eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
AdaptixC2: Emerging Open-Source Attack Framework Detected in Active Campaigns
Bottom Line: AdaptixC2 is a sophisticated open-source post-exploitation framework actively in use by threat actors, featuring modular architecture for custom payloads, advanced system control, and stealthy attack techniques. Publicly reported incidents highlight its use in social engineering scenarios and use of AI-generated scripts for persistent system access.
On September 10th, 2025, Unit 42 published a detailed analysis of AdaptixC2, an open-source post-exploitation and adversarial emulation framework that Unit 42 observed being used in real-world attacks in May 2025. The framework’s modular design, multiple beacon communication profiles, and support for fileless and on-disk payloads make it attractive to both low-skilled and sophisticated threat actors. The framework supports multiple payload formats, including standalone executables (EXEs), Dynamic Link Libraries (DLLs), service executables, and raw shellcode, and it can support both x86 and x64 architectures.
AdaptixC2 uses modular “extenders” that allow attackers to add custom listeners and agents, and it supports Beacon Object Files (BOFs) to run small C programs inside an agent process to evade detection. The framework supports three primary beacon communication profiles; BEACON_HTTP, BEACON_SMB, and BEACON_TCP. The HTTP profile is highly configurable with server lists, ports, URIs, HTTP methods, headers, and user-agent strings.
Unit 42 researchers observed two distinct attack scenarios involving AdaptixC2 in May 2025. The first scenario involved social engineering through fake IT support calls via Microsoft Teams, where attackers used legitimate remote assistance tools like Quick Assist to gain initial access before deploying the AdaptixC2 beacon. The attackers deployed the AdaptixC2 beacon using a multi-stage PowerShell loader that downloaded an encoded and encrypted payload from a legitimate service link. After successfully deploying AdaptixC2, the attackers conducted reconnaissance activities by using command-line tools to gather information about the compromised systems and networks. The beacon then established communication with a remote server, allowing the threat actors to gain control over the infected machine. The second scenario utilized an AI-generated PowerShell script for deployment, combining both in-memory shellcode injection and DLL hijacking for persistence.
Unit 42 has identified several configurable Operational Security (OpSec) features within AdaptixC2, including the KillDate and WorkingTime parameters, as well as options for SOCKS4/5 proxying and port forwarding. These features assist attackers in maintaining covert communication and circumventing network restrictions. According to Unit 42's telemetry, there is an increasing number of AdaptixC2 servers and domains being utilized by operators. The framework has also been observed in multi-stage intrusions, which have included the deployment of Fog ransomware.
eSentire Threat Intelligence Analysis:
AdaptixC2’s open-source nature, modular architecture, and multi-format payload support lower the bar for threat actors to adopt and customize the framework, which increases the likelihood of broader, faster adoption across threat actors. In May 2025, Symantec identified Fog ransomware operators deploying a legitimate employee monitoring software called Syteca and multiple open-source pentesting tools such as GC2, Adaptix, and Stowaway as part of their ransomware deployment chain. A separate analysis by The DFIR Report found that Akira ransomware utilized trojanized IT software installers to spread the Bumblebee malware loader. This loader used the AdaptixC2 tool to maintain persistence and conduct reconnaissance, which ultimately led to the delivery of the main payload. The observed integration of AdaptixC2 into ransomware attack chains highlights how adversaries are increasingly turning to open-source offensive tools to strengthen their post-exploitation capabilities. These incidents demonstrate that open-source red team frameworks are an integral component in ransomware operations. This adoption accelerates attacks, streamlining persistence and reconnaissance, and lowering the development and operational costs for threat actors.
The use of social engineering through Microsoft Teams to persuade victims to execute Remote Monitoring and Management (RMM) tools indicates that defenders need to monitor user-facing collaboration platforms for suspicious messages and followed by pivot to remote assistance tools. Legitimate RMM tools, like Quick Assist, have been abused by threat actors to provide an easy method of accessing a compromised device. Due to the widespread use of these tools, they can easily blend into an organization’s typical usage, making it more difficult to detect malicious activity. Organizations can take proactive measures by implementing technical controls that restrict the use of certain tools on their systems or by blocking connections to known RMM-related infrastructure. Additionally, deploying Endpoint agents on all supported assets within the organization can significantly aid in the identification and containment of threats. User training is a crucial component of protection that organizations should implement. In incidents where a user is tricked by an executable file pretending to be a legitimate file, it is important for users to learn how to recognize such deceptive tactics and have the means to report them. Ongoing education is essential to keep users informed about the latest methods employed by threat actors.
