Mythic Collaborative C2 Architecture: Forensic Reverse-Engineering & Architectural Dossier

Mythic is an enterprise-oriented, microservices-based command-and-control platform designed for collaborative multi-operator operations. The server core is built on Python 3 (FastAPI), backed by PostgreSQL, Redis, and RabbitMQ message brokers, exposed through GraphQL and REST APIs. Implants and communication profiles exist in isolated Docker containers, enabling dynamic compilation of heterogeneous agents: Apollo (.NET / C# with D/Invoke), Poseidon (Go for Linux/macOS), and Athena (.NET Core / AOT). Mythic standardizes agent tasking via JSON envelopes encrypted using AES-256-HMAC or ChaCha20, supporting bidirectional WebSockets, HTTP/S, and SMB named pipe pivoting.

Detailed reverse-engineering specifications archived in laboratory telemetry.

{
  "structureType": "Dynamic Payload Generation Model & JSON Tasking Definition",
  "decryptionRoutine": "Agent decrypts the embedded config blob at launch using an AES-256-CBC or ChaCha20 key provided during payload compilation, parsing parameters into memory.",
  "inMemoryLayout": "{\n  \"callback_host\": \"https://c2.enterprise-telemetry.com\",\n  \"callback_port\": 443,\n  \"interval\": 10,\n  \"jitter\": 20,\n  \"post_uri\": \"/api/v1/telemetry\",\n  \"crypto_type\": \"aes256_hmac\",\n  \"enc_key\": \"kL8+X9JmQ...\",\n  \"dec_key\": \"kL8+X9JmQ...\",\n  \"uuid\": \"d2786b84-4860-4966-8805-4b7713d0773e\",\n  \"proxy_type\": \"none\"\n}",
  "panelConfigOptions": "Mythic UI Agent Generation Wizard: Selection of Agent Type (Apollo, Poseidon, Athena), Target OS & Architecture, C2 Profile (HTTP, WebSocket, SMB), Encryption Profile (aes256_hmac, chacha20, none), Output Format (EXE, DLL, Service, Shellcode via Donut), Callback Interval & Jitter, and Embedded Commands inclusion list."
}

{
  "apiResolution": "In Apollo (.NET) and Athena, leverages Dynamic Invocation (D/Invoke) to locate NTAPI/Win32 function pointers directly from process memory without static P/Invoke imports or IAT registration, avoiding EDR memory hooks.",
  "processInjection": "Utilizes D/Invoke system call wrappers to invoke NtAllocateVirtualMemory, NtWriteVirtualMemory, NtProtectVirtualMemory, and NtCreateThreadEx for in-process or cross-process injection without passing through hooked Win32 wrappers.",
  "inMemoryAssemblyExecution": "Apollo executes .NET assemblies in memory using reflection (System.Reflection.Assembly.Load) and redirects Console Out/Error streams back to Mythic operator queues.",
  "crossPlatformMechanics": "In Poseidon (Go) on Linux/macOS, invokes direct system calls via runtime assembly stubs to execute pty shells, file system traversal, and memory mapping (mmap, mprotect)."
}

Concrete technical breakdown of functional modules implemented in the Mythic Collaborative C2 Architecture binary:

Mythic communication conforms to a strict JSON envelope framing model. Over HTTP/WebSockets, every message begins with a 36-byte payload UUID identifying the agent to the teamserver translation container. The message body is encrypted with AES-256-CBC and signed with HMAC-SHA256 (or ChaCha20-Poly1305). The decrypted JSON payload follows the schema: {"action": "get_tasking", "tasking_size": -1, "delegates": []}. Responses from the server return task instructions: {"action": "get_tasking", "tasks": [{"id": "<task_uuid>", "command": "<name>", "parameters": "<args>"}]}. In SMB profiles, the same JSON framing is transmitted across Windows Named Pipes with 4-byte length prefixes.

Indicators of compromise and forensic patterns recorded across laboratory triage:

// Decompiled Apollo D/Invoke Invocation Snippet
public static object DynamicSyscallInvoke(string moduleName, string functionName, Type delegateType, object[] parameters) {
    IntPtr pModule = DInvoke.DynamicImport.GetLoadedModuleAddress(moduleName);
    IntPtr pFunc = DInvoke.DynamicImport.GetExportAddress(pModule, functionName);
    Delegate d = Marshal.GetDelegateForFunctionPointer(pFunc, delegateType);
    return d.DynamicInvoke(parameters);
}

// Apollo C2 Message Dispatcher
public void ProcessMythicTasking(string decryptedJson) {
    MythicTaskingEnvelope envelope = JsonSerializer.Deserialize<MythicTaskingEnvelope>(decryptedJson);
    foreach (var task in envelope.tasks) {
        CommandInterface cmd = CommandFactory.CreateCommand(task.command);
        cmd.Execute(task.parameters);
    }
}