AdaptixC2Malware
AdaptixC2 is a open-source post-exploitation and adversarial emulation framework that lets penetration testers control compromised hosts and execute system actions. While being created for red-teaming it is also used by threat actors for attacks.From MISP Galaxy
Last reported yesterday, by The Hacker News13 reports
ATT&CK techniques
6 of 116 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1110Brute Force
“…Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.”
- T1219Remote Access Tools
“Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.”
- T1036Masquerading
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1505.003Web Shell
“… automated execution scanned 4,708 targets, confirming access to 429 WordPress administration panels, followed by the deployment of 32 web shells in a 61-second window.”
- T1003.001LSASS Memory
“T1003.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
13 reports, newest first · the exact sentence from each-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“…te access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“…nt access to corporate networks via OpenConnect VPN as well as installation of Remote Monitoring and Management (RMM) tools as well as AdaptixC2”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“Installing AdaptixC2 for command-and-control (C2).”
-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“Attackers Exploit PaperCut Flaws to Deliver AdaptixC2 — In late August 2026, threat actors exploited CVE-2026-82078 and CVE-2026-81578, two PaperCut MF vulnerabilities, as zero-days to load an in-memory Java loader, which in turn deployed a web shell.”
-
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline“…a a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework, and leveraging an AI-assisted development workflow.”
-
Should you care about an “AI slowdown?”“Meanwhile, The Gentlemen relies on legitimate red-teaming frameworks like AdaptixC2 to blend in, making lateral movement difficult to detect.”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“In addition, as shown in Figure 12, we found that The Gentlemen uses the open-source AdaptixC2 framework for command-and-control (C2) operations.”
-
Exploits and vulnerabilities in Q2 2026“Sliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“Two observed variants deliver AdaptixC2, while a third variant delivers Beagle, a backdoor documented recently with the domains being registered under NameSilo.”
-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener”
-
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise“…ng revealed identical server configurations across both nodes, a fingerprint inconsistent with commodity nginx and consistent with the AdaptixC2 framework, an open-source Go C&C toolkit.”
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira”
Indicators in its reports
named in the reports above- opmanager[.]proin 2 reports
- ip-scanner[.]orgin 2 reports
- 170.130.55[.]223in 2 reports
- 188.40.187[.]145in 2 reports
- 109.205.195[.]211in 2 reports
- ev2sirbd269o5j[.]orgin 2 reports
- 2rxyt9urhq0bgj[.]orgin 2 reports
- 172.96.137[.]160in 2 reports
- 193.242.184[.]150in 2 reports
- 185.174.100[.]203in 2 reports
- 186b26df63df3b73…c1936f0aa5dain 2 reports
- a6df0b49a5ef9ffd…eb1914945331in 2 reports
- de730d969854c369…9fff6edce19din 2 reports
Copy these 13 indicators · defanged
Thanks — we review every report.