A surge in cybercriminal abuse of AdaptixC2, a free adversarial emulation framework created initially for penetration testers, has been detected in active ransomware operations. The tool, widely used for ethical security testing, is now appearing in malicious campaigns worldwide. Its deployment accelerated shortly after new detection signatures were released, linking it to CountLoader, a malware loader first highlighted in August 2025. This development was detailed in a new analysis published today by Silent Push researchers. Ransomware Groups Turn to Legitimate Tools AdaptixC2 operates as an extensible post-exploitation platform, with a Golang-based server and a GUI built in C++ and QT for cross-platform use. Security teams employ it to simulate intrusions and test defenses. However,…