Tag: adaptixc2

6 Attack Reports | 0 Vulnerabilities

Attack reports

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant d…

process injection

c2 communication

employee bonus lure

russian corporate

Published: December 3, 2025

Downloadable IOCs: 12

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like…

government targets

tomiris powershell telegram backdoor

multi-language malware

tomiris c# reverseshell

tomiris c/c++ reverseshell

tomiris python telegram reverseshell

tomiris python discord reverseshell

tomiris c# telegram reverseshell

tomiris rust downloader

tomiris python filegrabber

distopia backdoor

tomiris go reversesocks

tomiris go reverseshell

tomiris rust reverseshell

tomiris c++ reversesocks

Published: November 28, 2025

Downloadable IOCs: 66

AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies

AdaptixC2 is a lightweight, modular command-and-control framework designed for flexibility and customization. The analysis reveals its sophisticated capabilities, including multi-protocol communication, advanced evasion techniques, and a BOF execution system for extensibility. The discovery of 102 …

infrastructure analysis

Published: October 9, 2025

Downloadable IOCs: 0

CountLoader: New Malware Loader Being Served in 3 Different Versions

A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, Blac…

evasion techniques

initial access broker

Published: September 19, 2025

Downloadable IOCs: 27

AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks

AdaptixC2, an open-source post-exploitation and adversarial emulation framework, has been observed being used in real-world attacks. This versatile tool allows threat actors to execute commands, transfer files, and perform data exfiltration on compromised systems. Its open-source nature enables eas…

social engineering

data exfiltration

post-exploitation

ai-generated scripts

adversarial emulation

Published: September 10, 2025

Downloadable IOCs: 0

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

A sophisticated cyber attack campaign leveraged SEO poisoning to compromise organizations through trojanized IT management tool installers. The attack began when users searching for ManageEngine OpManager were directed to a malicious website, downloading a compromised MSI file that installed Bumble…

credential theft

lateral movement

data exfiltration

it management tools

Published: August 7, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports