Mythic C2 Activity at Internet Scale

This Censys ARC report analyzes the Mythic open-source collaborative C2 framework, identifying 131 internet-exposed hosts (as of 2026-09-11) and recurring fingerprints such as default TLS subject names (O=Mythic / O=Mythic C2), internal PKI CNs (CN=operators → CN=multiplayer), and a default web UI port 7443. The report describes operational clusters (multi-framework lab-like deployments and single-framework deployments with custom tools), lists artifacts, infrastructure and geolocation breakdowns, highlights active development and staging of payloads (including Windows PE and Rust implants), and provides network- and host-based detection and hunting guidance for defenders.