Loading malware…
Apollo is an open-source post-exploitation agent used with the Mythic command-and-control framework. It is most commonly recognized as the .NET Mythic agent focused on Windows, although some references describe it more broadly within Mythic’s multi-agent ecosystem. Apollo is designed for managing compromised hosts after initial access and supports operator tasking through Mythic infrastructure.
Documented Apollo functionality includes command execution, execution of PowerShell commands, and process creation and injection behavior, including default support for creating and injecting into Rundll32. Reporting also associates Apollo with credential-dumping workflows through Mythic operator tradecraft, including use alongside tools such as Mimikatz for credential access and lateral movement. These characteristics place Apollo firmly in the post-exploitation phase rather than as a standalone initial-access tool.
Apollo has been observed both as a stock Mythic agent and in customized forms used by threat actors. Stealth Falcon used customized Apollo implants prior to transitioning to the more advanced Horus Agent, which is assessed as an evolution of that earlier Apollo-based tooling. Apollo has also been observed in campaigns linked with pro-Ukrainian hacktivist and intrusion clusters alongside other frameworks such as Sliver, Havoc, and AdaptixC2, indicating its use as one component in broader intrusion operations.
Operationally, Apollo is relevant to espionage and hands-on-keyboard intrusions because it provides flexible remote control of Windows systems and integrates into the broader Mythic ecosystem of agents and transports. Detection efforts have specifically targeted Apollo through YARA and behavioral signatures tied to Mythic C2 communication patterns and .NET Apollo agent structures.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft patched a zero-day vulnerability in its web application framework exploited by an Emirati threat group as part of an espionage campaign in the Middle East and Africa. The flaw, tracked as CVE-2025-33053, is a remote code execution vulnerability in Web Distributed Authoring and Versioning, or WebDAV.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Название «Mythic» в имени кластера отражает использование Mythic C2 - открытого фреймворка для post-exploitation с множеством агентов (Apollo, Medusa, Athena).
Named after the Egyptian falcon-headed sky god, Horus Agent represents an evolution from the group’s previously used customized Apollo implant.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
reg_query ... Query all subkeys of the specified registry path ... reg_write_value ... Write specified values to the registry keys.
MITRE ATT&CK Matrix: This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.): Technique Technique ID Observable Scheduled Task/Job T1053
printspoofer printspoofer -Command [command] Execute a command in SYSTEM integrity so long as you have SeImpersonate privileges. | make_token make_token Impersonate a user using plaintext credentials. ... rev2self Revert the access token to the original access token. ... steal_token steal_token [pid] Attempts to steal the process's primary token specified by [pid] and apply it to our own session.
printspoofer printspoofer -Command [command] Execute a command in SYSTEM integrity so long as you have SeImpersonate privileges. | make_token make_token Impersonate a user using plaintext credentials. ... rev2self Revert the access token to the original access token. ... steal_token steal_token [pid] Attempts to steal the process's primary token specified by [pid] and apply it to our own session.
dcsync dcsync -Domain contoso.local [-User username -DC dc.ip] DCSync one or more user credentials ... mimikatz mimikatz -Command [args] Execute Mimikatz with the specified arguments.
net_localgroup_member net_localgroup_member -Group [groupname] [-Computer [computername]] Retrieve membership information from a specified group on a given computer. net_localgroup net_localgroup [computer] Retrieve local groups known by a computer.
System Information Discovery T1082 Read machine GUID, software policy, volume information
C2 - Web Protocols (T1071.001) ... Управление имплантами и вывод данных - через HTTPS.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows agent/implant for the Mythic framework, mentioned as an example of a customizable payload communicating with a C2 server.
Агент фреймворка Mythic C2 для post-exploitation, упомянутый как часть инструментария, связанного с Mythic Likho.
Cross-platform Mythic agent that maintains C2 connectivity and supports command execution, file transfer, arbitrary code execution, and plugin-based extension. The observed .NET agent supported HTTP, TCP, WebSocket, SMB, named pipes, and web-shell transports.
Cross-platform post-exploitation agent used with Mythic that maintains persistent C2 connectivity, executes commands, transfers files, runs arbitrary code, and supports multiple transport profiles and plugins.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.