Loading malware…
Havoc is an open-source post-exploitation command-and-control framework released in 2022 and developed by C5pider. It consists of a teamserver and operator client and uses proprietary implants known as Demons. The framework is written across Golang, C++, and Qt, and is designed for flexible hands-on-keyboard operations after initial compromise. Havoc supports payload generation in multiple formats, including executables, DLLs, and shellcode, and communicates over HTTP(S) and SMB.
Havoc is widely used as a red-team framework but has also been adopted in real intrusions by multiple threat actors. Reported use includes espionage and intrusion activity associated with Bitter, Iranian operators aligned with Lemon Sandstorm tradecraft, campaigns targeting Czech government and military interests, and other operations against government and critical infrastructure environments. It has also appeared alongside other offensive frameworks such as Cobalt Strike, Sliver, and Mythic in mixed-tool intrusions.
Operationally, Havoc is a post-exploitation platform rather than a primary initial-access malware family. It is commonly deployed after compromise through loaders, shellcode runners, DLL side-loading, proxy execution, scheduled tasks, PowerShell-based staging, or trojanized software and update chains. Observed delivery chains include spearphishing attachments and lures, MSI-based installers, malicious LNK-driven execution, exploitation of public-facing software, and use of legitimate executables to side-load Havoc payloads.
The Demon implant supports remote command execution, file transfer, screenshot collection, and in-memory tasking. Havoc can execute Beacon Object Files for stealthier operator actions and supports sleep-obfuscation techniques including Ekko, Foliage, and WaitForSingleObjectEx. Configuration options observed in Demon payloads include sleep and jitter timing, indirect syscalls, AMSI and ETW patching, stack spoofing, injection targets, HTTP method selection, and host rotation. Havoc has been observed injected into suspended processes and delivered through malicious DLLs and shellcode loaders, reflecting strong emphasis on defense evasion and flexible execution.
Because Havoc is a framework, its exact behavior depends on operator tasking and loaded modules, but high-confidence observed uses include post-exploitation, persistence through scheduled tasks or side-loading chains, reconnaissance, credential-focused follow-on activity by operators, exfiltration of collected data, and defense evasion through memory-resident execution and anti-detection features. It primarily targets Windows environments in observed intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Around the same time, Check Point also reported that another high-severity security flaw in the TrueConf client (CVE-2026-3502) was exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia to deploy the Havoc C2 framework. | Check Point also reported that another high-severity security flaw in the TrueConf client (CVE-2026-3502) was exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia to deploy the Havoc C2 framework.
Researchers at Sophos recently discovered that in mid-2025, Bronze Butler (a.k.a. Tick, RedBaldKnight, Stalker Panda, Swirl Typhoon) exploited a critical vulnerability in Lanscope when it was still a zero-day... Motex disclosed a vulnerability designated CVE-2025-61932... Motex has released a fix... CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities (KEV) catalog.
Attack chains mounted by the adversary have been found to abuse CVE-2025-8088, a now-patched security flaw impacting RARLAB WinRAR that allows for arbitrary code execution when specially crafted archives are opened by targets. The exploitation of the vulnerability was observed about eight days after its public disclosure in August.
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This executes a Havoc payload. Created using domain administrator account. | The payload component was identified as a Havoc agent.
Proofpoint observed Bitter using KugelBlitz to deploy the Havoc C2 framework during hands-on activities.
GateSentinel has been independently documented as part of APT36's evolving toolkit and has been observed alongside other frameworks such as Cobalt Strike and Havoc in recent Transparent Tribe campaigns.
The group has also used a DLL sideloading technique to launch the Havoc C2 post-exploitation framework, and establishes an SSH backdoor via AdaptixC2 or OpenSSH.
Havoc C2 for post-exploitation tasks like pivoting through compromised hosts into internal networks, privilege escalation, and maintaining stealth
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Analysis of the compromised environments revealed that the attackers gained initial access in most cases by exploiting the ProxyShell vulnerability in Microsoft Exchange, which allows for full server compromise.
Table 11. Scheduled tasks created by the adversary throughout the reported intrusion... The heavy use of scheduled tasks to execute malware aligns with previous Lemon Sandstorm activity. | These backdoors were run using scheduled tasks.
we successfully phished some of the client staff, and lured them to execute a payload that provided us with Command & Control (C2) access.
In the context of Havoc, a shell or PowerShell command is specified by the attacker, and this opens cmd exe or powershell exe, respectively.
Table 11. Scheduled tasks created by the adversary throughout the reported intrusion... The heavy use of scheduled tasks to execute malware aligns with previous Lemon Sandstorm activity. | These backdoors were run using scheduled tasks.
config_r['inj_target32'] = extract_str(4*5, struct_b, config_r['inj_target_len32']) ... config_r['inj_target64'] = extract_str(current_offset, struct_b, config_r['inj_target_len64'])
setup.ps1 launches documents.exe (Java packer) → jar.exe; ... The stub.exe Havoc payload was unknown to VirusTotal at time of capture, indicating fresh, in-the-wild tooling.
The DemonInit function is responsible for loading modules like ntdll.dll and kernel32.dll via PEB (Process-Environment Block). It then resolves or retrieves the functions from those loaded modules...
config_r['inj_target32'] = extract_str(4*5, struct_b, config_r['inj_target_len32']) ... config_r['inj_target64'] = extract_str(current_offset, struct_b, config_r['inj_target_len64'])
The shellcode turned out to be a malicious Havoc DLL ... the loader spawns the notepad.exe process in a suspended mode ... using NTAPIs, it is written into memory.
Finally, the compressed and encoded shellcode is obtained via Base64 decoding and LZMA decompression. Now, after the shellcode is decoded, crypto algorithms like AES/RC4 are used to decrypt it.
the payload deployed to the targets via the phishing was crafted in a way to run the C2 agent code in both Microsoft Edge and Google Chrome browser processes on each victim's host
config_r['http_method'] = extract_str(current_offset, struct_b, config_r['http_method_len']) ... config_r['host'] = extract_str(current_offset, struct_b, config_r['host_len'])
At this point of the capture, we could monitor all the HTTP and TCP traffic between the demon and the teamserver.
At the time of writing, Havoc supports HTTP(s) and SMB as a communication protocol for the implants.
115 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
107 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A C2 framework mentioned only as background context regarding APT36's broader tooling.
Command-and-control framework mentioned in passing as deployed in a separate TrueConf-related campaign targeting Southeast Asia.
Implant mentioned in connection with a separate April 2026 TrueConf zero-day campaign dubbed Operation True Chaos.
An implant reportedly used in a separate TrueConf-targeting campaign called Operation True Chaos, attributed by CheckPoint to Chinese threat actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.