{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 0,
      "direct_entities": 3,
      "direct_relationships": 0,
      "invalid_iocs": 0,
      "iocs": 0,
      "mentioned": 3,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 0,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 97,
      "excluded_graph_objects": 96,
      "graph_complete": true,
      "graph_objects": 3,
      "graph_relationships": 0,
      "mitre_context_complete": true,
      "source_url": "https://censys.com/blog/mythic-c2",
      "status_as_of": "2026-10-10T15:54:14+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Malware",
        "aliases": [
          "win.apollo"
        ],
        "attributes": {
          "is_family": true,
          "malware_types": [
            "bot"
          ]
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": {
          "authorized_members": [],
          "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a",
          "is_inferred": false,
          "name": "Malpedia",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2026-01-18T18:06:53.391Z",
          "created_at": "2026-01-18T21:29:45.480Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-09-29T02:44:00.777Z",
          "updated_at": "2026-09-29T02:44:00.777Z"
        },
        "description_available": true,
        "entity_type": "Malware",
        "id": "a592b5ac-6738-4918-86ca-74d7d6f4a28b",
        "is_inferred": false,
        "labels": [
          "botnet_cc",
          "none"
        ],
        "lang": "en",
        "name": "Apollo",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": null,
            "id": "41aec801-2840-428e-8f16-a1ef8ac4fe0e",
            "source_name": "malpedia",
            "url": "https://github.com/MythicAgents/Apollo"
          },
          {
            "external_id": null,
            "id": "442d9442-2287-4901-b095-0d465a8cc1e3",
            "source_name": "malpedia",
            "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.apollo"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://censys.com/blog/mythic-c2",
        "standard_id": "malware--d6e22dd6-bf40-521f-a1af-b5a2435c7ca8",
        "type": "Malware"
      },
      {
        "__typename": "Malware",
        "aliases": [],
        "attributes": {
          "is_family": false
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-01-19T18:04:40.359Z",
          "created_at": "2026-02-24T11:26:35.038Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-09-26T15:42:22.404Z",
          "updated_at": "2026-09-26T15:42:22.404Z"
        },
        "description_available": false,
        "entity_type": "Malware",
        "id": "abc7a265-6586-4f96-8c30-4bd2006b2210",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "nyx",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://censys.com/blog/mythic-c2",
        "standard_id": "malware--ea6751e1-8f6c-5f3d-a206-de906cdd60df",
        "type": "Malware"
      },
      {
        "__typename": "Malware",
        "aliases": [],
        "attributes": {
          "is_family": false
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:57:27.496Z",
          "created_at": "2026-09-26T15:42:22.455Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-09-26T15:42:26.388Z",
          "updated_at": "2026-09-26T15:42:26.388Z"
        },
        "description_available": false,
        "entity_type": "Malware",
        "id": "c9c224e0-6c27-46ec-8420-f61798efd59e",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "fys2",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://censys.com/blog/mythic-c2",
        "standard_id": "malware--556e4a91-0f51-50dd-82a8-fdd99e8a9715",
        "type": "Malware"
      }
    ],
    "direct_relationships": [],
    "iocs": [],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "a592b5ac-6738-4918-86ca-74d7d6f4a28b",
        "name": "Apollo",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 50,
        "evidence_id": "c9c224e0-6c27-46ec-8420-f61798efd59e",
        "name": "fys2",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 50,
        "evidence_id": "abc7a265-6586-4f96-8c30-4bd2006b2210",
        "name": "nyx",
        "role": "mentionné",
        "type": "Malware"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-16T07:07:09.394Z",
        "created_at": "2026-09-26T15:44:06.026Z",
        "modified": "2026-09-26T15:44:06.638Z",
        "published": "2026-09-16T07:07:09.394Z",
        "updated_at": "2026-09-26T15:44:06.638Z"
      },
      "description_available": true,
      "id": "c1092112-93a5-423d-b78f-59ab1eec6562",
      "is_inferred": false,
      "labels": [
        "adversary infrastructure",
        "apollo",
        "c2 framework",
        "command-and-control",
        "fys2",
        "mythic",
        "network detection",
        "nyx",
        "open-source tools",
        "red team",
        "threat infrastructure"
      ],
      "lang": "en",
      "name": "Mythic C2 Activity at Internet Scale",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-16T07:07:09.394Z",
      "references": [
        {
          "external_id": null,
          "id": "548f88f6-6188-4935-988c-2e258e518fb4",
          "source_name": "alien-vault",
          "url": "https://censys.com/blog/mythic-c2"
        },
        {
          "external_id": "6aaa401dbc68ca971dbb0508",
          "id": "48eb6782-adec-4e06-a79b-a8033c56cef9",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6aaa401dbc68ca971dbb0508"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://censys.com/blog/mythic-c2"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "c1092112-93a5-423d-b78f-59ab1eec6562",
  "schema_version": 1,
  "selected_date": "2026-09-16",
  "source_url": "https://censys.com/blog/mythic-c2"
}