Loki: a new private agent for the popular Mythic framework

In July 2024 researchers identified a previously unknown Windows backdoor (Backdoor.Win64.MLoki), a private Mythic-compatible agent derived from Havoc, used in targeted attacks against Russian organizations; the report details loader and DLL architecture, command hashing and supported operations (process injection, token manipulation, file upload/download, BOF), encryption and C2 communication (AES+base64, specific domains), sample hashes, use of tunneling tools (ngrok, gTunnel/goReflect), victim indicators, and states attribution is inconclusive.