MYTHIC C2 ACTIVITY AT INTERNET SCALE

Summary from the TLDR InfoSec newsletter

Mythic, an open-source C2 framework that lets operators mix agents, transport profiles, and a shared web UI, is popular with red teams but has also turned up in real intrusions, according to new Censys research. Censys tracked 131 internet-exposed Mythic hosts, and 115 of them still carried the default O="Mythic" or O="Mythic C2" certificate. One cluster Censys flagged paired Mythic with custom Rust implants, Discord-based C2, and a domain disguised as Windows telemetry traffic.