The section your link pointed to isn't on Mythic's page any more, so we've brought you to the top.
Mythic is a cross-platform, post-exploit, red teaming framework providing a collaborative, web-based interface for operators managing command and control operations.
"my_bof_args": {
"type": "TypedArray",
"value": [
["int", 5],
["char*", "testing"],
["wstring", "this is my string"]
]
}
{
"alert": "Warning: suspicious process",
"send_webhook": true,
"webhook_alert": {
"severity": "high",
"custom_id": "12345"
}
}
Mythic is an open-source command-and-control platform for red teaming operations, free to use. It runs as a self-hosted set of Docker containers behind a reverse proxy, with a React web UI, a GoLang backend, and Postgres and RabbitMQ handling data and messaging, all controlled through the mythic-cli binary; agents and C2 profiles are installed separately from GitHub rather than bundled in the core repository. It targets red team operators and the managers who need reporting across an engagement, tracking payload provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., task history, and network artifacts for OpSec and deconfliction. The README describes it as a cross-platform, post-exploit framework built for collaborative, multiplayer use rather than solo operation. First committed in 2018 and backed by SpecterOps sponsorship, it has 34 contributors and over 300 commits in the past year, with its latest release about ten months old.
Mythic is a cross-platform, post-exploit, red teaming framework providing a collaborative, web-based interface for operators managing command and control operations.
agents and commands can record process creates, file writes, API calls, and network connections as artifacts, either when a task is issued or as agents report them back, building an OpSec-relevant trail
shared tracking of callbacks, tasking, and network artifacts across the team surfaces overlapping footprints so deconfliction is based on recorded activity rather than memory
ties tasked commands to MITRE ATT&CK mappings, giving a technique-level view of coverage across the operation for reporting
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Nine scores for Mythic, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
See how much detail Mythic puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
1 entry
No entries match these filters.
Issue, contributor and maintainer activity in its-a-feature/Mythic, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Where Mythic turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
browserslist 4.24.4 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks browserslist 4.24.4. That version has GHSA-73wf-gq98-2v4g and 1 other high or critical flaw.
Fixed in browserslist 4.28.7. No Mythic release includes it yet.
GHSA-73wf-gq98-2v4g advisory Checked Nov 4 against Mythic 3.4.0.5
fast-uri 3.0.6 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks fast-uri 3.0.6. That version has GHSA-4c8g-83qw-93j6 and 7 other high or critical flaws.
Fixed in fast-uri 3.1.7. No Mythic release includes it yet.
GHSA-4c8g-83qw-93j6 advisory Checked Nov 4 against Mythic 3.4.0.5
nanoid 3.3.11 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks nanoid 3.3.11. That version has GHSA-28wg-ghj8-5hjv and 2 other high or critical flaws.
Fixed in nanoid 3.3.18. No Mythic release includes it yet.
GHSA-28wg-ghj8-5hjv advisory Checked Nov 4 against Mythic 3.4.0.5
postcss 8.4.49 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks postcss 8.4.49. That version has GHSA-6g55-p6wh-862q and 1 other high or critical flaw.
Fixed in postcss 8.5.18. No Mythic release includes it yet.
GHSA-6g55-p6wh-862q advisory Checked Nov 4 against Mythic 3.4.0.5
react-router 7.5.2 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks react-router 7.5.2. That version has GHSA-2w69-qvjg-hvjx and 6 other high or critical flaws.
Fixed in react-router 7.18.0. No Mythic release includes it yet.
GHSA-2w69-qvjg-hvjx advisory Checked Nov 4 against Mythic 3.4.0.5
serialize-javascript 6.0.2 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks serialize-javascript 6.0.2. That version has GHSA-5c6j-r48x-rmvq.
Fixed in serialize-javascript 7.0.3. No Mythic release includes it yet.
GHSA-5c6j-r48x-rmvq advisory Checked Nov 4 against Mythic 3.4.0.5
source-map-js 1.2.1 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks source-map-js 1.2.1. That version has GHSA-68fv-2mgg-jv7q.
Fixed in source-map-js 1.2.2. No Mythic release includes it yet.
GHSA-68fv-2mgg-jv7q advisory Checked Nov 4 against Mythic 3.4.0.5
turbo-stream 2.4.0 in its MythicReactUI imagehigh
Mythic 3.4.0.5 builds its MythicReactUI image from MythicReactUI/package-lock.json, which locks turbo-stream 2.4.0. That version has GHSA-rxv8-25v2-qmq8.
Fixed in turbo-stream 3.0.0. No Mythic release includes it yet.
GHSA-rxv8-25v2-qmq8 advisory Checked Nov 4 against Mythic 3.4.0.5
We check the lockfiles its release builds images from: 1 npm. Go modules, other lockfiles and vendored code aren't checked.
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →