Apollo

Apollo is an implant/agent associated with the Mythic command-and-control framework. In the provided reporting, it is described as an open-source .NET Mythic agent and as the basis for Stealth Falcon’s earlier customized Apollo implants used prior to the group’s newer Horus tooling. Check Point assessed Horus Agent to be an evolution or rewritten, more advanced successor to Stealth Falcon’s customized Apollo implant, with Stealth Falcon (aka FruityArmor) previously using customized Apollo agents in operations spanning roughly 2022–2023. The content does not directly attribute specific standalone Apollo intrusions, but it does state that Stealth Falcon’s later Horus malware replaced earlier customized Apollo agents in espionage activity targeting government and defense entities in the Middle East and Africa, including Turkey, Qatar, Egypt, and Yemen. Additional content notes that defenders published YARA rules for detecting the Mythic C2 framework and its Apollo agent, including a .NET Apollo variant, by matching strings related to C2 communications, agent-specific classes, built-in commands, and internal manager classes. No high-confidence infection vector, standalone Apollo-specific capabilities, or Apollo-specific IOCs beyond those detection-rule references are directly provided in the content.