REPORT
Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure
In-depth forensic review of an exposed threat staging server running AdaptixC2, Cobalt Strike 4.9.1, and weaponized Rogue MySQL arbitrary file read attacks.
RedHydra Adaptix & Cobalt Strike Cluster
Targeted reconnaissance, access brokerage, and exploitation of public health and municipal infrastructure.
China / Asia-Pacific
Active: 2026-05 → 2026-08
Aliases: RedHydra-C2, RRR_C2 Cluster, UNC-10142
Key Operational Findings
- Infrastructure Staging: Host
101[.]42[.]255[.]92operates as a centralized Command & Control hub and offensive staging node hosted on Tencent Cloud. - Dual C2 Backbone: Runs Cobalt Strike 4.9.1 on port
8081alongside the modern AdaptixC2 and customizedRRR_C2_v1.2frameworks. - Specialized Protocol Attack: The cluster leverages Rogue MySQL Server (port 3306) to abuse MySQL’s
LOCAL INFILEprotocol feature, forcing connected Java/Spring clients to exfiltrate arbitrary files (application-dev.yml, internal.jarpackages). - Targeting Vertical: Direct reconnaissance against municipal and public health administration infrastructure (
卫生健康委员会).
Technical Telemetry & Indicators
| Indicator Type | Defanged Value | Operational Role |
|---|---|---|
| IPv4 Address | 101[.]42[.]255[.]92 | Staging, Cobalt Strike & Adaptix C2 Node |
| Port / Service | 101[.]42[.]255[.]92:8081 | Cobalt Strike TeamServer Listener |
| Port / Service | 101[.]42[.]255[.]92:3306 | Rogue MySQL Arbitrary File Exfiltration Listener |
| Port / Service | 101[.]42[.]255[.]92:8555 | JNDI / HTTP Payload Delivery |
| Port / Service | 101[.]42[.]255[.]92:8857 | Interactive Reverse Shell Listener |
| Tool Artifact | genCrossC2.Linux | Cross-platform Linux ELF Cobalt Strike Beacon Compiler |
| Tool Artifact | rogue_mysql_server | JDBC Protocol Arbitrary Client File Extraction Tool |