Researchers Map AdaptixC2 Capabilities and More Than 100 Active Servers

Summary

Hunt.io analyzes AdaptixC2’s beacon, evasion and pivoting features, and reports 102 active servers found through its telemetry, including 56 returning an AdaptixC2 HTTP header. The article shares hunting indicators and defensive measures.

Key points

The analysis describes HTTP, SMB named-pipe, and TCP communications, plus multi-hop pivoting and port forwarding.
AdaptixC2 supports runtime API resolution, process injection, BOF modules, file transfers, and configurable sleep schedules and kill dates.
Hunt.io reports finding 102 active servers across hosting providers in August and September 2025; 56 hosts returned an HTTP header containing “AdaptixC2.”
The researchers identified exposed directories containing deployment files, configuration data, shell histories, and compiled agents.
Server headers, ports, certificates, and TLS fingerprints can be used to hunt for and correlate related infrastructure.
Suggested defenses include monitoring unusual ports and HTTP headers, endpoint monitoring for suspicious memory activity and unsigned binaries, and network segmentation to limit SMB-based lateral movement.

Article Details

Attack Vectors: AdaptixC2 beacon communicates with operators over HTTP/HTTPS and custom headers and URIs, TCP sockets, or SMB named pipes.
The beacon supports process injection, standalone executable and service deployment, and shellcode execution.
Compromised systems can be used for TCP/UDP port forwarding and multi-hop pivoting.
The beacon supports file uploads and downloads over encrypted channels and can load additional modules through its BOF system.
Defensive Notes: Monitor unusual outbound connections and non-standard ports, HTTP headers associated with AdaptixC2, and recurring certificate names such as server.rsa.crt.
Use network segmentation to contain SMB-based lateral movement and block outbound communication from non-essential systems.
Monitor suspicious memory activity, unsigned binary execution, BOF module loads, unexpected service installations, and registry modifications.
Correlate reused HTTP headers, port combinations, and certificates; apply behavioral detection for tunneling and multi-hop C2, and isolate affected hosts for forensic analysis.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]91[.]103[.]204`	Listed as a confirmed AdaptixC2 server.
IPV4	`166[.]1[.]160[.]69`	Listed as a confirmed AdaptixC2 server.
IPV4	`185[.]196[.]10[.]96`	Listed as a confirmed AdaptixC2 server.
IPV4	`20[.]234[.]49[.]186`	Confirmed AdaptixC2 server with an exposed open directory.
IPV4	`23[.]227[.]203[.]190`	Identified as an AdaptixC2 C2 server.
IPV4	`85[.]202[.]193[.]88`	AdaptixC2 server analyzed by the researchers; exposed files and deployment traces.

MITRE ATT&CK

T1055 · Process InjectionThe article describes DLL injection and process injection as supported deployment methods.T1071.001 · Web ProtocolsThe beacon uses HTTP traffic, custom headers, and URIs for command-and-control communication.T1090.001 · Internal ProxyThe beacon uses infected systems as internal proxies for multi-hop communications to targets.T1095 · Non-Application Layer ProtocolThe beacon can use direct TCP socket connections for command and control.T1572 · Protocol TunnelingThe beacon supports tunneling and TCP/UDP port forwarding through compromised systems.

Tools

AdaptixC2AdaptixC2 is a command-and-control (C2) framework designed to be simple, flexible, and easily customizable. Unlike larger C2 platforms that can be complex and heavy, its lightweight design makes it easier for attackers Hunt.io AttackCaptureHuntSQL

Countries

Irelanddeployed. Findings pointed to servers across multiple providers and countries, including Kazakhstan, Ireland, and Switzerland, with ports such as 80, 8000, and 14531 frequently observed.Kazakhstanit's being deployed. Findings pointed to servers across multiple providers and countries, including Kazakhstan, Ireland, and Switzerland, with ports such as 80, 8000, and 14531 frequently observed.Switzerlandpointed to servers across multiple providers and countries, including Kazakhstan, Ireland, and Switzerland, with ports such as 80, 8000, and 14531 frequently observed.