Mythic C2 Detected – 193.201.185.90193[.]201[.]185[.]90:7443

Shodan identified a Mythic web interface at 193[.]201[.]185[.]90:7443. The page redirects to /new/login and uses a TLS certificate whose organisation is Mythic; this is consistent with an exposed Mythic C2 portal, but does not establish active use.

Why this matters and what to do now

What : A Mythic interface is reachable from the internet on port 7443.

Why : If unauthorised, access to a C2 management portal could enable control of agents, access to tasking data or disruption of operations. The Shodan result does not show whether authentication is effective or whether agents are connected.

Do now : Verify whether the host and Mythic deployment are authorised and owned by your organisation.

Do now : If unrecognised, restrict access to port 7443 at the network edge while preserving relevant logs and evidence.

Do now : Review Mythic authentication, administrator accounts, active sessions and connected agents.

Do now : network and endpoint telemetry for connections to 193[.]201[.]185[.]90, especially on port 7443.

Do now : Correlate the IP and TLS fingerprints with other observations, and reassess if the service changes or reappears.

The Mythic product fingerprint, matching page title, login route and certificate organisation provide strong evidence that this host exposes a Mythic interface. Mythic is a red-team and adversary-emulation framework that can provide command-and-control capabilities. The data confirms an accessible web service, not that it is currently controlling implants or being used maliciously. A legitimate security team may operate the service for authorised testing. The hosting location and TLS fingerprints can help correlate infrastructure, but do not by themselves identify an operator or intent. Confirm ownership, authorisation and expected exposure before treating the host as hostile.

DNS, proxy, firewall and flow logs for outbound connections to 193[.]201[.]185[.]90:7443.

Review endpoint telemetry for processes establishing TLS connections matching the IP or associated TLS fingerprints.

network telemetry for other hosts presenting the certificate fingerprint or JARM value; validate matches before attributing them.

Restrict the management interface to trusted administrative networks or a VPN; do not leave it publicly reachable unless required.

If the service is authorised, enforce strong unique credentials and multi-factor authentication where supported, and review user access.

Keep Mythic and its dependencies updated, and monitor authentication events, configuration changes and agent activity.

High, The Shodan product identification, page title and TLS certificate organisation consistently identify a Mythic interface, although malicious use and active agents are unconfirmed.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.