Threat actors have increasingly leveraged AI-assisted code generators to accelerate the development of malware payloads, allowing them to produce evasive scripts far more quickly than with traditional methods. One example of this is an incident observed by the Threat Response Unit where an LLM may have been utilized to convert a C-based malware to Python.
eSentire’s Threat Intelligence team assesses with high confidence that threat actor use of AI for malware development will continue, increasing both the speed and volume of malicious tooling. The Threat Intelligence team is actively monitoring this topic and exploring new detection opportunities.
npm Supply Chain Attack
Bottom Line: A large-scale supply chain attack was recently identified, involving the compromise of popular npm packages that were injected with malware. The financially motivated attack was designed to intercept and hijack cryptocurrency payments, rerouting them to attacker-controlled wallets.
On September 8th, 2025, Aikido published a report, indicating that a series of packages were pushed to Node Package Manager (npm), which contained malicious code. The malicious activity was initially detected by Aikido on September 8th, at 13:16 UTC, and impacted at least 18 popular npm packages which have a total of over 2 billion downloads per week. The malicious code would be executed on any web browsers loading the impacted website, which can be used to intercept crypto and web3 activity within the browser, enabling threat actors to manipulate cryptocurrency transactions for users who accessed the compromised applications over the web.
The supply chain attack began with a phishing email that targeted the maintainers of the npm packages, using a lure stating that the user’s Two-Factor Authentication (2FA) needed to be updated. The phishing email reported by Aikido targeted the maintainer Qix, who later confirmed on Bluesky that they had been phished, resulting in their npm account being compromised. Qix confirmed that they were actively working on mitigating the attack by removing the compromised packages.
Further analysis of the activity determined that malicious code was injected into the Index.js file of impacted npm packages, which acted as a web browser-based interceptor, with capabilities to hijack network traffic and application APIs for web browsers that visit the impacted website. The main objective of the campaign appears to have involved intercepting and rewriting content relating to cryptocurrency activity, with the malware targeting Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash transactions. The malware locates sensitive identifiers within observed transactions, such as payment destinations and approval targets, and swaps them for attacker-controlled addresses, resulting in cryptocurrency theft by routing funds to the attacker.
On September 9th, 2025, Socket reported that the maintainers of the DuckDB npm packages confirmed to have also been compromised in the same manner, providing a screenshot of an identical phishing email that they had received. After gaining access to the duckdb_admin account, the threat actors published malicious versions of DuckDB-related packages, which contained the same malicious code identified by Aikido. DuckDB confirmed that they detected the activity within a few hours, and have since removed the malicious packages, replacing them with updated safe versions.
eSentire Threat Intelligence Analysis:
Both attacks against Qix and DuckDB appear to be targeted, and part of the same widespread financially motivated supply chain attack. At the time of writing, Socket states that Blockchain analysis of the observed wallets from the campaign suggests that around $600 in stolen cryptocurrency was yielded. While reports of this attack refer to it as one of the “most widespread supply chain attack in npm’s history”, the “practical damage from the attack is almost non-existent”. This could potentially be due to the quick identification and remediation of the malicious packages, as a result of threat actors utilizing a “widely known obfuscator”, resulting in “immediate detection shortly after the malicious versions were published”. However, Wiz claims that given the prevalence of the impacted packages, and the short 2-hour timeframe that they were available, the malicious code may be “found in at least 10% of cloud environments”.
While no details on the threat actor behind the campaign have been reported, utilizing compromised npm packages for financially motivated supply chain attacks is a technique that has been associated with North Korean APT threat groups. This tactic has been observed in use by the Lazarus Group as part of the Contagious Interview campaign, with recent examples observed in April 2025 and August 2025. One notable difference between the campaigns is that Contagious Interview has been known to use the technique to steal cryptocurrency funds, along with deploying malware, such as BeaverTail and OtterCookie. Supply chain attacks are a popular attack method among threat actors, as they can allow for indirect access to numerous targets, through one compromise of a trusted vendor.
