Loading malware…
Mythic is an open-source, cross-platform post-exploitation and command-and-control framework developed for red-team operations but widely adopted by malicious actors in real intrusions. It uses an agent-agnostic, modular architecture in which the management platform is separated from payloads, allowing operators to deploy different agents across multiple operating systems and communication profiles. Publicly documented agents include Apollo for Windows, Poseidon for macOS and Linux, and Apfell for macOS, while threat actors have also used custom Mythic-compatible agents.
Mythic supports command-and-control over multiple protocols including HTTP, TCP, DNS, and SMB, and provides file transfer functionality with configurable chunk sizes for uploads and downloads. Documented operator capabilities include shell execution, process interaction, file browsing and transfer, persistence mechanisms, credential access through integrated tooling, and process injection in some agents. The framework is suitable for sustained post-compromise operations and data theft, and has been used to maintain persistent access and manage exfiltration.
Although Mythic is a legitimate offensive security framework, it has repeatedly appeared in espionage and cybercrime activity. It has been linked to Pakistan-associated espionage operations involving SideCopy and APT36, including campaigns targeting Indian entities with weaponized documents and Linux payloads. It has also been observed in financially motivated intrusion chains, including BLISTER and SOCGHOLISH-related activity, and in supply-chain compromise activity where a malicious Rust package delivered the Poseidon agent in CI environments. Researchers have also documented use of Mythic by the GOFFEE threat group, including custom agents and fileless execution inside Linux containers via anonymous memory, indicating adaptation to containerized environments.
Targeting spans Windows, macOS, and Linux systems, with observed victim sectors including government, defense, technology, and broader enterprise environments. Because Mythic is open source, actively maintained, and easy to customize, it is used by a wide range of operators from red teams to state-linked and criminal actors, which complicates attribution when it is encountered in the wild.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ESET researchers have discovered a previously unknown zero-day vulnerability in WinRAR being exploited in the wild by Russia-aligned group RomCom... now assigned CVE-2025-8088: a path traversal vulnerability, made possible with the use of alternate data streams. | Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and the Mythic agent.
Three Attack Variants Observed GrimResource (CVE-2025-26633): XSS via apds.dll res:// protocol handler
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Pakistan-linked threat actors SideCopy and APT36 (also known as Transparent Tribe) are actively conducting sophisticated cyber espionage campaigns utilizing a diverse arsenal of attack vectors... and advanced Mythic Command and Control (C2) frameworks for persistent network access and data exfiltration operations.
Кроме того, исследователи впервые обнаружили Mythic-агент GOFFEE внутри контейнера Linux. Предположительно, для его запуска хакеры модифицировали штатный скрипт RabbitMQ. Пейлоад размещался в анонимной области памяти через memfd_create и выполнялся без сохранения исполняемого файла на диск.
Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and the Mythic agent.
"Three minutes prior to the delivery of RomCom’s shellcode loader, the operator tests the connection to Mythic C2."
ShadowSyndicate continues to be associated with toolkits including Cobalt Strike, Metasploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent, and Brute Ratel.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.
Execution - PowerShell (T1059.001). Внутри архива LNK-файл, который через powershell.exe запускает base64-закодированный скрипт.
В качестве точки запуска предположительно был задействован штатный сценарий сервиса RabbitMQ ... /opt/bitnami/scripts/rabbitmq/setup.sh
This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
By the end of July, we observed campaigns involving a new BLISTER loader that targeted victim organizations to deploy the MYTHIC implant. MYTHIC running inside injected WerFault process
Пейлоад размещался в анонимной области памяти через memfd_create и выполнялся без сохранения исполняемого файла на диск.
Remove the first line of the Mythic JXA .js launcher... Some static A/V signatures have been known to check for this static string.
By the end of July, we observed campaigns involving a new BLISTER loader that targeted victim organizations to deploy the MYTHIC implant. MYTHIC running inside injected WerFault process
Developers of malware control servers often leave unique and identifying strings in web page data. Most commonly these can be found in the HTML Titles and HTTP Bodies.
Apollo can route SOCKS traffic regardless of what other commands are compiled in. To start the socks server, issue socks -Port [port] . This starts a SOCKS server on the Mythic server which is proxychains4 compatible.
135 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular C2 framework discussed as a comparable tool to Sliver. It separates the control panel from agents and can build custom agents with unique network profiles.
Mythic agent was used by GOFFEE inside a Linux container as an in-memory payload, likely launched via a modified RabbitMQ script and executed filelessly through memfd_create for post-compromise operations.
The article highlights GOFFEE's use of a Mythic agent/implant, including execution inside a Linux container via a RabbitMQ service script and in-memory execution using memfd_create. It is presented as part of the group's operational tooling for command-and-control and post-compromise activity.
Mentioned as a Linux-capable HTTP-based C2 framework whose traffic characteristics may be manipulated to evade ML-based IDS classifiers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.