Mythic

"CVE-2025-8088 was exploited by RomCom in an email spearphishing campaign... A malicious archive, disguised as a job applicant’s curriculum vitae or resume, was attached to the emails"

The agent currently employs three commands that imitate standard Jamf policy instructions... execute_command execute_command Executes a bash command on the target device with root privileges.

"A WinRAR zero-day vulnerability was exploited in the wild... CVE-2025-8088... enables attackers to misuse alternate data streams (ADSs) to achieve path traversal on Windows."

"A malicious LNK file Updater.lnk... Another LNK file runs... A third malicious LNK file executes..."

Annotations ID Technique Tactic T1204.003 Malicious Image Execution Default Configuration

"Updater.lnk adds a registry value and sets it to %TEMP%\msedge.dll"

"adds a registry value... using Component Object Model (COM) hijacking to execute the malicious msedge.dll"

"adds a registry value... using Component Object Model (COM) hijacking to execute the malicious msedge.dll"

The typhon agent utilises functionality provided by the Jamf binary. As such no additional code needs to be introduced to the compromised device for this agent to operate... execute_command execute_command Executes a bash command on the target device with root privileges.

"The DLL decrypts and deploys shellcode"

This post is about that loader, which we call WasmForge ... You point it at a Go project and you get back a Windows or macOS binary that runs your tool but doesn’t look anything like it ... The third generates an outer Go binary containing a Wazero runtime, embeds the encrypted WASM module into the binary’s PE sections.

"msedge.dll exits before deploying the Mythic agent if the target machine’s domain name does not match a hardcoded company name"

"through the use of alternate data streams, malicious files were hidden and deployed when the PDF was extracted and opened"

"Updater.lnk adds a registry value and sets it to %TEMP%\msedge.dll"

Practical queries for identifying malware infrastructure with FOFA.

Tribunus – A custom internal Mythic implant ... We tested standard commands like shell, ps, netstat, whoami .

“CVE-2020-1472, also known as ZeroLogon, allows for compromising a vulnerable operating system and executing commands as a privileged user.” | “CVE-2021-34527, also known as PrintNightmare… enabling remote access to a vulnerable OS and high-privilege command execution.”

If your goal is simply to execute a C2 payload, you can include the binary in the project directory and then execute it.

T1071 Application Layer Protocol — Мимикрия C2 под HTTP/HTTPS/DNS

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

The whole pipeline exists to solve one specific problem: take an existing offensive security tool, change zero lines of its source code, and produce a binary you can actually drop on a hardened endpoint.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").