AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks
Summary: Unit 42 researchers reported in May 2025 that AdaptixC2, an open-source post-exploitation and adversarial emulation framework built for penetration testers, was used to infect several systems, with two infections identified. One case used social engineering through Microsoft Teams to impersonate IT support and initiate Quick Assist remote sessions, while Unit 42 assessed with high confidence that the other used AI-based code generation tools.
What's compelling: AdaptixC2's modular extenders, Beacon Object Files, and encrypted RC4 configuration let attackers customize payloads and tunnel over SOCKS4/5 to evade detection, and it has already been deployed alongside Fog ransomware in an attack on a financial institution in Asia.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026