Updated: Aug 1
The rationale for this write-up is based on conversations with red-team operators and our observations of internet-facing Mythic C2 servers over the past three months.
Like Sliver, Mythic is a free-to-use, open-source tool. Written predominantly in Python, Mythic provides cross-platform payload creation options (Linux, MacOS, and Windows). With an active development community, and ‘plug-n-play’ functionality for its various (also open-source) agents, the technical entry barrier for users is comparatively low.
Mythic is therefore attractive to threat actors of varying skill sets; for the lower-skilled actor the ‘plug-n-play’ capabilities mean they can use the framework and additional agents ‘off-the-shelf’. In the case of higher-skilled actors, the framework’s flexibility for customization might be used to evade detection mechanisms based on ‘known’ fingerprints.
● Although dwarfed by Cobalt Strike, the number of online internet-facing Mythic servers outnumbers a number of other ‘common’ C2 frameworks, including Sliver.
● Mythic was observed being deployed alongside reNgine, a powerful reconnaissance tool.
● Connections to an operator identified previously utilizing Sliver, potentially in Pakistan-focused activities.
● Low confidence ties to e-crime operators have been identified within open source reporting.
Identification of Mythic Servers
Since the first quarter of 2021, the number of online Mythic servers has generally remained static; with 76 servers online at the time of writing - for ease of access we have used data from Shodan for this illustration.
Figure 1: Online Mythic Servers
Comparing this to other C2 frameworks (including Cobalt Strike), Mythic accounts for about 2% of the current ‘market share’ – interestingly, about 8x more prevalent than Sliver at present.
Figure 2: C2 Framework Market Share
Whilst 76 servers may seem like a low number, this only accounts for internet-facing infrastructure and likely doesn’t include many of the Mythic instances being used for red team operations within closed / controlled environments.
With that being said, Cobalt Strike remains the most prevalent framework in use today. Therefore, the purpose of this blog series is not to suggest defenders divert resources away from the detection of Cobalt Strike as a threat vector, but merely to heighten awareness of emerging and plausible alternatives.
Mythic in the Wild?
Reviewing the currently online Mythic servers, most of them (90%) fit a ‘default’ profile, with details for the web portal port, SSL certificate, etc. having not been altered from the ‘out-of-the-box’ settings.
● Port - 7443
● SSL certificate - Issuer: O=Mythic
In cases where these settings were modified, we have observed cases of re-use, where modified configurations were seemingly copied from box to box over time. In doing this, actors leave behind an attributable trail which makes tracking from C2 server to C2 server possible.
For example, by following E-Tag information (present in HTTP headers), we were able to tie multiple Mythic servers together. From this starting point we start to ‘zoom in’ on activities utilizing the Mythic framework, shedding light on some of the use cases.
Mythic + reNgine
We were able to follow this particular operator for a number of months, based on a recurring E-Tag value. In addition to Mythic, this operator was also observed using a reconnaissance framework called ‘reNgine’.
Figure 3: Identified Operator Infrastructure
Based on observed certificate information (CN = redteamtools.msfven0m[.]xyz), this infrastructure was likely used by a red team operator to target multiple customer organizations - although the potential for a false flag cannot be ruled out.
Figure 4: Certificate for 18.104.22.168
In this case the scenario was quite simple, reNgine was first used to scan port 443 on the victim server, seeking vulnerabilities which would allow initial compromise / exploitation. A Mythic beacon was then dropped on a victim machine for management of the exfiltration stage.
As a side note, reNgine is another powerful tool which blue team operators should become familiar with. At the time of writing, approximately 920 online reNgine servers were identifiable.
Mythic + Pakistani Focus
In our blog on Sliver, we identified a campaign which appeared to target both Pakistan and Turkey, based on the domain names observed. Whilst hunting for Mythic servers, we identified a similar domain ‘rd.mofa-pk[.]org’ - which appears to target the Pakistani Ministry of Foreign Affairs.
The domain mofa-pk[.]org was most recently hosted on 22.214.171.124 (assigned to AMAZON-AES), amongst the other domains hosted on this IP are:
Both of these domains were highlighted in our Sliver blog as being connected to the same activity, as outlined below:
Figure 5: Excerpt from the Sliver Blog
It would appear that the operator behind this linked infrastructure makes use of a diverse range of C2 frameworks in their activities. Our investigations into this cluster continue.
Mythic + Bazarloader / Bazarbackdoor?
In June 2022, a researcher shared a new Mythic C2 framework on Twitter with a slightly different web login panel. The default login panel for a Mythic C2 contains the Mythic logo, but in this case, the page contained this “Botleggers Club” image:
Figure 5: Source - https://twitter.com/benkow_/status/1542047469860683777
The “Botleggers Club” was mentioned in the Conti Leaks as a panel to manage / administrate and interact with clients (the bots), and also to deliver malware (BazarLoader / BazarBackdoor).
By pivoting on E-Tag values once again, a number of IP addresses were identified, sharing the same details as the Mythic C2 mentioned above (cryptolvl-rsa-check[.]com):
However, after this information (the Tweet) was publicly exposed, the server configurations were modified and now only one of these IPs is displaying the same E-Tag. It is likely that the other servers were either shut down, or moved elsewhere with updated configurations.
From a technical point of view, Mythic has all of the advantages of Cobalt Strike (or any of the most popular C2 frameworks). Based on the number of commits, issues, and pull requests on GitHub, the community is highly active in contributing to the development of the framework. In other forums, such as Twitter, we also observe researchers sharing their tips and tools for the improvement of Mythic functionality.
As noted already, Cobalt Strike remains the most popular C2 framework, but we wouldn’t be surprised to see growth in the use of Mythic in the near future. Indeed for some red team operators, this trend is already occurring - we would expect that malicious actors have taken note and are either considering or have already adopted the use of Mythic into their TTPs.
Indicators of Compromise
Note - only the most recently active Mythic C2 servers are shared.
MITRE ATT&CK Matrix:
This MITRE ATT&CK Matrix is a summary of the combined capabilities of every Mythic agent (Apollo, Athena, Tetanus, etc.):
Obfuscated Files or Information
Disable or Modify Tools
Guard pages creation
Remote System Discovery
Reads host file
Query running processes
System Information Discovery
Read machine GUID, software policy, volume information
Security Software Discovery
Load missing DLLs
Application Wide Discovery
Monitors Window changes
System Time Discovery
Application Layer Protocol
Perform DNS lookups