Hackers Exploit AdaptixC2, an Emerging Open-Source C2 Tool

Hackers are leveraging AdaptixC2, an open-source post-exploitation and adversarial emulation framework, to control compromised endpoints, with Unit 42 researchers noting its use in real campaigns in May 2025.

According to Unit 42, the first campaign impersonated HelpDesk staff via Microsoft Teams to prompt Quick Assist remote sessions, enabling a PowerShell loader to fetch an XOR-encoded payload, decrypt and inject shellcode, and deploy an HTTP beacon with a legitimate SSL endpoint, while persistence was achieved through a startup-folder shortcut.

The second campaign reportedly involved AI-assisted, multi-stage PowerShell installers that downloaded Base64-encoded shellcode, allocated memory, and executed shellcode via GetDelegateForFunctionPointer, with DLL hijacking and a registry Run key providing persistence. AdaptixC2 supports various beacons and communication options, including HTTP-based beacons, named-pipe SMB listeners, and direct TCP connections, and its RC4-encrypted configuration can be decrypted to reveal servers and timing details.

Defence guidance highlights monitoring for in-memory RC4 decryption, dynamic invocation, unusual PowerShell memory use, and atypical HTTP requests, while noting AdaptixC2’s open-source nature enables rapid behavioural analysis and community sharing of indicators. If a compromise is suspected, Unit 42 Incident Response is advised.