merlin-agent — The Cyber Toolchain

merlin-agent v2.5.1

Tue, 13 Oct 2026 00:19:10 GMT

Merlin agent v2.5.1 adds macOS arm64 and Linux armv7/arm64 pre-built binaries to the release matrix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds pre-built agent binaries for macOS (Darwin) arm64, Linux armv7, and Linux arm64, expanding the existing Windows x64, Linux x64, FreeBSD x64, and macOS x64 build matrix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v2.4.0

Sat, 23 Mar 2024 15:58:33 GMT

Merlin Agent v2.4.0 adds HTTP/3 support, winhttp proxy auth, and selective build tags • Adds the `-http-client` CLI argument to select the Go or `winhttp` API HTTP client • Introduces build tags (`http`, `http1`, `http2`, `http3`, `winhttp`, etc.) to selectively compile specific C2 clients • Enables automatic Windows HTTP proxy authentication via the `winhttp` API Breaking changes: • When ANY build tag is included, the agent will ONLY include that feature and nothing else; e.g., using ONLY the http tag excludes SMB, TCP, and UDP clients Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v2.3.0

Tue, 26 Dec 2023 20:32:02 GMT

Adds Mythic EKE authentication via RSA and new language code page decoders • Added `RSA` as a valid authentication method for Mythic EKE • Added `mythic` encoder to transform messages in the format Mythic expects them in • Support to decode Simplified Chinese (Code Page 936) encoding to UTF-8 • Support to decode Traditional Chinese (Code Page 950) encoding to UTF-8 • Support to decode Korean (Code Page 949) encoding to UTF-8 Breaking changes: • Removed `GOGARBLE` environment variable from Makefile Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v2.2.0

Thu, 14 Dec 2023 13:41:35 GMT

Adds os/windows/pkg/text package for ShiftJIS encoding handling in v2.2.0 • Adds `os/windows/pkg/text` package to detect and handle non UTF-8 encoding (ShiftJIS) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v2.1.0

Mon, 27 Nov 2023 13:38:15 GMT

Merlin Agent v2.1.0 adds `-secure` flag to control JA3/Parrot TLS validation and fixes uTLS proxy/version bugs • Passes TLS X509 certificate validation settings through to JA3 and Parrot clients Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v1.6.0

Fri, 11 Nov 2022 16:04:47 GMT

merlin-agent v1.6.0 adds `--parrot` flag for JA3 client impersonation • Adds `--parrot` CLI argument to enable JA3 signature spoofing via the utls library. • Allows changing the `--parrot` parameter dynamically while the agent is running without restart. Breaking changes: • The New() function in the agent package no longer returns an error; it only prints errors to STDOUT. • Dropped support for Go versions prior to v1.19. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v1.5.0

Fri, 22 Jul 2022 12:17:33 GMT

Merlin Agent v1.5.0 adds SOCKS5 functionality and updates minimum Go version to 1.18. • Adds new `SOCKS5` functionality for traffic routing Breaking changes: • The minimum supported Go version is now v1.18; upgrades from earlier versions will fail to compile or run. • The Send() method on the `ClientInterface` interface now returns a list of `messages.Base` instead of a single message, requiring callers to iterate over the returned slice. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v1.4.1

Wed, 13 Apr 2022 01:09:10 GMT

Adds Go build tags to separate Mythic client and exposes `SLEEP` make target for custom interval control. • Adds `SLEEP` Makefile variable (e.g., `make windows SLEEP=2m`) to control agent sleep interval • Introduces Go build tags to separate Mythic client from standalone HTTP1/2/3 client Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v1.3.1

Tue, 22 Mar 2022 12:37:55 GMT

v1.3.1 adds garble build targets to the Makefile for obfuscated agent binaries • Adds `windows-garble`, `linux-garble`, and `darwin-garble` targets to the Makefile to produce garbled agent builds. • Allows specifying a build seed via the `SEED` make variable (e.g., `make windows-debug SEED=`). • Adds `GetProcessWindowStation` and `GetThreadDesktop` functions to the `user32` package. Breaking changes: • The `ClientInterface.SendMerlinMessage` function is renamed to Send(), breaking any client code referencing the old name. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent

merlin-agent v1.2.0

Mon, 13 Dec 2021 01:17:56 GMT

v1.2.0 adds rm, ssh, runas, and token commands to merlin-agent; introduces os/windows API directory. • Adds `rm` command for native Go-based file deletion • Adds `runas` Windows command to create a process as another user with their password • Adds `ssh` command for non-interactive remote host connection and command execution • Adds `token make`, `privs`, `rev2self`, `steal`, and `whoami` subcommands for Windows Access Token interaction • Adds `-headers` CLI argument and `HEADERS=` Make parameter to inject arbitrary HTTP headers using newline-separated lists • Adds new `os/windows/api` directory containing OS-specific API and system calls • Adds new `os/windows/pkg` directory with wrapper functions for OS-specific calls • Adds `commands/os` package with Setup() and TearDown() functions to manage process space for Windows token operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/merlin-agent