GeckoDroid

GeckoDroid Mobile client for Adaptix C2 Framework. Full operator access from your Android device. What it does GeckoDroid gives you control over your Adaptix C2 server from anywhere. Instead of sitting at your desktop client, you can manage operations on the go. Agents - See all connected agents...

Maverick

Maverick Un agente de C2 de Adaptix construido con Crystal Palace: un enlazador PIC Código Independiente de Posición personalizado y un sistema de módulos PICO. Demuestra cómo construir agentes de shellcode modulares donde cada componente transporte, tareas, ofuscación es un blob PICO separado qu...

Cheshire

Cheshire 面向 Adaptix 的预检载荷质量保证，由 LitterBox 驱动。 Cheshire 是一个 Adaptix C2 服务插件，它将 Adaptix 客户端连接到 LitterBox 沙箱。操作员可以在 Adaptix UI 内部选取任意二进制文件，将其提交至 LitterBox 的完整分析链（静态 + 动态 + 每个可达的 EDR 配置文件），并在不离开 Adaptix 的情况下观察判定结果。 名称遵循项目吉祥物的谱系： Adaptix → 变色龙 LitterBox → 暴躁猫 连接两者的桥梁 → Cheshire （那只咧嘴笑、时隐时现、告诉你前路是否安全的猫...

Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2

Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code VS Code tunnels for remote access. Zscaler ThreatLabz, which...

Tomiris wreaks Havoc: New tools and techniques of the APT group

While tracking the activities of the Tomiris threat actor, we identified new malicious operations that began in early 2025. These attacks targeted foreign ministries, intergovernmental organizations, and government entities, demonstrating a focus on high-value political and diplomatic...

Russian Hackers Exploit Adaptix Pentesting Tool in Ransomware Attacks

Silent Push wars of Russian hackers exploiting Adaptix, a pentesting tool built for Windows, Linux, and macOS, in ransomware campaigns...

CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader

Cybersecurity researchers have discovered a new malware loader codenamed CountLoader that has been put to use by Russian ransomware gangs to deliver post-exploitation tools like Cobalt Strike and AdaptixC2, and a remote access trojan known as PureHVNC RAT. "CountLoader is being used either as par...