What is Mythic?
Mythic (S0699) is an open-source command and control framework. Security researchers originally built it as a collaborative red-teaming tool for macOS under the name Apfell. Today, the framework targets Windows and Linux systems as well. Like Empire, malicious actors (including state-sponsored groups like Nobelium and MuddyWater) heavily abuse Mythic to control compromised corporate networks.
Mythic stands out because of its highly modular, Docker-backed design. Attackers can customize the framework like building blocks. They use a web-based interface to create unique malware payloads called agents. Because of its cross-platform nature, attackers can deploy agents tailored to the target environment, such as Apollo for Windows, Poseidon for macOS, or Medusa for cross-platform Python execution. These agents bypass traditional antivirus software on almost any operating system.
The framework also allows criminals to disguise their network traffic. Attackers select different communication profiles. They can hide their malicious activity inside standard web traffic, persistent WebSockets, or internal file-sharing protocols. This flexibility makes Mythic a dangerous post-exploitation tool. Once attackers gain initial access, they use Mythic to harvest credentials, move laterally, and deploy devastating secondary payloads.
How to Defend Against Mythic?
Defending against Mythic requires cross-platform visibility, behavioral endpoint monitoring, and automated threat intelligence.
- Secure all operating systems: Mythic deploys agents across macOS, Windows, and Linux. Implement strict security controls, centralized host telemetry, and unified endpoint protection across your entire digital environment.
- Monitor endpoint behaviors: The framework executes modular commands directly in system memory. Deploy endpoint detection tools to inspect administrative utilities for unusual hidden processes across all operating systems, specifically auditing API calls like task_for_pid on macOS and unbacked execution threads on Windows.
- Eliminate network blind spots: Cross-platform C2 frameworks thrive on unmonitored infrastructure. Use platforms like Lumu Discover to maintain continuous visibility across your entire network footprint and reduce your overall attack surface.
- Track abnormal network behaviors: Mythic operators customize their communication profiles to blend in. Deploy Network Detection and Response (NDR) platforms like Lumu Defender to flag suspicious outbound connections, detect persistent WebSockets or HTTP C2 beaconing, and block C2 communication.
- Research emerging campaigns: Attackers constantly customize Mythic agents and communication profiles. Use the Threat Intelligence Observatory in Lumu Maltiverse to proactively research emerging C2 infrastructure and block new malicious domains before they target your network.
