Social Engineering Campaign Uses Fake IT Support to Deploy Havoc C2 in Enterprise Networks
Threat hunters have identified a coordinated intrusion campaign in which attackers impersonate IT support teams to gain remote access and deploy the Havoc command-and-control framework across corporate environments.
The attacks combine spam campaigns, social engineering, and staged malware delivery to compromise endpoints and potentially prepare the ground for data exfiltration or ransomware operations.
The activity was observed by security researchers across several organizations, where attackers progressed from initial access to lateral movement across multiple endpoints within hours.
How the Attack Begins
The campaign typically starts with a large-scale spam operation designed to flood a target’s inbox with junk messages.
Shortly afterward, the victim receives a phone call from someone claiming to be part of the company’s IT support team. The attacker offers to help resolve the supposed email issue and asks the user to initiate a remote support session.
Victims are persuaded to grant remote access through tools such as:
Microsoft Quick Assist
AnyDesk
other remote support utilities
Once remote access is established, attackers begin preparing the next stage of the intrusion.
Fake Security Update as an Attack Vector
During the session, the attacker directs the user to a website designed to imitate Microsoft services. The page claims that the user must update Outlook anti-spam rules.
The fake interface prompts the victim to enter their email address and initiate a “rules configuration update.”
This process ultimately triggers a script that displays a credential prompt, allowing attackers to harvest login information while maintaining the illusion of a legitimate IT procedure.
Malware Delivery Through DLL Sideloading
After credentials are collected, the attack chain continues with the download of what appears to be a legitimate patch.
The file launches a legitimate Windows binary such as:
ADNotificationManager.exe
DLPUserAgent.exe
WerFault.exe
These binaries are abused to sideload a malicious DLL containing the Havoc payload.
Once executed, the malware loads the Havoc “Demon” agent, establishing communication with attacker-controlled infrastructure.
To evade security controls, the payload incorporates several advanced techniques, including:
control-flow obfuscation
delayed execution loops
API hooking techniques such as Hell’s Gate and Halo’s Gate
attempts to bypass endpoint detection and response systems
Rapid Lateral Movement
Following successful compromise of the initial machine, attackers begin moving laterally across the network.
In observed incidents, threat actors accessed multiple endpoints within a short timeframe and deployed additional payloads.
Persistence was achieved through:
scheduled tasks that re-launch the Havoc agent after reboot
installation of legitimate Remote Monitoring and Management tools
Tools such as Level RMM and XEOX were used in some environments to maintain remote access even if the primary payload was removed.
What This Campaign Shows
The campaign illustrates how modern attacks blend multiple techniques:
social engineering to obtain initial access
legitimate tools for persistence
commodity malware customized to evade detection
Another notable aspect is the speed at which attackers move from initial compromise to broader network control.
In some cases, the activity strongly suggested preparation for large-scale data exfiltration or ransomware deployment.
DIAMATIX Perspective
Impersonation of internal IT staff remains one of the most effective entry vectors.
When combined with remote support tools and staged malware delivery, attackers can bypass traditional perimeter defenses and operate directly from trusted endpoints.
Organizations should consider several defensive measures:
Restrict remote support tools to approved and monitored channels
Train employees to verify unexpected IT support requests
Monitor suspicious use of system binaries associated with DLL sideloading
Track unusual outbound connections from endpoints
Detect abnormal deployment of RMM tools within corporate networks
Security teams should also watch for early indicators of lateral movement following remote access sessions.
What appears to be routine technical support may in reality be the first step of a multi-stage compromise.
Sources
This analysis is based on public reporting and threat research published by Huntress security researchers and industry cybersecurity reporting platforms.
Trusted · Innovative · Vigilant
