Weekly Threat Briefing: September 8 - 12, 2025

Every week, eSentire’s Threat Response Unit (TRU) compiles the following threat intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.

AdaptixC2: Emerging Open-Source Attack Framework Detected in Active Campaigns 

Bottom Line: AdaptixC2 is a sophisticated open-source post-exploitation framework actively in use by threat actors, featuring modular architecture for custom payloads, advanced system control, and stealthy attack techniques. Publicly reported incidents highlight its use in social engineering scenarios and use of AI-generated scripts for persistent system access.

On September 10th, 2025, Unit 42 published a detailed analysis of AdaptixC2, an open-source post-exploitation and adversarial emulation framework that Unit 42 observed being used in real-world attacks in May 2025. The framework’s modular design, multiple beacon communication profiles, and support for fileless and on-disk payloads make it attractive to both low-skilled and sophisticated threat actors. The framework supports multiple payload formats, including standalone executables (EXEs), Dynamic Link Libraries (DLLs), service executables, and raw shellcode, and it can support both x86 and x64 architectures.

AdaptixC2 uses modular “extenders” that allow attackers to add custom listeners and agents, and it supports Beacon Object Files (BOFs) to run small C programs inside an agent process to evade detection. The framework supports three primary beacon communication profiles; BEACON_HTTP, BEACON_SMB, and BEACON_TCP. The HTTP profile is highly configurable with server lists, ports, URIs, HTTP methods, headers, and user-agent strings.

Unit 42 researchers observed two distinct attack scenarios involving AdaptixC2 in May 2025. The first scenario involved social engineering through fake IT support calls via Microsoft Teams, where attackers used legitimate remote assistance tools like Quick Assist to gain initial access before deploying the AdaptixC2 beacon. The attackers deployed the AdaptixC2 beacon using a multi-stage PowerShell loader that downloaded an encoded and encrypted payload from a legitimate service link.

After successfully deploying AdaptixC2, the attackers conducted reconnaissance activities by using command-line tools to gather information about the compromised systems and networks. The beacon then established communication with a remote server, allowing the threat actors to gain control over the infected machine. The second scenario utilized an AI-generated PowerShell script for deployment, combining both in-memory shellcode injection and DLL hijacking for persistence.

Unit 42 has identified several configurable Operational Security (OpSec) features within AdaptixC2, including the KillDate and WorkingTime parameters, as well as options for SOCKS4/5 proxying and port forwarding. These features assist attackers in maintaining covert communication and circumventing network restrictions. According to Unit 42's telemetry, there is an increasing number of AdaptixC2 servers and domains being utilized by operators. The framework has also been observed in multi-stage intrusions, which have included the deployment of Fog ransomware.

Threat actors have increasingly leveraged AI-assisted code generators to accelerate the development of malware payloads, allowing them to produce evasive scripts far more quickly than with traditional methods. One example of this is an incident observed by the Threat Response Unit where an LLM may have been utilized to convert a C-based malware to Python. 

eSentire’s Threat Intelligence team assesses with high confidence that threat actor use of AI for malware development will continue, increasing both the speed and volume of malicious tooling. The Threat Intelligence team is actively monitoring this topic and exploring new detection opportunities.

Learn more in the full threat briefing here.

npm Supply Chain Attack   

Bottom Line: A large-scale supply chain attack was recently identified, involving the compromise of popular npm packages that were injected with malware. The financially motivated attack was designed to intercept and hijack cryptocurrency payments, rerouting them to attacker-controlled wallets.

On September 8th, 2025, Aikido published a report, indicating that a series of packages were pushed to Node Package Manager (npm), which contained malicious code. The malicious activity was initially detected by Aikido on September 8th, at 13:16 UTC, and impacted at least 18 popular npm packages which have a total of over 2 billion downloads per week. The malicious code would be executed on any web browsers loading the impacted website, which can be used to intercept crypto and web3 activity within the browser, enabling threat actors to manipulate cryptocurrency transactions for users who accessed the compromised applications over the web.

