LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1229: Havoc

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.

EnterpriseS1229MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Havoc matters because it is an open-source post-exploitation command-and-control framework with broad offensive capabilities and documented adoption by multiple threat actors. For leaders, the key issue is not the tool name alone; it is whether the organization can detect and respond to the behaviors commonly associated with a modern C2 framework across Windows, Linux, and macOS endpoints.

Executive priority

Treat Havoc as a coverage-validation case for post-compromise resilience. Executives should ask whether SOC, endpoint, network, and incident response teams can prove visibility into discovery, command execution, tool transfer, proxying, screen capture, local data collection, and Windows injection or token impersonation behaviors. Because ATT&CK lists WIRTE as using Havoc, threat intelligence and regional/business exposure reviews may be relevant, but local risk should be based on the organization’s sector, geography, and telemetry.

Technical view

ATT&CK does not provide a dedicated detection analytic for Havoc, so defenders should validate behavior-based coverage from the relationships. Priority validation areas include command execution via PowerShell and Windows Command Shell, native API use, process and account discovery, file and directory discovery, system and network discovery, web/file-transfer C2 protocols, proxy behavior, ingress tool transfer, screen capture, local data access, command obfuscation, and Windows-specific DLL/PE injection and token impersonation. Coverage should be tested across the listed platforms: Linux, macOS, and Windows.

Likely telemetry

  • Endpoint process creation and command-line telemetry, including PowerShell and cmd activity on Windows
  • Script execution logs and PowerShell logging where enabled
  • Endpoint detection telemetry for process injection, native API behavior, token impersonation, and unusual child-process patterns
  • Network telemetry for HTTP/S or other web protocol C2-like traffic, file-transfer protocol use, and proxy or traffic redirection patterns
  • File system telemetry for local data access, file and directory enumeration, and newly transferred tools

Detection direction

  • Build detections around clustered post-exploitation behavior rather than the Havoc name alone, since the supplied ATT&CK object has no official detection text.
  • Correlate discovery commands, command interpreters, network beaconing or web/file-transfer communications, and tool transfer from the same host or user context.
  • Tune for legitimate administrator activity: discovery commands, PowerShell, file transfer, and proxy use can be normal, so detections should incorporate asset role, user role, timing, parent process, and destination reputation where available.
  • Validate Windows-specific visibility for DLL injection, PE injection, and token impersonation; these are common blind spots if endpoint telemetry lacks memory/process-access detail.
  • Confirm Linux and macOS monitoring is not materially weaker than Windows coverage, because the object lists all three platforms.

Mitigation priorities

  • Prioritize least privilege and administrative access controls to reduce the value of token impersonation, discovery, and command execution after compromise.
  • Harden and monitor scripting and command interpreters, especially PowerShell and Windows Command Shell, while preserving legitimate administrative workflows.
  • Restrict and monitor unauthorized file transfer paths, proxy use, and outbound web/file-transfer communications from endpoints and servers.
  • Ensure endpoint controls can observe and block or alert on process injection, suspicious native API usage, and unusual tool staging where supported.
  • Improve user-execution defenses for malicious files and copy-paste social engineering through policy, awareness, and technical controls.
Additional notes and limits

The supplied ATT&CK data identifies Havoc as an open-source post-exploitation C2 framework first released on GitHub in October 2022 and maintained by C5pider with contributors. ATT&CK states it has been adopted by multiple threat actors and includes a relationship showing WIRTE uses it. The strongest defensive value comes from mapping the listed techniques to existing SOC telemetry and response playbooks.

No official ATT&CK detection text, aliases, labels, or malware-specific tactics were supplied. The relationship list provides behavioral context, but it does not prove activity in any specific environment. Local logs, EDR coverage, network architecture, identity controls, and business exposure are required to determine actual risk and detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Havoc

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

29 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

Havoc can trigger exection of `whoami` on the target host to display the current user.[1][2]

EnterpriseT1090Proxy

Havoc has the ability to route HTTP/S communications through designated proxies.[3]

EnterpriseT1559Inter-Process Communication

The Havoc SMB demon can use named pipes for communication through a parent demon.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

Havoc can send an AES encrypted check-in request to the C2 server.[1][2]

EnterpriseT1204.004Malicious Copy and PasteSub-technique

The Havoc infection chain has been initiated via ClickFix lures in phishing emails.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

Havoc can execute commands via `cmd.exe`.[3][4]

EnterpriseT1113Screen Capture

Havoc can capture screenshots.[3][1][4]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

Havoc has a module capable of token impersonation.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

