Skip to content
Mythic C2 Interfaces Exposed on Public IPs

Mythic C2 Interfaces Exposed on Public IPs

First seen 20 Oct 2026, 07:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 09:20 UTC
  • •Two Mythic C2 interfaces detected on public IPs, potentially exposing sensitive controls.
  • •Organizations should verify the legitimacy of these IPs and restrict unauthorized access.
  • •No confirmed active exploitation, but strong authentication and monitoring are recommended.

Two Mythic-branded command-and-control (C2) web interfaces were detected on public IPs 143.244.135.17 and 142.93.126.132, both accessible via port 7443 and redirecting to a login page. The interfaces present TLS certificates identifying them as Mythic, raising concerns about unauthorized access and potential control over connected agents. The scans do not confirm whether authentication is enforced or if the services are actively controlling compromised systems. Organizations are advised to check if these IPs are authorized, restrict access if unauthorized, and review logs for unexpected activity. The presence of these interfaces may indicate either legitimate deployments or potential malicious use, but no has been confirmed. Both articles emphasize the need for strong authentication and monitoring of network connections to these IPs.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Mythic C2 interfaces detected
Shodan observed Mythic-branded web interfaces on IPs 143.244.135.17 and 142.93.126.132, both on port 7443.
Redpacketsecurity
2026-10-20
Recommendations issued for organizations
Security professionals advised to check IP authorization, restrict access, and review logs for unexpected activity.
Redpacketsecurity

More articles in this cluster (2)

Following this threat?

Track Mythic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3

Common questions

Are these Mythic C2 interfaces actively being exploited?
No confirmed active exploitation has been reported; however, they pose a potential risk if unauthorized access occurs.
What should I do if my organization uses these IPs?
Verify if the IPs are authorized for your use, restrict access if they are not, and review logs for any suspicious activity.
What are the immediate steps to secure these interfaces?
Implement strong authentication measures, restrict access to trusted sources, and monitor network traffic to these IPs.