Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyber attack campaign combines social engineering and advanced malware techniques. Attackers pose as IT support to gain initial access, then deploy a modified version of the Havoc C2 framework. The malware uses DLL sideloading, indirect syscalls, and custom loaders to evade detection. After compromising the initial system, the attackers rapidly move laterally, establishing persistence through scheduled tasks and legitimate remote monitoring tools. The campaign demonstrates a blend of human-centric initial access methods and advanced technical evasion techniques, highlighting the need for comprehensive security measures spanning user awareness and technical controls.

The Fake Tech Support Delivers Havoc Command & Control campaign is a multi-stage cyber attack that begins with social engineering, where attackers pose as IT support to trick users into granting access or executing malicious payloads. Once inside, the attackers deploy a customized version of the Havoc C2 framework, a modular malware platform used for command and control operations. The malware employs sophisticated evasion techniques including DLL sideloading, which involves loading malicious DLLs through legitimate executables to bypass security controls; indirect syscalls that avoid direct API calls to evade detection by endpoint protection; and custom loaders that further obscure the malware’s presence. Following initial infection, the attackers perform rapid lateral movement across the network, leveraging legitimate remote monitoring and management tools to blend in with normal network activity. Persistence is maintained through scheduled tasks and other legitimate mechanisms, complicating detection and removal. The campaign’s indicators of compromise include numerous file hashes and domains linked to the malware infrastructure. Although no CVE or known exploits are associated with this campaign, the combination of social engineering and advanced malware techniques represents a significant threat vector. The campaign underscores the importance of integrating user training with robust technical controls, including behavioral monitoring and anomaly detection, to identify and mitigate such threats.

Detailed information about Fake Tech Support Delivers Havoc Command & Control. Get real-time updates, technical details, and mitigation strategies.

Fake Tech Support Delivers Havoc Command & Control - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Tech Support Delivers Havoc Command & Control

Threats Tagged 'havoc c2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'havoc c2'

Lead Pen Test Professional