Mythic
249 hosts convicted as Mythic command-and-control servers: 222 still listed, 27 archived. First seen 2026-08-22.
About
Mythic is an open-source post-exploitation framework for red teams, written by Cody Thomas and sponsored by SpecterOps, first released in 2018 as Apfell and renamed in 2020. Its agents and C2 profiles are installed separately from its core, so two Mythic servers may control different implants, including private ones such as one Kaspersky reported in targeted attacks in 2024. The fingerprint identifies the server, never which agent it controlled or a machine running one: usually the operator console, on port 7443 by default, where most of these addresses answered, otherwise an HTTPS listener its agents call back to. It is identified by defaults the console and its HTTP listeners ship with. A red team and an intruder can stand the server up identically, so a listing says nothing about who runs it or whether its use was authorised.
Ports
The 8 ports with the most hosts, of 22.
Observed changes
Relabelled: 1 host earlier labelled Ligolo-ng. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS202831 on 2026-10-26 (1 host); AS395213 on 2026-10-25 (1 host); AS4385 on 2026-10-25 (1 host); AS13113 on 2026-10-24 (1 host); AS21743 on 2026-10-24 (1 host).
Estimated moves of this family toward AS8075 on 2026-10-07 (fewer than 10 hosts); toward AS8151 on 2026-10-07 (fewer than 10 hosts); toward AS14061 on 2026-10-07 (10–99 hosts); toward AS14618 on 2026-10-07 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family. Showing the 4 newest of at least 12.
Detection packs
Rules for this hub's 222 still-listed hosts, across all 3 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 3 of 3
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.