Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go.
The tool addresses the need for flexible, modern command and control infrastructure during post-exploitation phases. It operates as a server-agent architecture where the server manages multiple agents through a gRPC-based command line interface supporting multi-user access. Agents communicate with the server using HTTP/2, HTTP/1.1, HTTP/3 over QUIC, or peer-to-peer channels via SMB, TCP, and UDP. The architecture emphasizes operational security through configurable data encoding and encryption transforms including AES, JWE with PBES2 key derivation, RC4, and XOR, along with multiple authentication mechanisms ranging from none to OPAQUE password-authenticated key exchange and encrypted JWT.
Teams should consider this tool when they need a modern C2 framework with strong encryption defaults and cross-platform agent deployment. It suits operations requiring flexible communication protocols and in-process code execution capabilities, particularly those targeting Windows environments where it supports .NET assembly execution, arbitrary PE execution, and multiple shellcode injection techniques. The tool integrates with Mythic for teams already using that framework.
Development activity shows consistent maintenance with regular updates to the codebase. The project maintains a modular architecture across multiple supporting repositories covering agent source code, CLI tooling, documentation, and message libraries. Active documentation is kept current with detailed guides for configuration and usage. The tool receives ongoing refinement in its encryption implementations and agent capabilities.
