Tutorial Shows Mythic C2 Relayed Through Discord to Evade Firewall Restrictions

Summary

The tutorial configures Mythic’s Discord profile and Athena agent to relay commands and callbacks through Discord when a lab host cannot directly reach the external C2 server.

Key points

• The lab scenario features an internal SQL host that cannot directly reach the external Mythic server but can make outbound connections to Discord.
• A Discord server and bot serve as a bidirectional broker for agent messages, operator commands, and callbacks.
• The demonstration installs Mythic’s Discord C2 profile and Athena agent, then configures the bot token and channel ID.
• The presenter builds a self-contained Windows payload with Discord communications and sets a five-second callback interval with 10% jitter.
• The payload is transferred through the segmented lab network and run on the restricted SQL host.
• The first callback fails because the bot was not added to the server; after the bot is authorized, callbacks arrive and a `whoami` command works.
• The presenter says the technique depends on the internal host being able to reach the third-party service and discusses other services and redirectors as possible relays.

MITRE ATT&CK

Products

Tools

Related Articles

• CikaBika RAT Uses Discord for Command and Controlsecurityweek.comDiscord · Microsoft Windows
• FLEXRAT Stealer and RAT Uses Fake ChilloutVR Mods to Steal Credentialshexastrike.comDiscord · Microsoft Windows
• Analysis Reveals Python-Based MaaS Infostealer Builder and Windows-Stealing Payloadlabs.k7computing.comDiscord · Microsoft Windows
• Fake LastPass Authenticator Installer Uses Signed Driver to Disable Security Tools and Steal Credentialsthehackernews.comDiscord · Microsoft Windows
• AI Makes More Attack Paths Affordable, but Attackers Still Seek the Least-Defended Routebitsight.comDiscord · Microsoft Windows