Threat Actors Leveraging Open-Source AdaptixC2 in Real-world Attacks

In early May 2025, Unit 42 researchers observed multiple instances of AdaptixC2 being deployed to infect enterprise systems.

Unlike many high-profile command-and-control (C2) platforms, AdaptixC2 has flown under the radar, with scant public documentation demonstrating its use in live adversary operations.

Our research dissects AdaptixC2’s capabilities, deployment techniques, and evasion mechanisms to equip security teams with the knowledge needed to defend against this evolving threat.

AdaptixC2 is a newly identified, open-source post-exploitation and adversarial emulation framework originally created for penetration testers.

Palo Alto Networks customers benefit from protection via Advanced DNS Security, Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Cortex XDR, and XSIAM. For incident response assistance, contact the Unit 42 Incident Response team.

AdaptixC2 Overview and Capabilities

AdaptixC2 is a modular, open-source adversarial framework designed for red team operations.

The AdaptixC2 interface shows linked agents and sessions in a graphical view.

Its functionality spans command execution, file transfer, data exfiltration, and session management.

Agents support both x86 and x64 architectures and can be generated as standalone executables, DLLs, service binaries, or raw shellcode.

Core features include filesystem manipulation (directory listings, file creation, modification, deletion), process enumeration and control, and execution of arbitrary binaries.

For covert communications, AdaptixC2 supports SOCKS4/5 proxying, port forwarding, and configurable chunk sizes to blend exfiltration traffic into legitimate network flows.

Extenders—plugin-style modules—enable custom payloads and detection-evasion strategies, while Beacon Object Files (BOFs) allow C payloads to run within the agent’s process.

Configuration is encrypted with RC4, embedding a size field, encrypted data block, and 16-byte key multiple incidents where threat actors installed AdaptixC2 beacons.

Three beacon profiles—HTTP, SMB, and TCP—offer flexibility under varied network restrictions. The HTTP profile, most prevalent in the observed campaigns, configures servers, ports, SSL settings, HTTP methods, URIs, headers, and user-agent strings.

Real-World Attack Scenarios

Two distinct AdaptixC2 infections were investigated. The first relied on social engineering via counterfeit Microsoft Teams messages impersonating IT support, luring victims into Quick Assist sessions.

A multi-stage PowerShell loader downloaded an XOR-encoded shellcode payload from a legitimate hosting service, decrypted it in memory, and launched it using .NET’s dynamic invocation to avoid writing to disk.

Persistence was achieved by dropping a startup shortcut. Post-infection reconnaissance invoked nltest.exe, whoami.exe, and ipconfig.exe before establishing C2 connectivity.

The second incident involved a PowerShell script assessed to be AI-generated. It downloaded a Base64-encoded AdaptixC2 beacon, allocated unmanaged memory, copied and executed shellcode via VirtualProtect, and implemented dual persistence: DLL hijacking in the Templates folder and a Run-key registry entry.

Stylistic cues—verbose numbered comments and check-mark output messages—alongside AI detector flags, indicated the use of generative tools. This case underscores how AI assistance accelerates the development of sophisticated, fileless loaders.

The emergence of AdaptixC2 in live attacks signals a shift toward adversaries customizing red-team frameworks for illicit operations.

Monitor for anomalous memory-only execution behaviors indicative of dynamic invocation.
Extract and analyze RC4-encrypted configurations from suspect binaries to uncover C2 infrastructure.
Leverage endpoint protections to detect proxying and port-forwarding tunnels.

Indicators of Compromise

Here is the data in a structured table format:

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.