S1229: Havoc
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
Security context for executives and security teams
S1229: Havoc describes [Havoc](https://attack.mitre.org/software/S1229) is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. [Havoc](https://attack.mitre.org/software/S1229) provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
Executive priority
S1229: Havoc is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1229: Havoc by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, macOS, Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1229: Havoc appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Havoc
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1033 | System Owner/User Discovery | Havoc can trigger exection of `whoami` on the target host to display the current user.CitationZscaler Havoc FEB 2023CitationFortinet Havoc MAR 2025 |
| Enterprise | T1090 | Proxy | Havoc has the ability to route HTTP/S communications through designated proxies.CitationHavoc Framework Documentation |
| Enterprise | T1559 | Inter-Process Communication | The Havoc SMB demon can use named pipes for communication through a parent demon.CitationHavoc Framework Documentation |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | Havoc can send an AES encrypted check-in request to the C2 server.CitationZscaler Havoc FEB 2023CitationFortinet Havoc MAR 2025 |
| Enterprise | T1204.004 | Malicious Copy and PasteSub-technique | The Havoc infection chain has been initiated via ClickFix lures in phishing emails.CitationFortinet Havoc MAR 2025 |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Havoc can execute commands via `cmd.exe`.CitationHavoc Framework DocumentationCitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1113 | Screen Capture | Havoc can capture screenshots.CitationHavoc Framework DocumentationCitationZscaler Havoc FEB 2023CitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1134.001 | Token Impersonation/TheftSub-technique | Havoc has a module capable of token impersonation.CitationHavoc Framework Documentation |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Havoc can use HTTP/S listeners to establish and maintain C2 communications. CitationHavoc Framework DocumentationCitationZscaler Havoc FEB 2023CitationFortinet Havoc MAR 2025CitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1082 | System Information Discovery | Havoc can gather system information including hostname, domain, and OS details.CitationFortinet Havoc MAR 2025 |
| Enterprise | T1057 | Process Discovery | Havoc can enumerate processes on targeted hosts.CitationHavoc Framework DocumentationCitationZscaler Havoc FEB 2023CitationFortinet Havoc MAR 2025 |
| Enterprise | T1059.001 | PowerShellSub-technique | Havoc can facilitate the execution of PowerShell commands.CitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1055.002 | Portable Executable InjectionSub-technique | Havoc has itself injected into `C:\\Windows\\System32\\Werfault.exe` on targeted systems.CitationHavoc Framework Documentation |
| Enterprise | T1105 | Ingress Tool Transfer | Havoc has the ability to upload files to infected systems.CitationHavoc Framework DocumentationCitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1083 | File and Directory Discovery | The Havoc interface can display a file explorer view of the compromised host.CitationHavoc Framework Documentation |
| Enterprise | T1574.001 | DLLSub-technique | Havoc has leveraged legitimate executables to side-load malicious payloads.CitationCheck Point Wirte NOV 2024 |
| Enterprise | T1570 | Lateral Tool Transfer | Havoc has the ability to copy files from one location to another.CitationHavoc Framework Documentation |
| Enterprise | T1016.001 | Internet Connection DiscoverySub-technique | The Havoc demon can check for a connection to the C2 server from the target machine.CitationZscaler Havoc FEB 2023 |
| Enterprise | T1087 | Account Discovery | Havoc can identify privileged user accounts on infected systems.CitationFortinet Havoc MAR 2025 |
| Enterprise | T1055.001 | Dynamic-link Library InjectionSub-technique | Havoc has DLL spawn and injection modules.CitationHavoc Framework Documentation |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.CitationCheck Point Wirte NOV 2024 |
| Enterprise | T1497.003 | Time Based ChecksSub-technique | The Havoc demon agent can be set to sleep for a specified time.CitationHavoc Framework DocumentationCitationZscaler Havoc FEB 2023 |
| Enterprise | T1071.002 | File Transfer ProtocolsSub-technique | Havoc can use an SMB listener for C2 communication.CitationHavoc Framework DocumentationCitationZscaler Havoc FEB 2023CitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1005 | Data from Local System | Havoc can download files from the victim's computer.CitationHavoc Framework DocumentationCitationImmersive Labs Havoc C2 APR 2024 |
| Enterprise | T1204.002 | Malicious FileSub-technique | Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.CitationCheck Point Wirte NOV 2024 |
| Enterprise | T1106 | Native API | Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.CitationHavoc Framework Documentation |
| Enterprise | T1016 | System Network Configuration Discovery | Havoc has a module for network enumeration including determining IP addresses.CitationHavoc Framework Documentation |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | Havoc has been distributed through ClickFix phishing campaigns.CitationFortinet Havoc MAR 2025 |
| Enterprise | T1018 | Remote System Discovery | Havoc features a module capable of host enumeration.CitationHavoc Framework Documentation |
Groups, software, and campaigns
G0090: WIRTE
WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | 78a28f2fe5b6… | ||
| 19.1 | 1.1 | Older bundle | 78a28f2fe5b6… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackS1229Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.