Using KATA and KEDR to detect the AdaptixC2 agent
Essential information
- Published
- 17/04/2026 18:56
- Modified
- 20/04/2026 10:53
- Tags
- 2026-04-17 adaptixc2 cloudatlas command and control coolclient credential harvesting edr lateral movement mgbot network detection post-exploitation framework powershower process injection toneshell vbcloud vbshower
- Related entities
- 20 techniques (mitre), 8 malware
Description
AdaptixC2 is an emerging open-source post-exploitation framework rapidly adopted by threat actors in APT attacks and ransomware campaigns. Written in Go and C++, it supports Windows, macOS, and Linux with extensive modularity through Beacon Object Files (BOFs). The framework enables diverse command-and-control channels including HTTP/S, TCP, mTLS, DNS, DoH, and SMB with RC4 encryption throughout. It implements sophisticated evasion techniques targeting both network detection systems and endpoint defenses. Despite advanced obfuscation capabilities, network-level detection remains viable through analysis of distinctive communication patterns, header structures, and behavioral indicators. The framework supports credential harvesting via LSASS dumping, LAPS exploitation, and Kerberos attacks, alongside defense evasion through process injection and lateral movement via WinRM and PsExec. Combined NDR and EDR solutions provide effective multi-layered detection coverage against AdaptixC2 operations across network ...