Mythic C2 Detected – 20.115.227.16120[.]115[.]227[.]161:7443

The host exposes a Mythic web interface on HTTPS port 7443. The page redirects to /new/login and is served through nginx on Microsoft Azure address space.

Why this matters and what to do now

What : An externally reachable Mythic management portal is exposed on 20[.]115[.]227[.]161:7443.

Why : Unauthorised access could expose C2 administration, payload management and operational data if authentication or the host is compromised.

Do now : Confirm whether the host and port are authorised and required.

Do now : Restrict port 7443 to approved administrator networks or VPN access.

Do now : Review Mythic, nginx, Azure and identity-provider logs for access and authentication activity.

Do now : Rotate credentials, tokens and certificates if unauthorised access is suspected.

Do now : enterprise telemetry for connections to 20[.]115[.]227[.]161:7443 and related Mythic indicators.

The exposed service is highly consistent with a Mythic command-and-control web interface. The application title, product identification, /new/login route and Mythic-issued self-signed certificate provide mutually supporting evidence. The evidence confirms an exposed Mythic portal, but does not prove active operator use or current payload activity. The Microsoft-hosted address and nginx reverse proxy may indicate cloud-hosted operational infrastructure, but they do not establish attribution. The supplied data contains no payload callbacks, operator identity, authentication events or connected agent evidence. Shared deployment artefacts could also cause infrastructure clustering false positives.

Alert on outbound or inbound connections to 20[.]115[.]227[.]161 over TCP 7443.

HTTP proxy and DNS logs for requests to /new/login and other paths on 20[.]115[.]227[.]161.

Cluster TLS observations using the supplied JARM, JA3S and certificate SHA-256 values.

Review authentication logs for successful or failed access to the Mythic portal.

endpoint telemetry for Mythic agent, payload or callback activity associated with this address.

Remove direct Internet exposure of the management interface.

Permit access only through a VPN, bastion host or allow-listed administrator ranges.

Enforce strong unique credentials and multi-factor authentication where supported.

Patch Mythic, nginx and the underlying operating system.

Enable centralised logging and alerting for portal access, configuration changes and payload operations.

Revoke and replace credentials or certificates if compromise cannot be excluded.

High, The Mythic title, product metadata, login route and Mythic-issued certificate independently identify the exposed application.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.