merlin

Why we included this project

Merlin is a solid pick for red teams and penetration testers who want a cross-platform command-and-control channel. The Go server and its matching agent can talk HTTP/1.1, HTTP/2, or HTTP/3, so operators choose the transport that fits the target environment instead of being locked into one protocol. The agent can also form peer-to-peer links over SMB, TCP, and UDP, which helps when moving laterally through segmented networks. After you get a foothold, it can execute .NET assemblies in-process or in a sacrificial process, run Windows executables, and use several shellcode injection techniques. Configurable message padding, encryption transforms, and JA3 fingerprint changes make the traffic harder to spot, and the gRPC-based CLI lets multiple users drive the same server. Teams already on the Mythic framework can run Merlin as an agent inside it.