Beyond Cobalt Strike: A New Open-Source Hacking Tool Is on the Rise

AdaptixC2 is an open-source post-exploitation and adversarial emulation framework that researchers say is being increasingly abused by threat actors, expanding beyond its original use for penetration testing. According to Palo Alto Networks’ Unit 42, it has quickly become a tool of choice for attackers seeking stealth, flexibility and persistence in compromised environments.

The framework enables file and process manipulation, network tunnelling with SOCKS4/5 proxies, and a modular design with extenders and Beacon Object Files that allow custom C code to run inside a process, with beacons supporting x86/x64 and multiple delivery formats. Its configuration is encrypted and it supports various communication profiles such as HTTP, SMB and TCP.

Unit 42 tracked multiple AdaptixC2 infections in May 2025, including a social engineering scenario using a fake help desk and a PowerShell loader delivered via a multi-stage infection, and an AI-assisted PowerShell script that downloaded shellcode and achieved persistence through DLL hijacking and registry run keys.

The report notes that the rise of AdaptixC2 in the wild highlights a growing trend of attackers using customizable frameworks to evade detection and coordinate campaigns, including with other malware families such as Fog ransomware.