#threatreport #HighCompleteness
[Op Report] From SSA Phish to AdaptixC2: A Multi-RAT Intrusion | 11-06-2026
Source:
blog.deception.pro/blog/xwor…
Key details below ↓
💀Threats:
Adaptixc2_tool, Xworm_rat, Screenconnect_tool, Right-to-left_override_technique, Typosquatting_technique, Phantom_stealer, Pingcastle_tool, Mimikatz_tool, Tinba, Spear-phishing_technique, Credential_dumping_technique,
🎯Victims: Healthcare
🏭Industry: Healthcare
🌐Geo: United states, Polish
📚TTPs:
⚔️Tactics: 3
🛠️Technics: 9
🧨IOCs:
- Domain: 9
- File: 15
- IP: 3
- Url: 10
- Hash: 5
- Path: 3
- Registry: 2
- Command: 2
💽Software: WordPress, Active Directory, Telegram, Windows Powershell
🔢Algorithms: sha256, zip
🔠Functions: RPC
📜Programming Languages: php, powershell
💻Platforms: x86
#threatreport:
In mid-May 2026, a sophisticated commodity intrusion was executed using a multi-layered approach involving malware and remote access tools within a Microsoft Active Directory environment in the healthcare sector. The attack process began with a well-crafted phishing email impersonating the Social Security Administration (SSA), which included a link to a RAR archive hosted on a compromised WordPress site. This archive contained a PE32 executable disguised as a PDF using a right-to-left override (RTLO) filename trick, allowing it to evade detection.
The attacker used AdaptixC2 as the primary command-and-control (C2) infrastructure, employing additional tools such as XWorm for redundant access and Telegram for exfiltration, alongside two independent instances of ScreenConnect for interactive control. Initial compromise involved the phishing email leading to the delivery of a malicious DLL (jli.dll), which was dropped in the user’s public documents. The operator subsequently used the Windows certutil command to download AdaptixC2 components from a specified URL, facilitating the establishment of persistence and further payloads. Over the engagement, multiple Staging variants of AdaptixC2 were launched, exhibiting beaconing behavior to specific IP addresses through HTTPS.
Utilizing TLS inspection provided insights into the C2 traffic, revealing the actual URLs and beacons in plaintext, contributing to effective attribution of the activity. The reconnaissance phase involved mapping out the domain using SAMR and LSAD, allowing the attacker to gather detailed information about domain users, groups, and trust relationships, crucial for lateral movement.
The primary C2 framework, AdaptixC2, exhibited a distinctive beaconing pattern characterized by specific HTTP POST requests to endpoints such as /updates/check.php. XWorm, deployed as a DLL, provided additional access capabilities and utilized Telegram’s Bot API for exfiltration, indicating a well-defined operational methodology. Meanwhile, ScreenConnect offered interactive access with resilience through deployment across multiple domains, complicating attempts to sever attacker access.
Given the complexity of the attack, it reflects an adaptive intrusion strategy where initial access relies on social engineering rather than advanced technical exploits. The use of RTLO to disguise executables remains a reliable tactic to bypass user vigilance, while the presence of non-detectable hashes for the payload in VirusTotal emphasizes the need for behavioral detection and network monitoring rather than reliance on conventional file hash fingerprints. This case underscores the importance of vigilant monitoring for legitimate tools being exploited as part of malicious campaigns, particularly focusing on certificate utilities, persistence mechanisms, and C2 behavior linked to known malware families.