The supply chain attack began with a phishing email that targeted the maintainers of the npm packages, using a lure stating that the user’s Two-Factor Authentication (2FA) needed to be updated. The phishing email reported by Aikido targeted the maintainer Qix, who later confirmed on Bluesky that they had been phished, resulting in their npm account being compromised. Qix confirmed that they were actively working on mitigating the attack by removing the compromised packages.

Further analysis of the activity determined that malicious code was injected into the Index.js file of impacted npm packages, which acted as a web browser-based interceptor, with capabilities to hijack network traffic and application APIs for web browsers that visit the impacted website.

The main objective of the campaign appears to have involved intercepting and rewriting content relating to cryptocurrency activity, with the malware targeting Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash transactions. The malware locates sensitive identifiers within observed transactions, such as payment destinations and approval targets, and swaps them for attacker-controlled addresses, resulting in cryptocurrency theft by routing funds to the attacker.

On September 9th, 2025, Socket reported that the maintainers of the DuckDB npm packages confirmed to have also been compromised in the same manner, providing a screenshot of an identical phishing email that they had received.

After gaining access to the duckdb_admin account, the threat actors published malicious versions of DuckDB-related packages, which contained the same malicious code identified by Aikido. DuckDB confirmed that they detected the activity within a few hours, and have since removed the malicious packages, replacing them with updated safe versions.

Given the scope of the campaign, eSentire's Threat Intelligence team assesses that more developers were likely targeted, and there may likely be more compromised npm packages that have not yet been reported. eSentire published an advisory for this supply chain attack on September 9th, 2025, which provides a list of the reported packages that have been impacted.

eSentire MDR for Endpoint has detected instances of the compromised npm packages in the wild. Organizations should review the list of packages to confirm if any are utilized within the environment, and if they are running impacted versions.

Organizations should also utilize a package lock file and enforce pinned versions, to prevent unwanted updates for utilized packages. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.

Learn more in the full threat briefing here.

China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations 

Bottom Line: The United States' House Select Committee on China published a press release, warning of ongoing cyber-espionage campaigns linked to the Chinese state-sponsored threat actor APT41. These operations targeted U.S. policy and trade negotiations through impersonation and attempted to compromise individuals and organizations.

On September 8th, 2025, the House Select Committee on China warned about ongoing cybercriminal operations linked to the Chinese Communist Party (CCP), attributing the activity to the state-sponsored threat group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, and Double Dragon). The threat actors impersonated the Committee Chairman, John Moolenaar, and targeted individuals and organizations involved in the United States (U.S.)-China trade policy and diplomacy. The Committee is coordinating with the Federal Bureau of Investigation and the U.S. Capitol Police to mitigate the threat. 

Through phishing emails containing malicious files and links, APT41 tricked recipients into interacting with the content, enabling the attackers to gain unauthorized access to their systems. The target individuals and organizations include U.S. government agencies and business organizations, D.C.-based law firms and think tanks, and at least one foreign government.

According to the Committee’s analysis, APT41 exploited software and cloud services to conceal their activities while attempting to steal sensitive information. The group used developer tools to establish hidden channels and covertly transfer data to their servers. The Committee concludes that these campaigns were designed to influence U.S. policy discussions and negotiation strategies, to gain an advantage in trade and foreign affairs.

The press release states that the reported incidents follow a spear-phishing campaign in January 2025, which targeted four Select Committee members overseeing investigations into Shanghai Zhenhua Heavy Industries (ZPMC), a Chinese state-owned manufacturing enterprise. Threat actors posed as a ZPMC North America representative and attempted to steal Microsoft credentials via a file-sharing lure.

In February 2024, a congressional investigation into cargo cranes manufactured by ZPMC and installed at U.S. ports uncovered communications equipment unrelated to standard operations, raising concerns that the foreign-made machines could present a hidden national security threat. 

Mitigating such threats remains difficult given the lack of accountability demonstrated by Chinese authorities in cooperating with investigations. Nevertheless, it is crucial for organizations to strengthen their defenses against potential APT attacks.

Recommended measures include implementing effective vulnerability and patch management programs, educating employees on phishing tactics and reporting procedures, deploying robust Endpoint Detection and Response (EDR) solutions, and safeguarding critical assets through network segmentation and strict access control policies.

Learn more in the full threat briefing here.

About the eSentire Threat Response Unit (TRU)

Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.