Mythic C2 Detected – 95.158.131.14195[.]158[.]131[.]141:7443

The host exposes a Mythic web interface on HTTPS port 7443. It redirects to /new/login and uses a self-issued Mythic TLS certificate, indicating likely Mythic command-and-control infrastructure.

Why this matters and what to do now

What : An internet-facing Mythic operator portal is exposed on 95[.]158[.]131[.]141:7443.

Why : Compromise or misuse of the portal could enable command execution, payload management and control of connected agents. The service also provides reliable fingerprints for monitoring related infrastructure.

Do now : Confirm whether the host and Mythic deployment are authorised and owned by the organisation.

Do now : Restrict port 7443 to approved administration networks or place it behind a VPN and access control layer.

Do now : Preserve server, proxy, Mythic and authentication logs before making changes.

Do now : Review Mythic users, recent logins, agents, payloads, callbacks and task history for unauthorised activity.

Do now : Hunt for the IP, TLS certificate fingerprint, JARM value, /new/login path and Mythic-related traffic in network telemetry.

The combination of the Mythic title, /new/login route, React application assets and a certificate issued by an organisation named Mythic is strongly consistent with an exposed Mythic operator portal. Mythic is a command-and-control framework, so this host may provide operator access to active infrastructure. The evidence does not confirm that the host is currently used for malicious activity or identify a specific operator, payload, callback profile or victim set. It could be a legitimate research, testing or privately operated deployment. The public exposure of the login portal and the short certificate validity period nevertheless warrant investigation.

proxy and firewall logs for HTTPS connections to 95[.]158[.]131[.]141:7443 and requests to /new/login.

Alert on TLS certificates with subject or issuer O=Mythic, especially when exposed on TCP/7443.

Cluster internet-facing services using the JARM value 1dd40d40d00040d00042d43d000000831b6af40378e2dd35eeac4e9311926e.

Review authentication and task activity in Mythic logs for unfamiliar source addresses, users, agents or payloads.

endpoint telemetry for outbound connections to the IP and related infrastructure identified through TLS or HTTP fingerprint clustering.

Remove direct public exposure of the Mythic operator interface.

Enforce VPN or zero-trust access with allow-listed administrator identities and source networks.

Require strong, unique credentials and multi-factor authentication where supported.

Update Mythic, its underlying operating system and nginx, and remove unused accounts and agents.

Rotate credentials, certificates, payload secrets and callback configuration if unauthorised access is suspected.

Enable centralised logging and alerting for operator logins, agent registration, payload creation and task execution.

High, The product title, login route, application structure and self-issued Mythic certificate provide mutually reinforcing evidence of a Mythic deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.