#Mythic

Open-source modular C2 framework by SpecterOps

Subscribe (RSS)


#Mythic

Open-source modular C2

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #Mythic

Week

0

IOCs tagged #Mythic

Month

6

IOCs tagged #Mythic

Year

12

IOCs tagged #Mythic

Counts as of 2026-10-28. Regenerated daily.

About #Mythic

  • Type: Open-source modular C2 framework, maintained by SpecterOps.
  • Agents: Apollo, Athena, Poseidon, Apfell, Medusa.
  • C2 profiles: HTTP, websocket, SMB, dynamic DNS.
  • Abuse: Mainly a red-team tool. Some real intrusions, mostly Apollo and Athena.
  • Detection: Agent-specific YARA, default mTLS certificates, web-UI ports on listeners.
  • References: Mythic on GitHub.

Recent IOCs tagged #Mythic

Latest 6 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/mythic.

Date Type Value Source
Oct 20, 19:35 url http://2.27.63.244 @etugenio
Oct 20, 19:35 domain cdn-staticfiles.com @etugenio
Oct 20, 19:35 url http://cdn-staticfiles.com @etugenio
Oct 20, 19:35 domain wiredrum.llc @etugenio
Oct 20, 19:35 url http://wiredrum.llc @etugenio
Oct 20, 19:35 ip 2.27.63.244 @etugenio

Related tags

Often seen with #Mythic.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is Mythic?

An open-source modular C2 framework maintained by SpecterOps. It uses pluggable agents (Apollo, Athena, Poseidon) and C2 profiles.

Is Mythic primarily used legitimately or maliciously?

Mainly a red-team and authorised-engagement tool. Some real intrusions use it, but volume in commodity malware is low.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Mythic subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Mythic IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.