Apollo

Apollo is an open-source post-exploitation agent used with the Mythic command-and-control framework. It is most commonly recognized as the .NET Mythic agent focused on Windows, although some references describe it more broadly within Mythic’s multi-agent ecosystem. Apollo is designed for managing compromised hosts after initial access and supports operator tasking through Mythic infrastructure.

Documented Apollo functionality includes command execution, execution of PowerShell commands, and process creation and injection behavior, including default support for creating and injecting into Rundll32. Reporting also associates Apollo with credential-dumping workflows through Mythic operator tradecraft, including use alongside tools such as Mimikatz for credential access and lateral movement. These characteristics place Apollo firmly in the post-exploitation phase rather than as a standalone initial-access tool.

Apollo has been observed both as a stock Mythic agent and in customized forms used by threat actors. Stealth Falcon used customized Apollo implants prior to transitioning to the more advanced Horus Agent, which is assessed as an evolution of that earlier Apollo-based tooling. Apollo has also been observed in campaigns linked with pro-Ukrainian hacktivist and intrusion clusters alongside other frameworks such as Sliver, Havoc, and AdaptixC2, indicating its use as one component in broader intrusion operations.

Operationally, Apollo is relevant to espionage and hands-on-keyboard intrusions because it provides flexible remote control of Windows systems and integrates into the broader Mythic ecosystem of agents and transports. Detection efforts have specifically targeted Apollo through YARA and behavioral signatures tied to Mythic C2 communication patterns and .NET Apollo agent structures.