Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks

AdaptixC2 is an open-source command-and-control framework that is being used by an increasing number of threat actors, including groups tied to Russian ransomware operations. The framework, designed for post-exploitation and adversarial emulation, features encrypted communications, credential and screenshot managers, a remote terminal, and a cross-platform GUI client, with the server written in Golang and the GUI in C++ QT.

It has been adopted in recent months by threat actors linked to the Fog and Akira ransomware operations, as well as by an initial access broker utilising CountLoader. According to Palo Alto Networks Unit 42, AdaptixC2 is a modular and versatile tool that can comprehensively control impacted machines and has been used in fake help desk scams via Microsoft Teams and through an AI-generated PowerShell script.

Silent Push said RalfHacker’s GitHub bio as a “MalDev” triggered an investigation, and they noted the owner’s Telegram channel and associated channels have drawn significant attention, raising red flags about ties to Russia’s criminal underground. The Hacker News reached out for comment on the matter on 30 October 2025.