Threats Tagged 'havoc demon'

Two espionage campaigns attributed to the Khmer Shadow cluster targeted Cambodian government entities in defense and public works sectors. The campaigns used a custom C++ loader named NIGHTFORGE delivered via government-themed self-extracting archive lures. NIGHTFORGE employs advanced evasion techniques such as NTDLL unhooking and Hell's Gate syscall resolution to decrypt and execute a Havoc Demon payload in memory. It uses DLL sideloading through a legitimate VMware-signed binary and establishes persistence via COM-based scheduled tasks. Despite technical sophistication, the attacker reused payloads and infrastructure across targets. The campaigns specifically targeted Cambodia's Information Collection Bureau and Ministry of Public Works and Transport using meeting-themed social engineering lures.

MediumMalwareCambodia#kaynldr#nightforge#khmer shadow

A sophisticated cyber attack campaign combines social engineering and advanced malware techniques. Attackers pose as IT support to gain initial access, then deploy a modified version of the Havoc C2 framework. The malware uses DLL sideloading, indirect syscalls, and custom loaders to evade detection. After compromising the initial system, the attackers rapidly move laterally, establishing persistence through scheduled tasks and legitimate remote monitoring tools. The campaign demonstrates a blend of human-centric initial access methods and advanced technical evasion techniques, highlighting the need for comprehensive security measures spanning user awareness and technical controls.

MediumMalwareUnited StatesUnited KingdomCanada+9#havoc demon#havoc#social engineering