Setting Up Resilient C2 Infrastructure with Cobalt Strike and Mythic

Wylie Bayes

• 3 min read

In a Red Team operation, your infrastructure is your lifeline. If you successfully spear-phish a target, execute your payload, and bypass their EDR, all of that effort is wasted if the Blue Team simply blacklists your single Command and Control (C2) IP address. When your server goes dark, the operation is over.

To survive against a mature Security Operations Center (SOC), Red Teams must architect highly resilient, deceptive, and distributed C2 infrastructure. In this post, we will explore the concepts of redirectors, traffic shaping with Cobalt Strike, and the flexibility of the Mythic framework.

The Golden Rule: Never Expose the Team Server

The most amateur mistake in Red Teaming is having your malware call back directly to your Team Server (the backend server hosting the C2 framework). If the Blue Team detects the beacon, they will block the IP, investigate it, and potentially even launch counter-attacks against it.

To protect the Team Server, we use Redirectors.

A redirector is a "dumb" proxy server (often just a $5/month cloud VPS running Nginx, Apache, or Socat). The malware on the victim's machine communicates with the redirector. The redirector then silently forwards that traffic to the hidden Team Server.

If the Blue Team burns the redirector's IP, the Red Team doesn't care. They simply spin up a new $5 VPS, point a new domain name at it, and instruct their dormant malware to start communicating with the new redirector. The Team Server remains completely hidden and secure.

Cobalt Strike and Malleable C2

Cobalt Strike is the industry standard for adversary simulation. One of its most powerful features is Malleable C2.

Mature SOCs perform deep packet inspection. If your malware beacons back to your server using a default, recognizable HTTP structure, an Intrusion Detection System (IDS) will flag it instantly.

Malleable C2 allows the Red Team to write custom profiles that manipulate the exact shape, size, and headers of the beacon traffic. You can make your malicious traffic look exactly like:

  • A user idly browsing Amazon.com.
  • A jQuery script updating in the background.
  • A Microsoft Office telemetry ping.

By blending into the "noise" of legitimate corporate web traffic, Cobalt Strike beacons can bypass network-level detection for months.

The Rise of the Mythic Framework

While Cobalt Strike is legendary, it is also heavily signatured by modern AV/EDR, and its primary payload (Beacon) is written in C/C++, focusing heavily on Windows environments.

Enter Mythic. Mythic is a modern, open-source, collaborative C2 framework that is taking the Red Teaming world by storm. It was built with modularity in mind.

Unlike monolithic C2s, Mythic allows operators to plug-and-play completely different agent types depending on the environment:

  • Poseidon: A macOS/Linux agent written in Golang.
  • Apollo: A Windows agent written in C#.
  • Medusa: A cross-platform Python agent.

Furthermore, Mythic excels at peer-to-peer (P2P) C2. If only one server in a target network has outbound internet access, Mythic agents can chain together internally via SMB or TCP. The deeply buried agents pass their traffic to the edge agent, which then funnels it all out to the internet.

Domain Fronting and Categorization

When setting up your redirectors, the domain name you choose is critical. Corporate proxies will block domains that are newly registered or classified as "Uncategorized."

Red Teams spend significant time aging and categorizing their domains prior to an engagement. They will register domains that sound legitimate (e.g., global-health-telemetry.com), set up a benign webpage on it, and submit the domain to services like Palo Alto, Fortinet, and Symantec to be officially categorized as "Healthcare" or "Finance."

When the operation begins, the malware beacons out to this highly trusted, perfectly categorized domain, sailing right past the corporate web filter.

Automation is Key

Setting up domains, SSL certificates, Nginx reverse proxies, and backend Team Servers manually is incredibly prone to error and takes hours. Modern Red Teams automate their entire infrastructure deployment using Infrastructure as Code (IaC) tools like Terraform and Ansible.

With a single terraform apply command, a Red Team can spin up a labyrinth of redirectors across AWS, DigitalOcean, and Azure, pull down valid Let's Encrypt certificates, and establish their C2 channels in less than 5 minutes.

Conclusion

A successful Red Team operation is 70% preparation and 30% execution. By heavily investing in resilient infrastructure—utilizing redirectors, manipulating traffic profiles, and categorizing domains—Red Teams ensure their operations can weather the storm when the Blue Team inevitably begins to hunt them.