Fake Tech Support Delivers Havoc Command & Control

A sophisticated cyber attack campaign combines social engineering and advanced malware techniques. Attackers pose as IT support to gain initial access, then deploy a modified version of the Havoc C2 framework. The malware uses DLL sideloading, indirect syscalls, and custom loaders to evade detection. After compromising the initial system, the attackers rapidly move laterally, establishing persistence through scheduled tasks and legitimate remote monitoring tools. The campaign demonstrates a blend of human-centric initial access methods and advanced technical evasion techniques, highlighting the need for comprehensive security measures spanning user awareness and technical controls.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26