Hunting for Mythic in network traffic

Hunting for Mythic in network traffic explains how threat actors use Mythic, a post-exploitation framework, and how network detection can identify its activity across several protocols. The piece notes Mythic supports HTTP/S, WebSocket, TCP, SMB, DNS, and MQTT, with two main network architectures: either agents talk through adjacent agents to a C2 server, or agents connect directly to the C2 server.

It highlights SMB and TCP modes where Mythic uses a MythicMessage structure encoded as base64 (often UUID plus AES-256 JSON), and shows how Suricata rules can flag UUIDs or base64 content in corresponding sessions. The article also covers covert transport modules such as Discord and GitHub, where traffic may resemble legitimate communications, and warns that signature-based detection can falter if TLS encryption is used, advocating behavioural analysis as a fallback.

Threat actors named in the piece include Mythic Likho (Arcane Wolf) and GOFFEE (Paper Werewolf), with claims that Mythic remains popular in APT and other attacks, according to Securelist. It also provides examples of specific detection rules for SMB, TCP, HTTP, HTTPS, WebSocket, and DNS traffic, and closes by emphasising that while signatures can detect many Mythic patterns, universal rules are impractical and per-protocol rules are necessary, as highlighted by the Kaspersky assessment.

According to Securelist, this approach helps organisations using Kaspersky’s NDR to identify Mythic activity and other post-exploitation frameworks, though decrypting TLS traffic is essential for certain detections.