Havoc

Most infections likely began through a link sent to the victims. The links launched the TrueConf client and showed an update prompt alleging that there is a newer version available.

CVE-2026-3502 is a flaw in TrueConf Client that allows it to download and install updates without verifying them. Attackers who can tamper with the update source can deliver malicious files, leading to arbitrary code execution on the system.

Havoc has also been employed in connection with a fraudulent npm module dubbed aabquerys that, once installed, triggers a three-stage process to retrieve the Demon implant.

The attack sequence documented by Zscaler begins with a ZIP archive that embeds a decoy document and a screen-saver file that's designed to download and launch the Havoc Demon agent on the infected host.

MITRE ATT&CK ID Technique T1566.002 Phishing: Spearphishing Link

the injected process used WMIC to query Windows Defender exclusion paths... the attackers used a command shell session spawned from the malicious DLL to move laterally via WMIC

The atexec module was used to remotely configure a scheduled task on the targeted system... schtasks /create /tn \Microsoft\Windows\Clip2

Attackers replaced update files with malicious ones, tricking users into installing them. This delivered the Havoc framework, enabling control, surveillance, and persistence.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

The VBS hides its intent behind string splitting. Deobfuscated, the VBS launches a hidden cmd that downloads the MSI from Google Cloud Storage with curl, runs it with msiexec /quiet /norestart, and deletes the file

the open-source Havoc framework is an advanced post-exploitation command-and-control framework capable of bypassing the most current and updated version of Windows 11 defender due to the implementation of advanced evasion techniques such as indirect syscalls and sleep obfuscation

CISA’s confirmation that the vulnerability is being exploited follows a report from cybersecurity researchers at Check Point outlining an alleged Chinese hacking campaign targeting governments in Southeast Asia. Check Point said Chinese hackers have been exploiting the vulnerability in a campaign they call TrueChaos.

The infections began when TrueConf client application launched, probably by a link sent to the target from the attacker. This link launched the already installed TrueConf client and presented an update prompt claiming that a newer version was available.

In October, Cluster Charlie was observed deploying additional C2 tooling by using DLL hijacking to abuse legitimate software downloaded by the operators to make a vulnerable executable available for use.

At first execution, the stager writes: HKCU\Environment\UserInitMprLogonScript = <path to mpextms.exe>

The atexec module was used to remotely configure a scheduled task on the targeted system... schtasks /create /tn \Microsoft\Windows\Clip2

In this campaign, sideloaded modules acted as intermediary loaders that decrypted hidden configuration data stored inside the Windows registry rather than writing anything suspicious to disk.

Using previously stolen credentials, the attackers deployed a web shell to a web application server using its built-in file upload feature.

At first execution, the stager writes: HKCU\Environment\UserInitMprLogonScript = <path to mpextms.exe>

The atexec module was used to remotely configure a scheduled task on the targeted system... schtasks /create /tn \Microsoft\Windows\Clip2

using a custom malware loader called HUI loader to inject a Cobalt Strike beacon into the Remote Desktop utility mstsc.exe... attackers used the Havoc tool to inject code into other processes

Encrypted C2 traffic. A fresh AES key is negotiated at first contact; all later traffic is encrypted.

allowing attacker-supplied modules to run under a trusted execution context from non-standard paths.

The MSI also has no digital signature ... Only mpextms.exe is signed. The stager DLL is not.

The next step is an MSI that pretends to be a Microsoft update ... Microsoft Endpoint DLP Module ... Inside the installer are two programs: mpextms.exe ... endpointdlp.dll ... Side by side, the MSI and DLL look like one Microsoft bundle.

using a custom malware loader called HUI loader to inject a Cobalt Strike beacon into the Remote Desktop utility mstsc.exe... attackers used the Havoc tool to inject code into other processes

The VBS hides its intent behind string splitting. Deobfuscated, the VBS launches a hidden cmd that downloads the MSI from Google Cloud Storage

Deobfuscated, the VBS launches a hidden cmd that downloads the MSI from Google Cloud Storage with curl, runs it with msiexec /quiet /norestart, and deletes the file

the open-source Havoc framework is an advanced post-exploitation command-and-control framework capable of bypassing the most current and updated version of Windows 11 defender due to the implementation of advanced evasion techniques such as indirect syscalls and sleep obfuscation

In October, Cluster Charlie was observed deploying additional C2 tooling by using DLL hijacking to abuse legitimate software downloaded by the operators to make a vulnerable executable available for use.

In this campaign, sideloaded modules acted as intermediary loaders that decrypted hidden configuration data stored inside the Windows registry rather than writing anything suspicious to disk.

deploy the open-source SharpHound tool for Active Directory infrastructure mapping

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

the open-source Havoc framework is an advanced post-exploitation command-and-control framework capable of bypassing the most current and updated version of Windows 11 defender due to the implementation of advanced evasion techniques such as indirect syscalls and sleep obfuscation

T1071 Application Layer Protocol — Мимикрия C2 под HTTP/HTTPS/DNS

When we ran the DLL in a sandbox with internet access, the behavior matched exactly: it issued GET /stage/<32-hex> and then POST /api/v2/telemetry/diag against 194[.]59[.]31[.]192:8443, using the Microsoft-Delivery-Optimization/10.1 user-agent.

По MITRE ATT&CK это конкретные техники: Proxy ( T1090, Command and Control ) - маршрутизация C2-трафика через промежуточный узел

The DLL we recovered is just a stager: its only job is to reach out to the C2 server and download the demon over the network. The demon never exists on disk.

Cobalt Strike uses a command-line interface to interact with systems. Brute Ratel C4 can use cmd.exe for execution. Havoc can execute commands via cmd.exe. Covenant provides access to a Command Shell in Windows environments for follow-on command execution and tasking.

Exfiltration of data of intelligence value was still an objective after the resumption of activity.