoke-RestMethod. The downloaded content is then decoded.

To implement Beacon DNS, the AdaptixC2 agent also supports the DNS over HTTPS (DoH) protocol. This mechanism encapsulates standard DNS queries within HTTP messages transmitted over a secure TLS connection.

Even when an agent employs advanced evasion, masking, or obfuscation techniques on the endpoint, it must maintain a connection with its C2 server to receive commands, exfiltrate results, and coordinate subsequent attack stages.