Real-World Exploitation of Open-Source AdaptixC2 by Threat Actors

Open-source post-exploitation framework AdaptixC2, initially developed for red-team operations, has surfaced in multiple real-world attacks over the past several months.

Unit 42 researchers first identified its deployment in May 2025, uncovering campaigns that leveraged both social engineering and AI-generated scripts to compromise Windows endpoints.

The framework’s modular architecture, encrypted configuration profiles, and fileless execution techniques have enabled adversaries to maintain persistent, covert access while evading traditional defenses.

Sophisticated Deployment via Fileless Shellcode Injection

In one documented incident, attackers initiated a compromise through a phishing campaign impersonating IT support. Victims received a Microsoft Teams “Help Desk (External)” invitation that, once accepted, launched Quick Assist.

A PowerShell loader delivered as an update.ps1 then fetched a Base64-encoded payload from Google Drive.

Without writing to disk, the script allocated memory within the PowerShell process, copied and decrypted the shellcode using a simple XOR routine, and executed it via .NET’s GetDelegateForFunctionPointer method.

To ensure persistence, the script created a startup shortcut, guaranteeing beacon activation on reboot. This memory-only approach reduced the forensic footprint and complicated detection by endpoint security products.

AdaptixC2 agents support HTTP, SMB, and TCP profiles, with the default HTTP beacon targeting 172.16.196.1:4443 via HTTPS POST requests to /uri.php.

Configuration data, including server addresses, ports, user-agent strings, and sleep/jitter delays, is encrypted with RC4.

Extraction tools replicate the framework’s own extraction logic: reading the PE file’s .rdata section, unpacking a 32-bit size field, isolating the encrypted blob, and pulling the 16-byte RC4 key that follows. With this method, defenders can automate configuration recovery and quickly identify live C2 endpoints.

AI-Assisted Script Generation and Advanced Persistence

A second case revealed the use of an AI-generated PowerShell installer combining in-memory execution with DLL hijacking.

The attacker’s script downloaded shellcode via Invoke-RestMethod, allocated execute-read-write memory regions, and invoked the payload dynamically.

For persistence, it exploited DLL hijacking in the APPDATA\Microsoft\Windows\Templates directory and added a “Updater” run-key registry entry.

Stylistic markers, verbose numbered comments, and Unicode check marks strongly indicate AI assistance, highlighting how adversaries can harness generative tools to streamline malware development.

Post-exploitation activities included standard Windows discovery commands (nltest.exe, whoami.exe, ipconfig.exe) and data exfiltration with configurable chunk sizes to blend with legitimate traffic.

AdaptixC2’s SOCKS4/5 and port-forwarding extenders further enabled lateral movement through network tunnels, even in restricted environments.

The growing prevalence of AdaptixC2 is evidenced by newly observed domains tech-system[.]online, protoflint[.]com, novelumbsasa[.]art, and others hosting beacon infrastructure.

Indicators of compromise now include a range of SHA256 hashes for scripts, DLLs, and raw shellcode, as well as YARA rules designed to detect API-hashing loaders and Go-based agents.

Security teams must adapt detection strategies to address the evolving threat. Encrypted C2 profiles can be uncovered with custom extractors, while endpoint monitoring should flag in-memory execution patterns and anomalous registry or startup modifications.

As threat actors increasingly combine open-source frameworks with AI-generated code, defenders will need both automated analysis tools and threat intelligence sharing to stay ahead of these agile, stealthy campaigns.

Indicators of Compromise

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates