Open-Source AdaptixC2 Hacking Framework Adopted by Russian Cybercriminals and Akira Ransomware

According to Silent Push, AdaptixC2, a legitimate open‑source post‑exploitation framework, is being repurposed by cybercriminals, with activity centred on threat actors linked to Russia. The tool, originally designed for red‑team operations and written in Golang with a C++/Qt interface for cross‑platform use, has increasingly become a weapon of choice in global ransomware campaigns, including those involving Akira ransomware.

The report notes that CountLoader malware has served as a delivery vector, with malicious AdaptixC2 payloads hosted on attacker infrastructure and used to maintain access and exfiltrate data before encryption. A key developer identified is a GitHub user and Telegram channel operator known as “RalfHacker,” who described himself as a penetration tester and “maldev,” with two linked email addresses appearing in a leaked RaidForums database.

The investigation also highlighted a Russian‑language Telegram channel advertising AdaptixC2 updates, tying the tool’s use to Russia’s criminal ecosystem, and it concluded with moderate confidence that there are non‑trivial ties between the developer and Russian cybercrime networks. The article further warns that threat actors may disguise their activities as red teaming, raising red flags for cybersecurity defenders.