Mythic
Open-source modular command-and-control framework with Docker-based server, cross-platform agents, and a browser interface for red team operations.
Technical Architecture & Overview
Mythic is an open-source, modular command-and-control framework for authorized red teaming. It is built with Go, Docker, and a web browser interface. The server supports a plug-and-play architecture for agents and C2 profiles, which are maintained in separate repositories. It was created by Cody Thomas and is used for security assessment and research.
Targeted Technical Use Cases
Multi-operator authorized engagements that require custom or cross-platform agents, flexible C2 profiles, and a browser-based collaborative interface.
Evaluation & Trade-offs
Core Strengths
- +Modular agent and C2 profile ecosystem with plug-and-play architecture.
- +Cross-platform agent support with a web UI for collaboration.
- +Open-source and extensible for custom tooling development.
Trade-Offs & Limitations
- -Requires Docker for the server deployment, which runs on Linux or macOS with OrbStack.
- -Agent and profile maintenance depends on community repositories.
- -Operational complexity compared with single-binary frameworks.
Defensive Security Application
Test detection coverage across multiple agent types and C2 channels by running authorized simulations and observing how EDR, network, and logging controls respond.
Frequently Asked Questions
What is Mythic?→
Mythic is an open-source, modular command-and-control framework for authorized red teaming. It is built with Go, Docker, and a web browser interface. The server supports a plug-and-play architecture for agents and C2 profiles, which are maintained in separate repositories. It was created by Cody Thomas and is used for security assessment and research.
What is Mythic used for?→
Multi-operator authorized engagements that require custom or cross-platform agents, flexible C2 profiles, and a browser-based collaborative interface.
What are the strengths of Mythic?→
- +Modular agent and C2 profile ecosystem with plug-and-play architecture.
- +Cross-platform agent support with a web UI for collaboration.
- +Open-source and extensible for custom tooling development.
What are the limitations of Mythic?→
- +Requires Docker for the server deployment, which runs on Linux or macOS with OrbStack.
- +Agent and profile maintenance depends on community repositories.
- +Operational complexity compared with single-binary frameworks.
How is Mythic used defensively?→
Test detection coverage across multiple agent types and C2 channels by running authorized simulations and observing how EDR, network, and logging controls respond.