216.73.216.6

Using KATA and KEDR to detect the AdaptixC2 agent

· Published 17/04/2026 18:56 · Modified 20/04/2026 10:53

Export JSON

Essential information

Published
17/04/2026 18:56
Modified
20/04/2026 10:53
Tags
2026-04-17 adaptixc2 cloudatlas command and control coolclient credential harvesting edr lateral movement mgbot network detection post-exploitation framework powershower process injection toneshell vbcloud vbshower
Related entities
20 techniques (mitre), 8 malware

Description

is an emerging open-source rapidly adopted by threat actors in APT attacks and ransomware campaigns. Written in Go and C++, it supports Windows, macOS, and Linux with extensive modularity through Beacon Object Files (BOFs). The framework enables diverse command-and-control channels including HTTP/S, TCP, mTLS, DNS, DoH, and SMB with RC4 encryption throughout. It implements sophisticated evasion techniques targeting both systems and endpoint defenses. Despite advanced obfuscation capabilities, network-level detection remains viable through analysis of distinctive communication patterns, header structures, and behavioral indicators. The framework supports via LSASS dumping, LAPS exploitation, and Kerberos attacks, alongside defense evasion through and via WinRM and PsExec. Combined NDR and solutions provide effective multi-layered detection coverage against operations across network ...

External references