CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Havoc C2 Framework Deployed via Fake Tech Support Campaign

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Threat actors impersonating IT support have deployed the Havoc C2 framework across multiple organizations using email spam and phone calls. The campaign, identified by Huntress, involved initial access followed by rapid lateral movement, suggesting data exfiltration or ransomware as the end goal. The attackers used a mix of custom Havoc Demon payloads and legitimate RMM tools for persistence. The tactics resemble those used by the Black Basta ransomware group, indicating possible affiliation or adoption of their methods. The attack chain begins with email spam, followed by a phone call from fake IT support. Victims are tricked into granting remote access, leading to the deployment of Havoc shellcode via DLL sideloading. The attackers also use legitimate RMM tools for persistence and employ defense evasion techniques to bypass security software.

Timeline

  1. 03.03.2026 19:15 1 articles · 23h ago

    Havoc C2 Framework Deployed via Fake Tech Support Campaign

    Threat actors impersonating IT support deployed the Havoc C2 framework across multiple organizations using email spam and phone calls. The campaign involved initial access followed by rapid lateral movement, suggesting data exfiltration or ransomware as the end goal. The attackers used a mix of custom Havoc Demon payloads and legitimate RMM tools for persistence. The tactics resemble those used by the Black Basta ransomware group, indicating possible affiliation or adoption of their methods.

    Show sources
    Open in new tab

Information Snippets