{"id":50636,"date":"2023-02-17T10:30:08","date_gmt":"2023-02-17T10:30:08","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/cry-havoc-and-let-slip-dogs-of-war-theres-an-upgraded-malware-server-in-town\/"},"modified":"2023-02-17T10:30:08","modified_gmt":"2023-02-17T10:30:08","slug":"cry-havoc-and-let-slip-dogs-of-war-theres-an-upgraded-malware-server-in-town","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cry-havoc-and-let-slip-dogs-of-war-theres-an-upgraded-malware-server-in-town\/","title":{"rendered":"Cry Havoc and let slip dogs of war … there’s an upgraded malware server in town"},"content":{"rendered":"

There’s a fresh open-source command-and-control (C2) framework on the loose, dubbed Havoc, as an alternative to the popular Cobalt Strike, and other mostly legitimate tools, that have been abused to spread malware.<\/p>\n

ReversingLabs wrote<\/a> about Havoc<\/a> earlier this month in connection with a malicious npm package called Aabquerys, noting that it was created by a malware developer called C5pider. Now researchers with Zscaler’s ThreatLabz threat intelligence unit say Havoc is being used in a campaign targeting a government organization.<\/p>\n

“While C2 frameworks are prolific, the open-source Havoc framework is an advanced post-exploitation command and control framework capable of bypassing the most current and updated version of Windows 11 Defender,” the ThreatLabz researchers wrote in a report<\/a> this week.<\/p>\n