Given the scope of the campaign, eSentire's Threat Intelligence team assesses that more developers were likely targeted, and there may likely be more compromised npm packages that have not yet been reported. eSentire published an advisory for this supply chain attack on September 9th, 2025, which provides a list of the reported packages that have been impacted. eSentire MDR for Endpoint has detected instances of the compromised npm packages in the wild. Organizations should review the list of packages to confirm if any are utilized within the environment, and if they are running impacted versions. Organizations should also utilize a package lock file and enforce pinned versions, to prevent unwanted updates for utilized packages. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations
Bottom Line: The United States' House Select Committee on China published a press release, warning of ongoing cyber-espionage campaigns linked to the Chinese state-sponsored threat actor APT41. These operations targeted U.S. policy and trade negotiations through impersonation and attempted to compromise individuals and organizations.
On September 8th, 2025, the House Select Committee on China warned about ongoing cybercriminal operations linked to the Chinese Communist Party (CCP), attributing the activity to the state-sponsored threat group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, and Double Dragon). The threat actors impersonated the Committee Chairman, John Moolenaar, and targeted individuals and organizations involved in the United States (U.S.)-China trade policy and diplomacy. The Committee is coordinating with the Federal Bureau of Investigation and the U.S. Capitol Police to mitigate the threat.
Through phishing emails containing malicious files and links, APT41 tricked recipients into interacting with the content, enabling the attackers to gain unauthorized access to their systems. The target individuals and organizations include U.S. government agencies and business organizations, D.C.-based law firms and think tanks, and at least one foreign government. According to the Committee’s analysis, APT41 exploited software and cloud services to conceal their activities while attempting to steal sensitive information. The group used developer tools to establish hidden channels and covertly transfer data to their servers. The Committee concludes that these campaigns were designed to influence U.S. policy discussions and negotiation strategies, to gain an advantage in trade and foreign affairs.
The press release states that the reported incidents follow a spear-phishing campaign in January 2025, which targeted four Select Committee members overseeing investigations into Shanghai Zhenhua Heavy Industries (ZPMC), a Chinese state-owned manufacturing enterprise. Threat actors posed as a ZPMC North America representative and attempted to steal Microsoft credentials via a file-sharing lure. In February 2024, a congressional investigation into cargo cranes manufactured by ZPMC and installed at U.S. ports uncovered communications equipment unrelated to standard operations, raising concerns that the foreign-made machines could present a hidden national security threat.
eSentire Threat Intelligence Analysis:
According to the 2025 Annual Threat Assessment by the U.S. Intelligence Community, published by the Office of the Director of National Intelligence, threat actors linked to the People’s Republic of China (PRC), such as Volt Typhoon and Salt Typhoon, represent a significant risk to U.S. government systems, private sector networks, and critical infrastructure. The assessment notes that “The PRC will likely continue positioning itself to gain an advantage in any potential conflict with the United States” seeking both espionage and strategic benefits. This has been proven by the APT41-led cyberespionage campaign aiming at manipulating the U.S.-China trade talks in favour of the CCP.
A Wall Street Journal report on the APT41 campaign stated the first signs of infection appeared in July 2025, coinciding with the extension of a tariff truce until early November 2025. The phishing email urged recipients to review the attached draft legislation, stating, “Your insights are essential.” The data stolen in these campaigns can provide the CCP with valuable insights into the U.S. trade strategies and negotiation priorities, allowing the CCP to anticipate the U.S. position in the trade talks. Intelligence on business organizations, law firms, and think tanks could reveal significant influence networks, enabling China to shape the narrative in its interest.
APT41 is a prolific and unique Chinese state-sponsored threat group, active since 2007, as it is involved in conducting both cyber-espionage and financially motivated operations. The group targets healthcare, high-tech, and telecommunications sectors, with target organizations generally aligning with Chinese strategic interests. In 2020, the U.S. Department of Justice (DOJ) indicted five individuals linked to APT41 for computer intrusions impacting over 100 organizations in the United States and overseas, along with several foreign governments. Although not exclusively dedicated to state-sponsored operations, the group remains strongly supported by Chinese authorities, who leverage its capabilities to conduct espionage against the U.S. despite the indictments.
In response to the 2024 investigation into ZPMC, the company asserted that it does not pose a cybersecurity risk to the United States, while the Chinese embassy in Washington likewise denied any knowledge of the cyber activities reported by the House Select Committee on China. Mitigating such threats remains difficult given the lack of accountability demonstrated by Chinese authorities in cooperating with investigations. Nevertheless, it is crucial for organizations to strengthen their defenses against potential APT attacks. Recommended measures include implementing effective vulnerability and patch management programs, educating employees on phishing tactics and reporting procedures, deploying robust Endpoint Detection and Response (EDR) solutions, and safeguarding critical assets through network segmentation and strict access control policies.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
