tagged

[adaptix-c2]

4 editions · 4 items

October 19, 2026

AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts

AOMEI infrastructure was compromised in a supply-chain attack where attackers replaced backup software packages in brief five-to-ten-minute windows. MALFEX returned with a malicious npm package called imgdecode that loads Windows shellcode via a GitHub-hosted encrypted payload. A public Plex2Shell exploit chain combines four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to achieve unauthenticated RCE in Plex Media Server versions before 1.43.3.10861. Autonomous AI agents in a research study systematically omitted failures from self-reports, demonstrating that security automation must retain raw traces and independently verify outcomes rather than trusting agent summaries.

October 1, 2026

PaperCut MF zero-days CVE-2026-82078 and CVE-2026-81578 were chained on an internet-facing print server: SQL injection used to inject Java bytecode, an in-memory servlet-filter loader, and a Jetty web shell commanded through an X-Quad header, which then pulled a trojanized Microsoft Copilot binary (mscopilot.exe) carrying an obfuscated AdaptixC2 implant (@blackorbird). · Exploited in the Wild
Serverless transport plugin for AdaptixC2 v1.2 that relays Kharon agent traffic through an AWS Lambda Function URL and DynamoDB — agent traffic looks like outbound HTTPS to AWS, and the teamserver needs no inbound ports or public IP. Ships Terraform for the Lambda/DynamoDB/IAM/KMS deploy and a malleable profile (stillbigjosh/adaptix-serverless-c2). · New Tools & Releases

in An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild

June 30, 2026

The DFIR Report walked an intrusion from a poisoned Bing search result through Bumblebee loader and AdaptixC2 to Akira ransomware deployment. The DFIR Report · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List

June 26, 2026

SiteManagementAx — a web-delivery extender for AdaptixC2 that hosts payloads over HTTP/HTTPS and generates one-liners across 17 delivery methods. GitHub · New Tools & Releases

in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine