Loading story…
Threat actors have begun using the open-source Havoc post-exploitation framework in real-world attacks, positioning it as an alternative to tools such as Cobalt Strike, Sliver, and Brute Ratel. Researchers observed a targeted intrusion against an unnamed government organization in which attackers delivered a ZIP archive containing a decoy document and a malicious .scr file that installed the Havoc Demon implant. Once deployed, the malware enabled remote command execution, collection of command output, encryption of results, and exfiltration to attacker-controlled command-and-control infrastructure.
Analysis cited in multiple reports said Havoc includes evasion features such as indirect syscalls and sleep obfuscation, helping it bypass fully updated Windows 11 Defender protections. The framework was also linked to a malicious npm package, aabquerys, which triggered a three-stage infection chain to fetch the Demon payload before the package was removed. The activity reflects a broader trend of offensive security frameworks escaping legitimate red-team use and being repurposed by attackers for stealthy post-compromise operations.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Security reporting from Zscaler and others highlighted that attackers had begun using the open-source Havoc command-and-control framework as an alternative to tools like Cobalt Strike, Sliver, and Brute Ratel. The reports also noted Havoc's evasion features, including indirect syscalls and sleep obfuscation, which helped it bypass modern Windows defenses.
Threat actors also used a malicious npm package named aabquerys in a three-stage infection chain to retrieve the Havoc Demon implant. The package was later removed after its malicious behavior was identified.
In early January 2023, threat actors targeted an unnamed government organization with a ZIP archive containing a decoy document and a malicious screen-saver file that deployed the Havoc Demon implant. The campaign showed real-world adoption of the open-source Havoc post-exploitation framework in targeted attacks.
Researchers published fuller technical disclosure on Havex trojans, expanding public understanding of the malware's behavior and capabilities. This added technical detail to the already known Havex campaign activity.
A cyber-espionage campaign using the Havex remote access trojan was reported as affecting industrial control system and SCADA targets. The activity marked Havex as a threat to operational technology environments.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcenetresec.com
Open sourcesecurityaffairs.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how the **Havoc** command-and-control framework, an open-source post-exploitation platform built for red teaming, is being used in real intrusions and can be identified through distinctive network and host artifacts. The analysis describes Havoc’s architecture, beaconing, payload generation, and sleep-obfuscation, and says defenders can spot traffic by looking for the default `0xDEADBEEF` magic value, Havoc `AgentID` patterns, and its **AES-CTR** encryption workflow in packet captures and memory. The report says encryption keys used to inspect Havoc traffic can be recovered from several sources, including modified source code, the teamserver **SQLite** database, packet captures, and memory dumps. It also highlights defensive tooling released to support investigations, including a **YARA** rule, a **Volatility** plugin, and a Python parser for decrypting and analyzing Havoc communications, while noting that SIEM visibility is weaker when operators rely on **BOFs** for stealth and stronger when they use shell or PowerShell tasking that leaves traces in Windows logs and Elastic.
Aug 14, 2026
Sophos X-Ops reported that a threat actor built and tested an AI-assisted post-exploitation framework designed to evade endpoint detection and response tools, using a mix of malicious files, Cobalt Strike profiles, Python shellcode-injection scripts, a Telegram Bot API command-and-control channel, and a Cloudflare Worker redirector. Investigators found a supporting Git repository that automated Active Directory discovery and maintained a malware-testing lab with multiple virtual machines to evaluate bypass techniques against **Sophos**, **CrowdStrike**, and **Microsoft Defender** environments; many scripts appeared partly AI-generated and included Russian-language elements. The framework used a Python payload generator to create **Rust**- and **Go**-based payloads with encryption, evasion, and alternate execution methods, ultimately producing nearly 80 modules that tested more than 70 techniques. Sophos said the operators used tools including **Cursor**, **Claude Opus 4.5**, and **Model Context Protocol** to coordinate workflows, ingest public research, and map activity to `MITRE ATT&CK`, but found no clear evidence that AI independently invented new malware capabilities; the company also linked the development activity to known ransomware deployment and data-theft operations and urged organizations to maintain layered defenses including patching, MFA, passkeys, and strong EDR coverage.
Jun 29, 2026
Researchers linked a cluster of hacktivist activity with medium confidence to **4BID** and associated groups including **Hakerskii Kit**, **C.A.S.**, and **Goffee**, reporting that operations have expanded beyond Russia and Belarus into **Kazakhstan, the UAE, Syria, and Egypt**. The attackers primarily obtained initial access by exploiting **ProxyShell** on vulnerable **Microsoft Exchange** servers, then installed the `fd.aspx` web shell and used custom scripts alongside legitimate remote management and monitoring tools to deepen access and persistence. Post-compromise activity included deployment of **BlackReaperRAT**, **Warp RAT**, **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, and a newly documented **BlackSalt** backdoor, as well as utilities such as **AnyDesk**, **Panorama9**, **Dev Tunnels**, **Tactical RMM**, and **Nezha Monitoring**. Investigators also observed **EDR killers**, **ClearWater ransomware**, and an updated **Blackout Locker** variant, indicating that the campaigns have evolved from primarily politically motivated disruption into broader operations with a stronger **financially motivated** component.
Jul 1, 2026