Full Report
Adversaries leverage fake tech support to deploy a modified Havoc C2 agent, employing DLL sideloading, syscall evasion (HellsGate), and RMM tools for persistent access.
Analysis Summary
# Tool/Technique: Modified Havoc C2 (Demon Agent)
## Overview
This attack involves a sophisticated social engineering campaign (fake tech support) used to deliver a heavily modified version of the open-source **Havoc C2 framework**. The campaign is notable for its use of "Vishing" (voice phishing) to guide users through the infection chain and the deployment of a custom **Demon** agent designed to bypass modern EDR/XDR solutions.
## Technical Details
- **Type:** Malware Family / Command & Control (C2) Framework
- **Platform:** Windows
- **Capabilities:** Evasion (Indirect Syscalls), DLL Sideloading, Registry-based persistence, RMM integration, Lateral Movement.
- **First Seen:** Campaign identified February 2026 (associated with TTPs seen in Jan 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.004 - Phishing: Voice and Text (Vishing)]
- **[TA0003 - Persistence]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- [T1112 - Modify Registry]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1106 - Native API (HellsGate/Indirect Syscalls)]
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Services: Remote Desktop Protocol]
## Functionality
### Core Capabilities
- **Command and Control:** Establishes a remote connection to an adversary-controlled server for tasking.
- **Payload Delivery:** Uses a layered delivery chain starting from a fake Outlook Antispam panel.
- **Persistence:** Leverages extensive DLL sideloading and the deployment of legitimate Remote Monitoring and Management (RMM) tools to maintain a foothold.
- **Registry Utilization:** Stores C2 parameters and configuration data within the Windows Registry, a feature not found in the "stock" version of Havoc.
### Advanced Features
- **Evasion (HellsGate/Indirect Syscalls):** Uses a modified "Demon" agent that employs indirect syscalls to hide malicious API calls from EDR monitors.
- **Customized Resilience:** Modified from the base open-source code to remove "default" signatures that security vendors typically target.
- **Manual Interaction:** Adversaries actively engage with victims via phone calls to bypass technical security controls through human manipulation.
## Indicators of Compromise
- **File Names:** Modified Havoc Demon payloads, legitimate RMM installers used maliciously.
- **Registry Keys:** Custom keys used to store C2 configuration (Fallback C2 parameters).
- **Network Indicators:**
- C2 Domains: [defanged] `havoc-c2-infrastructure[.]com` (Example based on context)
- C2 IP: [defanged] `192[.]168[.]1[.]100` (Example)
- **Behavioral Indicators:**
- Unusual DLL loading in standard Windows directories.
- Unexpected RDP activity or lateral movement shortly after a "support" call.
- System processes making indirect syscalls to sensitive NT functions (e.g., `NtCreateThread`).
## Associated Threat Actors
- **Black Basta (Affiliates/Successors):** The TTPs (Registry-based C2, DLL sideloading, and vishing) overlap significantly with previous Black Basta and **FIN7** campaigns.
## Detection Methods
- **Signature-based detection:** While the Demon agent is modified, specific code snippets from the Havoc framework can be targeted.
- **Behavioral detection:** Monitoring for DLL sideloading events and the creation of unexpected registry keys containing encrypted or encoded data.
- **Memory Analysis:** Detecting the use of indirect syscalls by analyzing the call stack for transitions into `ntdll.dll` that do not originate from standard API wrappers.
## Mitigation Strategies
- **User Training:** Education on "Vishing" and verifying IT support requests through official internal channels.
- **Technical Restrictions:** Implement DLL search order hijacking protections and restrict the execution of unassigned RMM tools.
- **Registry Monitoring:** Audit changes to suspicious registry paths used for persistence or configuration storage.
- **Attack Surface Reduction:** Block unauthorized remote access tools at the network perimeter.
## Related Tools/Techniques
- **Cobalt Strike:** A similar commercial C2 framework often compared to Havoc.
- **SectopRAT / ModeloRAT:** Other malware families mentioned as part of the broader threat landscape using similar delivery vectors.
- **DLL Sideloading:** The primary execution technique used to load the Demon agent.