Skip to content
Multiple Mythic C2 Interfaces Detected Exposed on Port 7443

Multiple Mythic C2 Interfaces Detected Exposed on Port 7443

First seen 23 Oct 2026, 08:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 09:42 UTC
  • •Multiple Mythic C2 interfaces exposed on port 7443 were detected by Shodan.
  • •TLS certificates and login redirects suggest potential unauthorized access to sensitive systems.
  • •Organizations should verify ownership and restrict access to mitigate risks.

Shodan scans have identified several Mythic command-and-control (C2) web interfaces exposed on port 7443 across different IP addresses, including 34.187.60.230, 39.105.125.235, 143.244.135.171, and 142.93.126.132. These interfaces feature Mythic-named TLS certificates and redirect to a login path, indicating potential unauthorized access to sensitive control panels. While the presence of these interfaces raises concerns about possible exploitation, the scans do not confirm active malicious use or whether authentication is enforced. Organizations are advised to verify ownership of these IPs, restrict access, and review logs for any unauthorized activity. The risk of credential attacks and unauthorized access is significant due to the public exposure of these management interfaces. The situation remains under investigation as of October 23, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Mythic C2 interfaces detected
Shodan identified Mythic interfaces on IPs 143.244.135.171 and 142.93.126.132, indicating potential risks.
Redpacketsecurity
2026-10-20
Additional Mythic C2 interface found
Another Mythic interface was detected on 39.105.125.235, returning a 403 error, indicating access restrictions.
Redpacketsecurity
2026-10-23
New Mythic C2 interface identified
A new Mythic interface was detected on 34.187.60.230, raising concerns about unauthorized access.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track Mythic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

What should I do if I find a Mythic interface in my network?
Verify ownership and restrict access immediately, while reviewing logs for any unauthorized activity.
Are these Mythic interfaces actively being exploited?
Current reports do not confirm active exploitation, but the exposure poses a significant risk.
How can I protect my systems from unauthorized access?
Implement strong authentication, restrict access to trusted networks, and regularly review security logs.