MITRE ATT&CKsoftware (malware)

S1229 Havoc

Published 2025-08-05 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Linux, macOS, Windows
Version
1.1
Created
2025-08-05

Description

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.

Related

Uses · MITRE ATT&CK (29)

  • T1204.004 Malicious Copy and Paste sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1559 Inter-Process Communication technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1087 Account Discovery technique
  • T1090 Proxy technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1113 Screen Capture technique

Referenced by MITRE ATT&CK · uses (1)