Loading story…
Researchers detailed how the Havoc command-and-control framework, an open-source post-exploitation platform built for red teaming, is being used in real intrusions and can be identified through distinctive network and host artifacts. The analysis describes Havoc’s architecture, beaconing, payload generation, and sleep-obfuscation, and says defenders can spot traffic by looking for the default 0xDEADBEEF magic value, Havoc AgentID patterns, and its AES-CTR encryption workflow in packet captures and memory.
The report says encryption keys used to inspect Havoc traffic can be recovered from several sources, including modified source code, the teamserver SQLite database, packet captures, and memory dumps. It also highlights defensive tooling released to support investigations, including a YARA rule, a Volatility plugin, and a Python parser for decrypting and analyzing Havoc communications, while noting that SIEM visibility is weaker when operators rely on BOFs for stealth and stronger when they use shell or PowerShell tasking that leaves traces in Windows logs and Elastic.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Spamhaus reported a 22% increase in the use of Havoc as a backdoor between Q2 and Q4 2023. The report cited growing use of the framework in the wild.
The content says Havoc usage increased again by 22% toward the end of 2023. This indicates renewed adoption after the earlier decline.
The content states that Havoc usage dropped by 36% between Q2 and Q3 2023. This reflects a decline in observed use during mid-2023.
The Havoc command-and-control framework, created by C5pider, was first released as an open-source post-exploitation platform. The source says it remained under active development at the time of writing.
Between Q4 2022 and Q1 2023, Havoc drew attention because it could be used to bypass the latest version of Windows 11 Defender. This marked an early increase in interest around the framework's offensive utility.
Immersive Labs analyzed Havoc's architecture, traffic patterns, encryption workflow, and memory artifacts to identify host- and network-based indicators of compromise. The research also produced detection outputs including a YARA rule, a Volatility plugin, and a Python parser for decrypting and analyzing Havoc traffic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
immersivelabs.com
Open sourcehavocframework.com
Open sourceinfo.spamhaus.com
Open sourceinfo.spamhaus.com
Open sourceinfo.spamhaus.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have begun using the open-source **Havoc** post-exploitation framework in real-world attacks, positioning it as an alternative to tools such as **Cobalt Strike**, **Sliver**, and **Brute Ratel**. Researchers observed a targeted intrusion against an unnamed government organization in which attackers delivered a ZIP archive containing a decoy document and a malicious `.scr` file that installed the **Havoc Demon** implant. Once deployed, the malware enabled remote command execution, collection of command output, encryption of results, and exfiltration to attacker-controlled command-and-control infrastructure. Analysis cited in multiple reports said Havoc includes evasion features such as **indirect syscalls** and **sleep obfuscation**, helping it bypass fully updated **Windows 11 Defender** protections. The framework was also linked to a malicious npm package, `aabquerys`, which triggered a three-stage infection chain to fetch the Demon payload before the package was removed. The activity reflects a broader trend of offensive security frameworks escaping legitimate red-team use and being repurposed by attackers for stealthy post-compromise operations.
Jul 12, 2026
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026
Researchers published detection guidance for the open-source **PoshC2** command-and-control framework, emphasizing that operators who leave default settings in place can expose distinctive indicators across network and host telemetry. Reported network indicators include default HTTP(S) beacon URL patterns, static `200` and `404` responses, a default self-signed TLS certificate, predictable beacon timing, and TLS fingerprinting opportunities using **JA3** and server-side **JA3S** techniques to identify characteristic client and server handshake behavior. On endpoints, the guidance highlighted suspicious loading of `System.Management.Automation.dll` or `mscoree.dll` into unmanaged processes, repeated PowerShell ScriptBlock logging artifacts, and default process migration into `netsh.exe`. Researchers also pointed to persistence artifacts such as `Wallpaper777`, `Wallpaper555`, `Wallpaper666`, and `IEUpdate` autoruns, along with binary traits including the `VoidFunc` DLL entry point and YARA-detectable signatures, and said a GitHub repository was created to track PoshC2 indicators of compromise and detections over time.
Aug 15, 2026