Mythic

SentinelLabs has investigated a supply-chain attack against the Rust development community... the malicious crate typosquats against the well known rust_decimal package... the intended targeting could lead to subsequent larger scale supply-chain attacks depending on the GitLab CI pipelines infected.

"CVE-2025-8088 was exploited by RomCom in an email spearphishing campaign... A malicious archive, disguised as a job applicant’s curriculum vitae or resume, was attached to the emails"

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

Рабочее решение — apfell-агент, который работает через osascript (AppleScript, T1059.002, Execution) и не зависит от архитектуры процессора. Callback через osascript проходит на arm64 без проблем.

The agent currently employs three commands that imitate standard Jamf policy instructions... execute_command execute_command Executes a bash command on the target device with root privileges.

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

Set up Mythic C2 server and generate an "apfell" jxa payload... Host that payload... uses osascript to download and execute the Mythic JXA .js payload.

Copy and paste that macro into an MS Office doc.

"Updater.lnk adds a registry value and sets it to %TEMP%\msedge.dll"

Mythic does have the ability to add Login Item persistence even from the App Sandbox.

Mythic does have the ability to add Login Item persistence even from the App Sandbox.

The typhon agent utilises functionality provided by the Jamf binary. As such no additional code needs to be introduced to the compromised device for this agent to operate... execute_command execute_command Executes a bash command on the target device with root privileges.

This post is about that loader, which we call WasmForge ... You point it at a Go project and you get back a Windows or macOS binary that runs your tool but doesn’t look anything like it ... The third generates an outer Go binary containing a Wazero runtime, embeds the encrypted WASM module into the binary’s PE sections.

Remove the first line of the Mythic JXA .js launcher... Some static A/V signatures have been known to check for this static string.

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

"msedge.dll exits before deploying the Mythic agent if the target machine’s domain name does not match a hardcoded company name"

"Updater.lnk adds a registry value and sets it to %TEMP%\msedge.dll"

he read the entitlements of macOS Office products and used that information to determine where files could be written to disk from a sandboxed MS Office macro.

Обход Gatekeeper (T1553.001, Defense Evasion)… Gatekeeper проверяет атрибут com.apple.quarantine у скачанных файлов и блокирует неподписанный или ненотаризованный код. А вот при доставке через curl, scp или rsync — не ставится, и Gatekeeper молчит.

Practical queries for identifying malware infrastructure with FOFA.

Tribunus – A custom internal Mythic implant ... We tested standard commands like shell, ps, netstat, whoami .

“CVE-2020-1472, also known as ZeroLogon, allows for compromising a vulnerable operating system and executing commands as a privileged user.” | “CVE-2021-34527, also known as PrintNightmare… enabling remote access to a vulnerable OS and high-privilege command execution.”

If your goal is simply to execute a C2 payload, you can include the binary in the project directory and then execute it.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

Hunting C2/Adversaries Infrastructure with Shodan and Censys ... My research Cobalt Strike C2 Metasploit/MSF Covenant C2 Deimos C2 Posh C2 Brute Ratel C4 Mythic C2 Sliver C2 ... Night Hawk C2 NimPlant C2 ShadowPad C2 Infrastructure Async Rat C2 Infrastructure Meterpreter C2 Infrastructure

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

It supports several protocols for C2 including HTTP, WireGuard, and DNS... Mythic is an open source post-exploitation framework... and supports multiple protocols for C2 including TCP, HTTPM, DNS, and SMB.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload... Host that payload... use python -m SimpleHTTPServer to host

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

AppleSeed has divided files if the size is 0x1000000 bytes or more. APT28 has split archived exfiltration files into chunks smaller than 1MB. APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.