Havoc can use HTTP/S listeners to establish and maintain C2 communications. [3][1][2][4]

EnterpriseT1082System Information Discovery

Havoc can gather system information including hostname, domain, and OS details.[2]

EnterpriseT1057Process Discovery

Havoc can enumerate processes on targeted hosts.[3][1][2]

EnterpriseT1059.001PowerShellSub-technique

Havoc can facilitate the execution of PowerShell commands.[4]

EnterpriseT1055.002Portable Executable InjectionSub-technique

Havoc has itself injected into `C:\\Windows\\System32\\Werfault.exe` on targeted systems.[3]

EnterpriseT1105Ingress Tool Transfer

Havoc has the ability to upload files to infected systems.[3][4]

EnterpriseT1083File and Directory Discovery

The Havoc interface can display a file explorer view of the compromised host.[3]

EnterpriseT1574.001DLLSub-technique

Havoc has leveraged legitimate executables to side-load malicious payloads.[5]

EnterpriseT1570Lateral Tool Transfer

Havoc has the ability to copy files from one location to another.[3]

EnterpriseT1016.001Internet Connection DiscoverySub-technique

The Havoc demon can check for a connection to the C2 server from the target machine.[1]

EnterpriseT1087Account Discovery

Havoc can identify privileged user accounts on infected systems.[2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Havoc has DLL spawn and injection modules.[3]

EnterpriseT1027.010Command ObfuscationSub-technique

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.[5]

EnterpriseT1497.003Time Based ChecksSub-technique

The Havoc demon agent can be set to sleep for a specified time.[3][1]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

Havoc can use an SMB listener for C2 communication.[3][1][4]

EnterpriseT1005Data from Local System

Havoc can download files from the victim's computer.[3][4]

EnterpriseT1204.002Malicious FileSub-technique

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.[5]

EnterpriseT1106Native API

Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.[3]

EnterpriseT1016System Network Configuration Discovery

Havoc has a module for network enumeration including determining IP addresses.[3]

EnterpriseT1566.002Spearphishing LinkSub-technique

Havoc has been distributed through ClickFix phishing campaigns.[2]

EnterpriseT1018Remote System Discovery

Havoc features a module capable of host enumeration.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0090: WIRTE

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1559: Inter-Process CommunicationEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1204.004: Malicious Copy and PasteEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1134.001: Token Impersonation/TheftEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1055.002: Portable Executable InjectionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1016.001: Internet Connection DiscoveryEnterpriseuses · TechniqueT1087: Account DiscoveryEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · GroupG0090: WIRTEEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1071.002: File Transfer ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
78a28f2fe5b67344...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle78a28f2fe5b6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  2. [2]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  3. [3]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  4. [4]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  5. [5]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  6. [6]
    mitre-attackS1229
    Open source URL
  7. [7]
    mitre-attackS1229
    Open source URL
  8. [8]
    mitre-attackS1229
    Open source URL
  9. [9]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  10. [10]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  11. [11]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  12. [12]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  13. [13]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  14. [14]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  15. [15]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  16. [16]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  17. [17]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  18. [18]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  19. [19]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  20. [20]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  21. [21]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  22. [22]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  23. [23]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  24. [24]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  25. [25]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  26. [26]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  27. [27]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  28. [28]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  29. [29]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  30. [30]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  31. [31]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  32. [32]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  33. [33]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  34. [34]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  35. [35]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  36. [36]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  37. [37]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  38. [38]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  39. [39]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  40. [40]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  41. [41]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  42. [42]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  43. [43]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  44. [44]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  45. [45]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  46. [46]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  47. [47]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  48. [48]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  49. [49]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  50. [50]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  51. [51]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  52. [52]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  53. [53]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  54. [54]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  55. [55]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  56. [56]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  57. [57]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  58. [58]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  59. [59]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  60. [60]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  61. [61]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  62. [62]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  63. [63]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  64. [64]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  65. [65]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  66. [66]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  67. [67]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  68. [68]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  69. [69]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  70. [70]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  71. [71]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  72. [72]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  73. [73]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  74. [74]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  75. [75]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  76. [76]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  77. [77]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  78. [78]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  79. [79]
    Zscaler Havoc FEB 2023

    Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.

    Open source URL
  80. [80]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  81. [81]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  82. [82]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  83. [83]
    Immersive Labs Havoc C2 APR 2024

    Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.

    Open source URL
  84. [84]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  85. [85]
    Check Point Wirte NOV 2024

    Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.

    Open source URL
  86. [86]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  87. [87]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  88. [88]
    Fortinet Havoc MAR 2025

    Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.

    Open source URL
  89. [89]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use