Threat Actors Exploiting Open-Source C2 Frameworks to Deploy Malicious Payloads

Threat intelligence researchers have uncovered a growing campaign in which cybercriminals weaponise AdaptixC2, an open-source Command and Control framework initially designed for authorised penetration testers. The investigation links the framework’s development to Russian criminal networks, with claims of extensive abuse as threat actors pair AdaptixC2 with CountLoader in coordinated attacks.

According to The DFIR Report, AdaptixC2’s use by Akira ransomware affiliates has surged, and Akira ransomware alone has impacted over 250 organisations globally since March 2023, with ransomware proceeds estimated at more than $42 million USD. Silent Push threat analysts first observed AdaptixC2 abuse in August 2025, and information from OSINT site intelx[.]io corroborates connections involving a developer identified as “RalfHacker” and Russia’s cybercriminal ecosystem. Security teams are advised to monitor AdaptixC2 infrastructure vigilantly as its use in global ransomware campaigns continues to rise.