MythicTool
Mythic is an open source, cross-platform post-exploitation/command and control platform. Mythic is designed to "plug-n-play" with various agents and communication channels. Deployed Mythic C2 servers have been observed as part of potentially malicious infrastructure.From MITRE ATT&CK
Last reported yesterday, by The Hacker News9 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1053.005Scheduled Task
“A separate delivery service supports phishing through malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc; its only recorded campaign was an internal self-test.”
- T1219Remote Access Tools
“Inventory remote-access tools such as SimpleHelp, MeshCentral and N-central, patch them, restrict their use and block unauthorized software”
- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1001Data Obfuscation
“…ommand and Control: Encrypted Channel: Asymmetric CryptographyThe threat actor used the GitHub API for C2, which communicates over HTTPS.T1001.003Exfiltration: Exfiltration Over Web Service: Exfiltration to Code RepositoryThe threat actor used the GitHub API to exfiltrate files t…”
- T1027Obfuscated Files or Information
“… SumatraPDF loader downloaded a second-stage shellcode from the C2 IP 58.247.193.100 which reflectively loads the AdaptixC2 Beacon agent.T1027.007Defense Evasion: Obfuscated Files or Information: Dynamic API ResolutionThe initial loader identified Windows APIs by comparing Adler-…”
- T1027.006HTML Smuggling
“A separate delivery service supports phishing through malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc; its only recorded campaign was an internal self-test.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“Other tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“Supporting tools: A Cloudflare-fronted Mythic agent (QuickLine), a Quick Heal/Seqrite killer abusing the Zemana driver, and the rks3 and BackupAgent exfiltration tools”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“New tool—Mythic Ornn: Security researcher Adrian D.”
-
July 2026 Threat Trend Report on APT Groups“…loudAtlas employed remote template injection and maintained a Google Sheets-based C2, while GOFFEE utilized legitimate utilities and the Mythic agent to conduct reconnaissance, access credentials, and carry out follow-up activities in container environments.”
-
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor“This is not typical in public C2 frameworks such as Mythic or Sliver, which generally use gRPC for internal communication between framework components.”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“This marks a departure from earlier TOSHIS versions, which delivered either a Cobalt Strike Beacon or a Merlin Mythic agentANALYST NOTE: The AES key is derived by using the Windows API function CryptDeriveKey with the MD5 hash of a hard-coded key seed "424986c3a4fddcb6".”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“ShadowSyndicate continues to be associated with toolkits including Cobalt Strike, MetaSploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent, and Brute Ratel.”
-
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist“Once we received our Poseidon payload callback to our Mythic C2 we were able to retrieve credentials using a variety of different methods provided by Poseidon.”
-
“We find many things that others do not even see”“…of a malicious server, for example, it could be running any phishing kit and popular frameworks such as Cobalt Strike, Metasploit, Beef, Mythic, and Silent Trinity.”
Indicators in its reports
named in the reports above- 45.227.254[.]43in 2 reports
- re102.fastwinnow[.]comin 1 report
- 66b2b22397cea219…fc9ca1fabed5in 1 report
- 9136ffb749c6cec1…d74c32578f52in 1 report
- 7dcabb6d07d52b92…56fc1cd2372fin 1 report
- 35ea50f16bd5c080…1ae58db0eedcin 1 report
- 759287052b8cc4f4…3a95092c6f96in 1 report
- f36bfccf944b5d1e…9d43940b1121in 1 report
- 51edd14233483bcf…7ec1bb17ce33in 1 report
- 5d53246b0e6b681b…2e829c053f85in 1 report
- 65af5c3ba2d00967…b907d492a670in 1 report
- 41748648b71a7043…a4f718e7fd91in 1 report
- f85960dee17ba587…c7f0988413f5in 1 report
- scansec-upd[.]comin 1 report
- re2.filesdwnload[.]topin 1 report
- re8.dowlfles[.]onlinein 1 report
- update19.upldf[.]onlinein 1 report
- 5.253.59[.]222in 1 report
- 94.140.114[.]192in 1 report
- 193.29.57[.]37in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.