AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks

According to Unit 42, AdaptixC2 is a recently identified, open-source post-exploitation and adversarial emulation framework that threat actors are using in campaigns, with limited public documentation of its real‑world use. The researchers observed two infections in early May 2025, including one scenario that relied on social engineering and another that employed AI-based code generation tools to deploy beacons.

The toolkit is designed as a modular red-teaming framework that can execute a range of actions, from file and process manipulation to data exfiltration, and it supports covert tunneling through HTTP, SMB and TCP beacons via extenders and BOFs. Notably, one May 2025 case used a PowerShell loader to download and memory-load shellcode, while another case involved AI-assisted PowerShell automation and DLL hijacking for persistence.

The researchers emphasise that AdaptixC2’s open-source nature enables threat actors to customise payloads and evasion techniques, illustrating a broader trend toward configurable post-exploitation frameworks in the wild.