Russian Ransomware Gangs Turn Open-Source AdaptixC2 Into a Potent Attack Platform

 

Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks

The open-source command-and-control (C2) framework AdaptixC2 has rapidly gained attention — not just among ethical hackers, but increasingly among Russian-linked ransomware operators exploiting it for sophisticated cyberattacks.

Originally developed as a legitimate tool for penetration testing and adversarial emulation, AdaptixC2 was designed to offer extensibility and ease of use for red team operations. The framework’s server component is built in Golang, while its graphical client is written in C++ using Qt, ensuring cross-platform compatibility for security professionals.

A Powerful Tool With Dangerous Potential

AdaptixC2 offers an extensive suite of features typical of modern C2 platforms, including fully encrypted communications, remote command execution, credential and screenshot managers, and terminal access. The project first appeared publicly on GitHub in August 2024, released by a user known as “RalfHacker” (@HackerRalf on X), who identifies as a penetration tester, red team operator, and “MalDev” — shorthand for malware developer.

However, what began as an open-source ethical hacking framework has quickly drawn the attention of cybercriminals. Over the past few months, AdaptixC2 has been adopted by multiple threat actors, including groups associated with the Fog and Akira ransomware operations. It has also been observed in use by initial access brokers, leveraging CountLoader to deploy various post-exploitation payloads.

Rapid Criminal Adoption and Abuse

Researchers from Palo Alto Networks Unit 42 recently detailed the technical capabilities of AdaptixC2, describing it as a modular and highly adaptable C2 framework capable of “comprehensively controlling impacted machines.” Attackers have already weaponized it in social engineering campaigns, such as fake Microsoft Teams help desk calls and AI-generated PowerShell scripts, to gain unauthorized access and persistence within victim environments.

Despite its original intent as a tool for legitimate security testing, AdaptixC2’s flexibility and open-source availability have made it an attractive choice for ransomware affiliates and criminal operators.

Investigations Link Developer to Russian Underground

Cybersecurity firm Silent Push initiated an investigation into the framework after noting RalfHacker’s self-described “MalDev” persona on GitHub. Their analysis uncovered email addresses associated with multiple GitHub accounts and a Telegram channel — “RalfHackerChannel” — boasting over 28,000 subscribers. Messages reposted from the official AdaptixC2 channel indicate ongoing promotion and community engagement around the tool.

In one message posted in August 2024, RalfHacker expressed interest in developing a “public C2” similar to the Empire framework, a well-known post-exploitation tool long favored by both ethical hackers and threat actors alike.

Although there is currently no direct evidence linking RalfHacker to malicious activity involving AdaptixC2 or CountLoader, Silent Push cautioned that the developer’s connections to Russian cybercriminal circles and the tool’s increasing use among Russian-speaking threat groups are major warning signs for the security community.