Havoc
MITRE ATT&CK: S1229 View on attack.mitre.org
Aliases: HavocCrypt Ransomware, Havokiz, Havoc
- First seen
- 2022-10-01 00:00:00
- Malware type
- rat, backdoor, ransomware
- Family
- Malware family
- Operating systems
- linux, macos, windows
- Related IoCs
- 1411 (612 malicious)
- Last IoC activity
- 2026-10-18 02:31:42
- Profile updated
- 2026-07-07 12:35:16
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
Recent IoC activity
613 malicious indicators in Maltiverse are attributed to Havoc (S1229). The 20 most recently updated:
Detection coverage
- 4 YARA rules
- 631 Sigma rules
Malware & tools used
- System Owner/User Discovery (attack-pattern)
- Proxy (attack-pattern)
- Inter-Process Communication (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Malicious Copy and Paste (attack-pattern)
- Windows Command Shell (attack-pattern)
- Screen Capture (attack-pattern)
- Token Impersonation/Theft (attack-pattern)
- Web Protocols (attack-pattern)
- System Information Discovery (attack-pattern)
- Process Discovery (attack-pattern)
- PowerShell (attack-pattern)
- Portable Executable Injection (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- File and Directory Discovery (attack-pattern)
- DLL (attack-pattern)
- Lateral Tool Transfer (attack-pattern)
- Internet Connection Discovery (attack-pattern)
- Account Discovery (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- Command Obfuscation (attack-pattern)
- Time Based Checks (attack-pattern)
- File Transfer Protocols (attack-pattern)
- Data from Local System (attack-pattern)
- Malicious File (attack-pattern)
Used by threat actors
- MacroPack Payload Delivery Activity (campaign)
- WIRTE (threat-actor)
- SloppyLemming (threat-actor)
Detection rules
- MALPEDIA_Win_Havoc_Auto (yara-rule)
- SEKOIA_Implant_Win_Havoc_Default_Strings (yara-rule)
- EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 (yara-rule)
- DITEKSHEN_INDICATOR_TOOL_Havoc (yara-rule)
Reports & references
- id-ransomware.blogspot.co.il — Havoc Ransomware (report)
- info.spamhaus.com — Q4%202023%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q2%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q3%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
- spamhaus.org — Botnet Threat Update January To June 2025 (report)
- info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- Broadcom/Symantec — Grayling Taiwan Cyber Attacks (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Havoc (report)
- fortinet.com — Fortiguard Incident Response Team Detects Intrusion Into Middle East Critical National Infrastructure (report)
- youtube.com — Watch (report)
- 4pfsec.com — Havoc C2 First Look (report)
- seqrite.com — Operation Oxidovy Sophisticated Malware Campaign Targets Czech Officials Using Nato Themed Decoys (report)
- twitter.com — 1579668721777643520 (report)
- kroll.com — Prelude Crypto Heist Causes Havoc (report)
- checkmarx.com — First Known Targeted Oss Supply Chain Attacks Against The Banking Sector (report)
- github.com — Havoc (report)
- zscaler.com — Havoc Across Cyberspace (report)
- immersivelabs.com — Havoc C2 Framework A Defensive Operators Guide (report)
- github.com — Parse Havoc Generic.Py (report)
- fortinet.com — Report Incident Response Middle East (report)
- MITRE ATT&CK — S1229 (report)
- proofpoint.com — Bitter End Unraveling Eight Years Espionage Antics Part One (report)
- jsac.jpcert.or.jp — Jsac2024 1 9 Takeda Furukawa En (report)