Fake Tech Support Scammers Now Deploying Advanced Havoc C2 Framework

A sophisticated new cyber threat campaign is leveraging fake tech support scams to deploy the advanced Havoc command-and-control (C2) framework. Threat actors are using email spam and follow-up phone calls to trick victims into granting remote access, paving the way for data exfiltration or ransomware attacks. This evolving tactic blurs the lines between traditional social engineering and advanced malware deployment.

Key Takeaways

• Human-Centric Initial Access is Scaling: Adversaries are increasingly bypassing technical defenses through direct human interaction, impersonating IT staff and using personal phone numbers.

• Democratization of Advanced Evasion: Techniques once exclusive to state-sponsored attacks are now common, forcing adversaries to evolve rapidly to evade sophisticated EDR solutions.

• Framework Customization for Resilience: Default malware and C2 frameworks are easily detected. Customizing these tools erodes pattern-based recognition and enhances operational resilience.

• Aggressive Lateral Movement: The speed at which attackers move from initial compromise to multiple endpoints suggests a focus on rapid data exfiltration or ransomware deployment.

• Diversified Persistence Strategies: Attackers employ multiple methods to maintain access, including custom malware and legitimate remote management tools, making complete remediation challenging.

The Attack Chain Unveiled

The campaign begins with a barrage of spam emails designed to overwhelm targets. Following this, threat actors, posing as IT support, contact victims. They persuade individuals to grant remote access, often through legitimate tools like Quick Assist or AnyDesk, under the guise of fixing the "spam issue."

Once access is established, the attackers direct victims to a fake Microsoft landing page hosted on Amazon Web Services (AWS). This page prompts users to enter their email address to "update Outlook's anti-spam rules." This step serves a dual purpose: harvesting credentials and adding a layer of authenticity to the fraudulent interaction.

Malware Delivery and Evasion Techniques

The "anti-spam patch" downloaded by the victim is a malicious payload. It leverages legitimate binaries like to sideload a malicious DLL. This DLL employs advanced defense evasion techniques, including control flow obfuscation, timing-based delays, and Hell's Gate/Halo's Gate to bypass endpoint detection and response (EDR) solutions by directly interacting with system calls.

Lateral Movement and Persistence

After successfully deploying the Havoc Demon agent on the initial host, attackers engage in rapid lateral movement. This often involves creating scheduled tasks to ensure the Havoc payload persists across reboots. In some instances, instead of the Havoc framework, attackers deploy legitimate remote monitoring and management (RMM) tools like Level RMM and XEOX for persistence, diversifying their access methods.

Implications and Recommendations

This campaign highlights a concerning trend where sophisticated evasion techniques are becoming commonplace. The speed of lateral movement and the use of multiple persistence mechanisms indicate a strong likelihood of data exfiltration or ransomware deployment as the ultimate goal. Organizations are urged to enhance user awareness training, implement out-of-band authentication for IT requests, and strictly monitor and whitelist application execution, especially for RMM tools, to counter such evolving threats.

By staying vigilant and adopting safe browsing practices, users can significantly reduce their exposure to these evolving threats. As cyber threats continue to evolve, your security strategy needs to evolve with them. BetterWorld Technology delivers adaptive cybersecurity solutions designed to keep your business secure while supporting innovation. Connect with us today to schedule a personalized consultation.

Sources

• Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations, The Hacker News.

• Fake Tech Support Delivers Havoc Command & Control, Huntress.