Dark-Agent: The Mythic C2 Agent With an In-Memory BOF Loader for macOS and Linux
Dark-Agent is the first open-source Mythic C2 agent with a full in-memory BOF (Beacon Object File / COFF) loader purpose-built for macOS and Linux. Written in Crystal, it loads Beacon Object Files entirely in memory — no disk writes, no temporary files, no child processes — and has been used operationally by the ServiceNow Red Team since 2024. What Is Dark-Agent? A Mythic C2 Agent Purpose-Built for Linux and macOS Mythic is an open-source, cross-platform C2 (command-and-control) framework that makes it easy to extend an agent and swap in alternative C2 profiles without recompiling. Most of the well-known Mythic agents — Apollo, Xenon, Poseidon, and the Java-based options — either focus on Windows or treat Unix as a second-class citizen. Dark-Agent, released by ServiceNow under an open license, is built explicitly to change that. ...