Mythic C2 Detected – 23.148.228.25323[.]148[.]228[.]253:7443

The host exposes a Mythic web interface on HTTPS port 7443. The interface redirects to /new/login and uses a self-signed certificate identifying the subject and issuer as Mythic.

Why this matters and what to do now

What : A remotely reachable C2 management portal is exposed on the public internet.

Why : Unauthorised access could enable operator login, payload management, tasking, or disruption of the Mythic instance. The login page alone does not confirm compromise.

Do now : Determine whether 23[.]148[.]228[.]253:7443 is authorised and identify its owner.

Do now : Restrict or remove public access to the management interface, allowing only approved administration networks.

Do now : Review Mythic, reverse-proxy, authentication, and host logs for successful logins, failed logins, and unusual activity.

Do now : Rotate administrative credentials and review configured users, agents, payloads, and callback activity.

Do now : enterprise telemetry for connections to the IP, port 7443, the JARM value, and the TLS certificate fingerprint.

The exposed service is highly consistent with a Mythic command-and-control management interface. The product title, login route, bundled React assets, Mythic favicon, and Mythic-labelled TLS certificate provide mutually supporting evidence. The certificate is not publicly trusted, which is common for internally generated or deliberately self-signed management services. The evidence confirms an exposed Mythic web portal but does not establish active operator access, payload deployment, compromise, or malicious use. The address may represent a test, research, red-team, or criminal deployment. Attribution to a specific actor or campaign is not supported by the supplied data.

Alert on outbound or inbound HTTPS connections to 23[.]148[.]228[.]253:7443.

Hunt proxy and endpoint logs for requests to /new/login and responses containing the title Mythic.

Cluster TLS observations using the supplied JARM, JA3S, and certificate SHA-256 values.

Review DNS, firewall, VPN, and identity logs for administrative access involving the endpoint.

Place the Mythic management interface behind a VPN, private network, or allow-list.

Enforce strong unique administrator credentials and multi-factor authentication where supported.

Keep Mythic, its host operating system, and the nginx reverse proxy patched.

Monitor and alert on authentication failures, new users, payload creation, and callback registration.

Retain and protect web, application, host, and authentication logs for investigation.

High, The Mythic product label, login route, application assets, favicon, and Mythic-issued self-signed certificate consistently identify the exposed service.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.