Havoc Malware: Techniques, Targets, and Threat Overview

Introduction to Havoc Malware:

Security analysts have noticed a trend among threat actors shifting towards adopting a novel open-source command and control (C2) framework called Havoc as an alternative to paid solutions like Cobalt Strike and Brute Ratel. Developed in the C language and introduced in 2022, Havoc’s Main branch received updates in 2023. Noteworthy features of Havoc include its cross-platform compatibility and its ability to bypass Microsoft Defender on updated Windows 11 systems through techniques like sleep obfuscation, return address stack spoofing, and indirect syscalls. Similar to other exploitation kits, Havoc offers a broad array of modules, enabling penetration testers (and malicious actors) to carry out diverse tasks on compromised devices, such as executing commands, managing processes, downloading additional payloads, manipulating Windows tokens, and executing shellcode. All of these operations are facilitated through a web-based management console, providing the attacker with visibility into compromised devices, events, and task outputs.

Delivery Methods of Havoc Malware:

The source code for Havoc was uploaded to GitHub at the following URL: 

https://github.com/HavocFramework/Havoc/blob/main/client/src/Havoc/Demon/ConsoleInput.cc#L876-L883.

The Havoc C2 framework, crafted by C5pider, consists of three primary components: the Demon agent, deployed on infected machines to communicate with a configured Teamserver; the Teamserver, functioning as the command and control (C2) server managing communications with agents; and the Client, utilized by threat actors to connect to a Teamserver for managing and issuing commands to connected agents.

Impact of Havoc Malware:

In early January 2024, an undisclosed threat group deployed this post-exploitation kit as part of an attack campaign targeting a government organization. Observations by security experts revealed that the shellcode loader dropped on compromised systems disables the Event Tracing for Windows (ETW), and the final Havoc Demon payload is loaded without the DOS and NT headers to evade detection. Furthermore, the framework was distributed via a malicious npm package (Aabquerys), masquerading as a legitimate module, as reported by ReversingLabs’ research team earlier in the month. According to the report, “Demon.bin is a malicious agent with typical RAT (remote access trojan) functionalities that was generated using an open-source, post-exploitation, command and control framework named Havoc,” indicating its versatility in building malicious agents in various formats, including Windows PE executable, PE DLL, and shellcode.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

Havoc Malware TTPS

Havoc IOCs (Sample of 50)