Open‑Source C2 Frameworks: overview of popular solutions

Open‑Source C2 Frameworks: overview of popular solutions

One of the key trends in C2‑framework development is expanding functionality through modules and third‑party components, including BOF utilities. To assess how relevant BOF utilities are today, we analyzed a list of open‑source C2 platforms that support them.

According to the comparative matrix of C2 platforms C2 Matrix the following platforms support BOF: • Sliver • AdaptixC2 • Havoc • Empire The C2 framework Mythic, where BOF support depends on the connected agent, may also be included in the list.

Sliver One of the most actively developed open‑source C2 frameworks. The project receives regular updates with new features and fixes. The last public release — v1.7.3 — was published on February 24, 2026. Language: Go GUI: CLI Agents: Windows / Linux / macOS. C2 channels: mTLS, WireGuard, HTTP(S), DNS.

Extensions for Sliver are available on the Sliver Armory.

Mythic A C2 platform designed for complex hybrid infrastructures that require controlling diverse agents and components from a single console with independently extensible functionality. Language: Go + Python + Docker GUI: Web UI Agents: Windows / Linux / macOS. C2 channels: different communication channels are connected separately.

Over the past six months, the following new Mythic modules have been released: • azureBlob – a Mythic C2 profile using Azure Blob Storage as a command‑and‑control and data exchange channel. Each agent runs in an isolated container, enabling separate communication flows between instances. • container_wrapper and container_registry – extensions that automate containerized payload delivery.

The full catalog of agents and C2 profiles is available at Mythic Meta.

AdaptixC2 A rapidly evolving modular framework whose agents are extremely lightweight and highly flexible in network profile configuration. The repository is actively maintained. Updates focus not only on bug fixes but also on architectural improvements, new components, and expanded platform capabilities. Version v1.2 was released in early 2026. Language: Go + C++/Qt GUI: Qt GUI Agents: Windows / Linux / macOS. C2 channels: HTTP/S, DNS/DoH, SMB, TCP, mTLS.

Extensions are available in Extension‑Kit.

Havoc A framework focused on evading modern defense solutions (including EDR). Havoc features a modern architecture, extension support, and a convenient management interface, but active development has ceased (the repository was archived in February 2026). Language: Go/C/C++ GUI: Qt GUI Agents: Windows. C2 channels: HTTP(S), SMB, TCP.

Available templates for building custom modules and a catalog of third‑party extensions at Havoc Store.

Empire A Windows‑focused C2 framework that remains relevant due to ongoing development of the BC‑SECURITY branch (the original repo was archived in 2020) and its up‑to‑date codebase. Recent updates are focused on compatibility, stability, component refreshes, and broader agent support. Architecturally, however, the project represents an earlier C2 generation, emphasizing built‑in modules. The latest public version — v6.6.0 — was released on May 28, 2026. Language: Python GUI: Starkiller Agents: Windows. C2 channels: HTTP(S), TCP, WebSocket, Custom Listener Plugins.

Among the reviewed open‑source C2 frameworks, Sliver, Mythic and AdaptixC2 stand out for active development, regular updates, and well‑built extension ecosystems. Their BOF support and modular architectures make it easy to expand functionality. Ultimately, choosing a C2 framework depends on specific operational goals and infrastructure requirements, so other platforms remain relevant for certain use cases.