Loading malware…
Havoc is an open-source post-exploitation command-and-control framework used by red teams and widely repurposed by threat actors in real intrusions. Its primary implant, commonly referred to as Demon, is used after initial compromise to provide interactive access, tasking, and follow-on operations on victim systems. Havoc has been observed in espionage, hacktivist, financially motivated, and opportunistic campaigns, including activity linked to Chinese state-directed operations, pro-Ukrainian hacktivist clusters, and low-skill criminal operators.
Observed tradecraft shows Havoc commonly deployed through multi-stage in-memory chains involving script-based stagers, PowerShell loaders, reflective PE loading, and shellcode execution, often without writing the final implant to disk. It has also been launched through DLL sideloading, malicious shortcut-based phishing chains, web-shell-assisted deployment on already compromised servers, and loader frameworks such as Donut-style reflective loaders. In some campaigns, Havoc was installed from archives or side-loaded via trusted signed binaries to reduce detection.
Once active, Havoc supports post-exploitation functions such as remote command execution, reconnaissance, credential and session follow-on activity through operator tasking, file transfer, and broader intrusion enablement. Reporting also associates Havoc deployments with screen monitoring and attempts to compromise additional systems in the network. Operators have used Havoc alongside scheduled-task persistence, process injection, and defense-evasion techniques including in-memory execution, encrypted or externalized configuration, indirect API resolution, and other anti-analysis measures inherited or reused by related tooling.
Havoc is primarily associated with Windows intrusions, where Demon implants and loaders are most frequently documented, but it is also referenced as part of macOS and Linux operator tradecraft and as HTTP-based C2 infrastructure on Linux servers. It has been used against enterprises, government entities, healthcare, aviation, public service organizations, and small businesses. Because Havoc is openly available and increasingly common in intrusion sets, its presence generally indicates an active post-compromise operation rather than a uniquely attributable actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in TrueConf Client, tracked as CVE-2026-3502 (CVSS score of 7.8), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-3502 is a flaw in TrueConf Client that allows it to download and install updates without verifying them. Attackers who can tamper with the update source can deliver malicious files, leading to arbitrary code execution on the system. | Attackers replaced update files with malicious ones, tricking users into installing them. This delivered the Havoc framework, enabling control, surveillance, and persistence.
Researchers at Sophos recently discovered that in mid-2025, Bronze Butler (a.k.a. Tick, RedBaldKnight, Stalker Panda, Swirl Typhoon) exploited a critical vulnerability in Lanscope when it was still a zero-day... Motex disclosed a vulnerability designated CVE-2025-61932... Motex has released a fix... CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities (KEV) catalog.
Attack chains mounted by the adversary have been found to abuse CVE-2025-8088, a now-patched security flaw impacting RARLAB WinRAR that allows for arbitrary code execution when specially crafted archives are opened by targets. The exploitation of the vulnerability was observed about eight days after its public disclosure in August.
19 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group has also used a DLL sideloading technique to launch the Havoc C2 post-exploitation framework, and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
Havoc C2 for post-exploitation tasks like pivoting through compromised hosts into internal networks, privilege escalation, and maintaining stealth
The TrueChaos campaign has been found to weaponize this flaw in the update mechanism to likely deploy the open-source Havoc command-and-control (C2) framework to vulnerable endpoints.
The group uses a combination of living-off-the-land tools (like ligolo, socat, proxychains) and post-exploitation frameworks (like Havoc, MeshCentral, and custom C2 binaries) across Linux and cloud systems.
What once ended with a $300 gift card purchase now ends with a modified Havoc C2 framework burrowed into your environment... deploying a mix of custom Havoc Demon payloads...
"...used to execute the Havoc command-and-control (C2) framework."
26 distinct techniques documented for this family, organized by ATT&CK tactic.
These hashes empower server clustering, identification of unique and similar servers, and the pursuit of malicious actors with heightened confidence.
The most significant aspect of the attack was the attacker's installation of OpenSSH Server and Tailscale on a victim's machine, creating a covert access channel independent of the command-and-control server. Even after the Havoc infrastructure went offline, the attacker maintained access through this separate, encrypted mesh network.
the attackers used a command shell session spawned from the malicious DLL to move laterally via WMIC, and to deploy the open-source SharpHound tool...
That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.
We can simply run this script using invoke-expression since Havoc doesn’t have a PowerShell-Import function. I host the script and IEX it through Havoc.
the attackers used the shell to execute commands on the targeted web app server... /c wevtutil qe ... /c WMIC ... findstr /i /c:exclude /c:whitelist /c:blocklist
That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.
The most significant aspect of the attack was the attacker's installation of OpenSSH Server and Tailscale on a victim's machine, creating a covert access channel independent of the command-and-control server. Even after the Havoc infrastructure went offline, the attacker maintained access through this separate, encrypted mesh network.
That username and password is then passed to schtasks to schedule a task that executes our APCTest.exe executable at a specified time.
After executing the chain, we get a beacon back with our process injected into RuntimeBroker.exe
Now that we have a high integrity beacon, we can use the SharpEfsPotato tool to get system ... dotnet inline-execute /home/kali/Desktop/SharpEfsPotato.exe -p C:\Users\User\Downloads\aese.exe ... the last is at System level privileges.
Harriet is a payload framework ... The tool will encrypt the shellcode and the function calls ... For this demo, I’m just going to choose the first option, Fully-Automated AES Encryption.
copying the application’s dynamic linking library (DLL) to a web documents folder and disguising it as a PDF... another malicious DLL masquerading as an .ini file... deployed the XieBroC2 framework as a backup... renamed jconsole.exe, this time renamed firefox.exe
After executing the chain, we get a beacon back with our process injected into RuntimeBroker.exe
the threat actor using credentials stolen from an unmanaged device and a dropped web shell. The attackers used the shell to execute rundll32.exe, injecting a malicious Havoc DLL...
80 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
91 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Command-and-control framework mentioned as part of the growing set of C2 tools SOC teams should detect on compromised hosts.
C2 framework/agent referenced as an example payload used after initial access on macOS.
An adversary emulation/C2 framework whose Demon agent was used as part of a multi-stage in-memory intrusion chain to establish control on victim machines. In this case, access persisted even after the Havoc infrastructure went offline because the attacker also installed alternative remote access mechanisms.
Referenced as another known post-exploitation framework for comparison with AdaptixC2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.