Fake IT Support Scams Deliver Modified Havoc C2 Across Multiple Organizations
Summary
Huntress reports intrusions at five partner organizations involving fake IT support, credential harvesting, DLL sideloading and modified Havoc payloads. In one environment, attackers spread to nine additional endpoints using scheduled tasks and RMM tools.
Key points
- Huntress says a February 2026 investigation across five partner organizations found spam emails followed by callers impersonating IT support, who persuaded users to grant remote access.
- A fraudulent Outlook antispam panel prompted users to enter credentials and run a script that reconstructed and launched the malware payload.
- The attackers used DLL sideloading with legitimate signed binaries and obfuscated loaders; one loader used Hell’s Gate and Halo’s Gate techniques to bypass userland EDR hooks.
- The payload delivered a modified Havoc Demon with indirect syscalls and registry-based fallback C2 configuration not present in stock Havoc, according to Huntress.
- In one environment, the attackers moved from the initial host to nine additional endpoints. Scheduled tasks deployed Havoc on four endpoints, while Level RMM and XEOX were used for persistence on others.
- Huntress recommends verifying IT requests through a separate channel, restricting and auditing RMM tools, and limiting workstation-to-workstation RDP and SMB traffic.
Article Details
- Attack Vectors
- Mass email spam was used as bait, followed by calls from people impersonating IT support and claiming users needed help with Outlook spam or updates.
- Users were persuaded to approve QuickAssist sessions or install AnyDesk, giving the adversary hands-on access to endpoints.
- A fraudulent Outlook Antispam panel hosted on Amazon AWS prompted users to enter credentials and download an “Antispam Patch” that reconstructed and launched a payload.
- Malicious DLLs were placed beside legitimate signed executables and loaded through DLL sideloading.
- The intruders moved from the initial compromised endpoint to nine additional endpoints, using scheduled tasks, Havoc Demon payloads, and legitimate RMM agents for persistence.
- Defensive Notes
- Provide security awareness training covering fake IT-support scams and verify administrator requests through a separate communication channel.
- Restrict and monitor execution of remote management applications; maintain an inventory of authorized RMM agents and regularly audit their use.
- Use application whitelisting to limit unauthorized application execution.
- Restrict horizontal workstation-to-workstation communication over TCP/3389 and TCP/445 where it is not required.
- Scope and remediate all persistence mechanisms across affected endpoints; removing one mechanism from one host may not eliminate access elsewhere.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | afzarkara[.]com | Listed with the Havoc C2 indicators in the article’s IOC section. |
| DOMAIN | agricularly[.]com | Listed with the Havoc C2 indicators in the article’s IOC section. |
| DOMAIN | alatastro[.]com | Listed with the Havoc C2 indicators in the article’s IOC section. |
| DOMAIN | arcupondepago[.]com | Listed in the article’s IOC section as a Havoc C2 domain. |
| DOMAIN | bongsebing[.]com | Listed with the Havoc C2 indicators in the article’s IOC section. |
| DOMAIN | egravy[.]com | Listed with the Havoc C2 indicators in the article’s IOC section. |
| SHA256 | 0dce1175dc50d20da0fc009d0eed30fb75a004389fca0fbe0abe9835631d745c | Hash identified in the article for the malicious loader_vcruntime140_1.dll. |
| SHA256 | 1175b1c56d59b736fe25495674ee3f83848e7785fde8ba9e207d283fed9b36c7 | Hash identified for license.key, which contains encrypted Havoc shellcode. |
| SHA256 | 59014e97287b5602bba192a04535c59c60c6eb3a9770a94293551dfd5390c5c2 | Hash identified for the decrypted license.key Havoc payload. |
| SHA256 | 6fbd98bbdb8a34dd563f29f45c66adf5c53b1aff225269af3ceb56d76ecd677d | Hash identified in the article for the malicious mpclient.dll loader. |
| SHA256 | 96c3b7ec47ca5ffaac5da1fda25b1ad1afa91e57e1586165deec1e541f3def2e | Hash identified for go.bat, the malicious batch file used to deploy Havoc. |
| SHA256 | b1ccee3d0dc7a85c117580cc08b8edcb8118b5612669300d4b006f50663b387e | Hash identified in the article for the malicious vcruntime140_1.dll loader. |
| SHA256 | d96d8b01d034ca1b9b232c70d57a863320cc107e07245ef7308cbdb069031e61 | Hash identified in the article for the malicious faultrep.dll loader. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loaders used obfuscated trampoline chains and encrypted or encoded payloads, including XOR- and ChaCha20-protected content.T1053.005 · Scheduled TaskScheduled tasks ran go.bat at system boot to reconstruct and launch Havoc Demon payloads on four endpoints.T1055 · Process InjectionThe article describes the Demon being injected into a spawned process for fork-and-run operations.T1056.003 · Web Portal CaptureA script on the fraudulent Outlook Antispam panel displayed a password prompt used to harvest user credentials.T1059.003 · Windows Command ShellThe malicious go.bat batch file reconstructed and launched the Havoc Demon payload.T1071.001 · Web ProtocolsThe Havoc Demon used operator-configured C2 URL paths designed to resemble legitimate API endpoints.T1106 · Native APIThe loaders and Demon invoked syscalls directly or indirectly to allocate memory and execute payloads while bypassing userland hooks.T1112 · Modify RegistryThe modified Demon used registry values to recover encrypted fallback C2 host-and-port entries.T1204.002 · Malicious FileUsers were directed to download the Antispam Patch and activate its test-rules button, initiating payload reconstruction and execution.T1219 · Remote Access ToolsThe adversary used QuickAssist and AnyDesk for remote access and deployed Level RMM and XEOX agents for persistence.T1497.003 · Time Based ChecksA loader used tight-loop timing delays that the article says were likely intended to prevent or confuse emulation.T1574.002 · DLL Side-LoadingMalicious DLLs placed beside legitimate executables were loaded by DLPUserAgent.exe, ADNotificationManager.exe, and Werfault.exe.T1620 · Reflective Code LoadingThe shellcode loader manually mapped the embedded Demon DLL into memory.
People
am0nsecCredited in the article as a developer of Hell’s Gate.Bryan MastersNamed article author reporting the intrusion analysis.C5piderIdentified in the article as the creator of the Havoc framework.Craig SweeneyAcknowledged for efforts detecting and surfacing the reported behavior.Michael TiggesNamed article author reporting the intrusion analysis.vxundergroundCredited in the article as a developer of Hell’s Gate and Halo’s Gate.
Malware
Products
Tools
AnyDeskor other "remediations" to stop the spam. Users were then persuaded to approve a QuickAssist session or to install remote access applications like AnyDesk, granting the attacker hands-on access toHavocHomeBlogExorcising Demons: Fake Tech Support Delivers Havoc Command & ControlLevel RMMLevel RMM was the first RMM deployed, appearing on two endpoints at 21:26 and 21:44 UTC, just over one hour after the initial compromise.QuickAssistor other "remediations" to stop the spam. Users were then persuaded to approve a QuickAssist session or to install remote access applications like AnyDesk, granting the attacker hands-on access toUPXThese sideloaded DLLs are UPX-packed and trivially unpacked/reverse engineered, but implement EDR evasion techniques that will be recognizable later in the article.XEOXXEOX, a lesser-known RMM agent, appeared on three additional endpoints approximately eleven hours after the initial compromise, beginning at 07:14 UTC on February 21.