Threat Actors Leveraging Open-Source AdaptixC2 in Real-world Attacks

In early May 2025, Unit 42 researchers observed multiple real-world deployments of AdaptixC2, an open-source post-exploitation and adversarial-emulation framework designed for red team operations, being used to infect enterprise systems. AdaptixC2 is modular and can generate agents as standalone executables, DLLs, service binaries, or raw shellcode, with capabilities that span command execution, file transfer, data exfiltration, and session management.

The article describes two distinct infections: the first used counterfeit Microsoft Teams messages impersonating IT support to lure victims into Quick Assist sessions, followed by a PowerShell loader that downloaded an XOR-encoded shellcode payload and launched it in memory, with persistence via a startup shortcut.

The second case involved a PowerShell script that downloaded a Base64-encoded AdaptixC2 beacon, allocated unmanaged memory, and executed shellcode, achieving dual persistence through DLL hijacking and a Run-key registry entry, with signs suggesting AI-assisted development. Beacons provided three profiles—HTTP, SMB and TCP—with the HTTP profile being the most prevalent, and configurations include server details, SSL settings, and user-agent strings, while RC4 encryption protects the configuration data.

According to Unit 42, the emergence of AdaptixC2 in live attacks marks a shift toward adversaries customising red-team tooling for illicit use.