Threat Level: High
Category: Command & Control (C2) Framework / Post-Exploitation Platform
Audience: SOC Analysts, Threat Hunters, Incident Responders, Detection Engineers, Network Security Teams
Executive Summary
AdaptixC2 is an open-source command-and-control (C2) and post-exploitation framework originally designed for authorized red team operations that is increasingly being observed in real-world threat actor campaigns. Security researchers from Palo Alto Unit 42 documented multiple intrusions leveraging AdaptixC2, demonstrating that the framework has moved beyond adversary emulation into active malicious operations.
Like Cobalt Strike, AdaptixC2 provides operators with remote command execution, file transfer capabilities, lateral movement functionality, SOCKS proxying, port forwarding, process manipulation, and extensible in-memory modules. The framework supports multiple communication channels including HTTP/S, SMB, DNS/DoH, and TCP/mTLS, allowing attackers to tailor communications to the target environment.
The primary concern for defenders is that AdaptixC2 is free, actively maintained, modular, highly customizable, and supports modern evasion techniques that reduce the effectiveness of signature-based detection approaches.
Key Capabilities
AdaptixC2 provides operators with:
- Remote command execution
- Interactive shell access
- File upload/download capabilities
- Process enumeration and termination
- Credential collection support
- SOCKS4/SOCKS5 proxying
- Local and reverse port forwarding
- Agent pivoting and chaining
- SMB beacons
- HTTP/HTTPS beacons
- DNS/DoH communication channels
- Beacon Object File (BOF) execution
- Encrypted communications
- Multi-hop lateral movement functionality
- Configurable kill dates and operating schedules
MITRE ATT&CK Mapping
| Tactic | Technique | Description |
| Initial Access | T1566 | Phishing / Social Engineering |
| Execution | T1059.001 | PowerShell |
| Execution | T1106 | Native API |
| Defense Evasion | T1027 | Encrypted Payloads |
| Defense Evasion | T1055 | Process Injection |
| Persistence | T1547 | Registry Run Keys |
| Persistence | T1574 | DLL Search Order Hijacking |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Credential Access | T1003 | OS Credential Dumping |
| Lateral Movement | T1021.002 | SMB/Windows Shares |
| Command & Control | T1071.001 | Web Protocols |
| Command & Control | T1090 | Proxy |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
Observed Attack Chains
Campaign #1 (Unit 42)
Initial Access
- Threat actor impersonated IT support.
- Victim received a Microsoft Teams “Help Desk (External)” request.
- Quick Assist used for remote access.
Payload Delivery
PowerShell script downloaded:
update.ps1
The script retrieved a Base64/XOR encoded shellcode payload from Google Drive.
Execution
The loader:
- Allocated executable memory
- Decrypted shellcode in memory
- Executed shellcode directly through .NET delegates
- Avoided writing payloads to disk
Persistence
Startup shortcut created in:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
Campaign #2
Fileless Installation
PowerShell-based installer:
- Downloaded encrypted Adaptix payloads
- Used memory allocation APIs
- Executed shellcode directly in memory
Persistence
Observed:
Registry Run Key
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value:
Updater
DLL Hijacking
%APPDATA%\Microsoft\Windows\Templates\msimg32.dll
Detection Opportunities
Network-Based TTPs
HTTP/S Beaconing
Look for:
- Consistent HTTPS POST requests
- Low-byte periodic traffic
- Sleep/jitter beacon patterns
- Custom HTTP headers
Known observed header:
Beacon-Id
Observed URI:
/uri.php
SMB Pivoting
AdaptixC2 supports:
- SMB beacons
- Named pipe communications
- Internal lateral movement channels
Monitor:
- Unusual SMB traffic
- Named pipe creation
- Workstation-to-workstation SMB connections
Proxy and Tunneling
Monitor for:
- Unauthorized SOCKS proxies
- Reverse port forwarding
- Internal pivot behavior
- Multi-hop communication chains
Host-Based Detection Opportunities
Suspicious PowerShell Activity
Look for:
VirtualAlloc
VirtualProtect
Invoke-RestMethod
GetDelegateForFunctionPointer
Marshal.Copy
CreateThread
Indicators of:
- Shellcode loading
- Memory-only execution
- Reflective loading
Memory Injection
Monitor EDR telemetry for:
- RWX memory allocations
- PowerShell spawning unmanaged code
- Reflective DLL loading
- In-memory PE execution
DLL Search Order Hijacking
Watch for:
msimg32.dll
Located outside standard Windows system directories. Particularly:
%APPDATA%\Microsoft\Windows\Templates\
Indicators of Compromise (IOCs)
Network Indicators
AdaptixC2 Default HTTP Profile
Observed:
URI: /uri.php
Header: X-Beacon-Id
Protocol: HTTPS POST
Observed AdaptixC2 Infrastructure
Threat hunting reference IPs identified through Hunt.io and OTX analysis:
45.80.158.57
209.250.247.174
31.169.126.162
36.133.13.147
38.132.122.180
43.140.221.154
45.136.29.64
45.138.16.95
45.155.53.153
20.118.226.163
These should be treated as historical threat-hunting indicators and not used as standalone blocking criteria. Infrastructure frequently changes.
Real-World AdaptixC2 Infrastructure Observed in Attacks
Additional infrastructure observed in threat actor operations:
83.142.209.11
AdaptixC2 C2 server identified during the TeamPCP supply-chain campaign.
Registry Indicators
Potential persistence:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater
File Indicators
Observed filenames:
update.ps1
loader.ps1
msimg32.dll
Sigma Hunting Ideas
PowerShell Memory Injection
selection:
Image|endswith:
– powershell.exe
CommandLine|contains:
– VirtualAlloc
– VirtualProtect
– GetDelegateForFunctionPointer
condition: selection
Registry Persistence
selection:
TargetObject|contains:
– CurrentVersion\Run
Details|contains:
– Updater
condition: selection
Suspicious Beaconing
selection:
Url|contains:
– /uri.php
condition: selection
Defensive Recommendations
Immediate Actions
- Hunt for PowerShell processes performing memory allocations.
- Search logs for HTTP POST requests containing X-Beacon-Id.
- Audit Registry Run keys for suspicious persistence mechanisms.
- Inspect DLLs resident in user profile application directories.
- Monitor SMB named pipe activity between endpoints.
- Baseline and alert on SOCKS proxy activity.
- Review Quick Assist and remote assistance sessions for abuse.
- Deploy detections for in-memory shellcode execution patterns.
- Block unauthorized outbound communications to unknown cloud-hosted C2 nodes.
- Incorporate AdaptixC2 TTPs into MITRE ATT&CK-based threat hunting programs.
Analyst Assessment
AdaptixC2 should be viewed as an emerging successor-class framework to Cobalt Strike, Havoc, and Sliver. While it lacks the historical prevalence of Cobalt Strike, its open-source availability, active development, multi-protocol communications, BOF support, encrypted configurations, and demonstrated use in real-world intrusions make it a significant threat platform for enterprise defenders. Organizations heavily focused on detecting Cobalt Strike beacons should broaden detection strategies to include AdaptixC2 behavioral indicators and hunting techniques.
Need Assistance or Want to Discuss Further?
Contact Blackswan Cybersecurity at 855-BLK-SWAN or Contact@BlackswanCybersecurity.com