YARA

MAL_AdaptixC2_Loader_Mar26

Detects AdaptixC2 loader that evades EDR via indirect syscalls, extracts a steganographic payload, decrypts it, injects into a process

2026-03-30

https://www.ox.security/blog/teampcps-telnyx-windows-malware-technical-analysis/

YARA

MAL_AdaptixC2_Agent_Oct25

Detects AdaptixC2 Agent payloads.

2025-10-10

Internal Research

YARA

HKTL_Adaptix_C2_Framework_Client_Sep25

Detects the use of Adaptix C2 Framework Client

2025-09-29

https://github.com/Adaptix-Framework/AdaptixC2

YARA

MAL_Adaptixc2_Agent_Beacon_Sep25

Detects AdaptixC2 agent beacon written in C, which is used to provide remote shell execution, process management, screenshot capture, network tunneling, and terminal sessions with Cobalt Strike BOF compatibility and encrypted communications

2025-09-17

https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/

YARA

MAL_AdaptixC2_Gopher_Beacon_Sep25

Detects AdaptixC2 beacon written in Go, which is used to provide remote shell execution, process management, screenshot capture, network tunneling, and terminal sessions with Cobalt Strike BOF compatibility and encrypted communications

2025-09-15

https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/

YARA

MAL_Adaptix_Post_Exploitation_Jul25

Detects Adaptix, an extensible post-exploitation and adversarial emulation framework made for penetration testers.

2025-07-04

https://github.com/Adaptix-Framework/AdaptixC2