SecuriTricks

Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets

A zero-day vulnerability in the TrueConf client application, CVE-2026-3502, was exploited in a targeted campaign against government entities in Southeast Asia. The flaw allows attackers controlling an on-premises TrueConf server to distribute and execute arbitrary files across connected endpoints. …

zero-day

dll sideloading

Published: March 31, 2026

Downloadable IOCs: 0

Fake Tech Support Delivers Havoc Command & Control

A sophisticated cyber attack campaign combines social engineering and advanced malware techniques. Attackers pose as IT support to gain initial access, then deploy a modified version of the Havoc C2 framework. The malware uses DLL sideloading, indirect syscalls, and custom loaders to evade detectio…

remote monitoring tools

havoc c2

2026-03-05

syscalls

Published: March 5, 2026

Downloadable IOCs: 11

SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh

An extensive cyber espionage campaign conducted by SloppyLemming, an India-nexus threat actor, targeted government entities and critical infrastructure in Pakistan and Bangladesh from January 2025 to January 2026. The campaign used two attack vectors: PDF lures with ClickOnce execution chains and m…

geopolitical conflict

Published: March 3, 2026

Downloadable IOCs: 19

The Shadow Campaigns: Uncovering Global Espionage

This investigation reveals a new cyberespionage group tracked as TGR-STA-1030, believed to be a state-aligned actor operating from Asia. Over the past year, the group has compromised government and critical infrastructure organizations in 37 countries, targeting ministries, law enforcement agencies…

Published: February 5, 2026

Linked vulnerabilities : CVE-2019-11580

Downloadable IOCs: 22

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like…

tomiris powershell telegram backdoor

multi-language malware

tomiris c# reverseshell

tomiris c/c++ reverseshell

tomiris python telegram reverseshell

reverse shells

tomiris python discord reverseshell

tomiris c# telegram reverseshell

tomiris rust downloader

tomiris python filegrabber

distopia backdoor

tomiris go reversesocks

tomiris go reverseshell

tomiris rust reverseshell

tomiris c++ reversesocks

Published: November 28, 2025

Downloadable IOCs: 66

BRONZE BUTLER exploits Japanese asset management software vulnerability

In mid-2025, a sophisticated campaign by the Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) exploited a zero-day vulnerability in Motex LANSCOPE Endpoint Manager. The vulnerability, CVE-2025-61932, allowed remote attackers to execute arbitrary commands with SYSTEM privilege…

Published: October 31, 2025

Downloadable IOCs: 0

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

This report details a prolonged Iranian state-sponsored intrusion into critical national infrastructure in the Middle East from May 2023 to February 2025. The threat actors employed various tactics including web shells, custom malware, and legitimate tools to maintain persistent access across multi…

apt

credential harvesting

critical infrastructure

Published: May 6, 2025

Downloadable IOCs: 35

Havoc: SharePoint with Microsoft Graph API turns into FUD C2

A phishing campaign combines ClickFix and multi-stage malware to deploy a modified Havoc Demon Agent. The attack starts with an HTML attachment using ClickFix to deceive users into executing malicious PowerShell commands. The malware stages are hidden behind SharePoint sites, and a modified Havoc D…

Published: March 3, 2025

Downloadable IOCs: 5

Wreaking havoc in cyberspace: threat actors experiment with pentest tools

Recent research reveals adversaries increasingly using the Havoc post-exploitation framework to bypass cybersecurity systems. Two campaigns utilizing this framework were analyzed. The first campaign involved phishing emails with malicious archives containing ISO files and LNK files, which downloade…

cybersecurity evasion

demon implant

post-exploitation

Published: October 8, 2024

Downloadable IOCs: 0

Unraveling SloppyLemming’s Operations Across South Asia

An investigation reveals SloppyLemming, an advanced threat actor targeting South and East Asian countries, particularly Pakistan. The group uses multiple cloud services for credential harvesting, malware delivery, and command and control. Their operations focus on government, law enforcement, energ…

Published: September 27, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 96

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Multiple Microsoft Office documents generated by the MacroPack framework have been discovered, likely used by malicious actors to deploy various payloads. These documents, uploaded to VirusTotal between May and July 2024, originated from different countries including China, Pakistan, Russia, and th…

Published: September 3, 2024

Downloadable IOCs: 16

Sophisticated Malware Campaign Targets Czech Officials Using NATO-Themed Decoys

Seqrite Labs APT-Team discovered a sophisticated malware campaign targeting government and military officials in the Czech Republic. The campaign leveraged NATO-themed decoy documents to lure victims and employed a multistage attack chain involving a malicious batch script, a Rust-based loader, and…

Published: August 28, 2024

Downloadable IOCs: 13

Tag: havoc

Attack reports

Operation Poisson – Analyzing a Cybercriminal’s Entire Operation

Hacktivists are broadening their scope beyond political motivation

The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP

Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets

Fake Tech Support Delivers Havoc Command & Control

SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh

The Shadow Campaigns: Uncovering Global Espionage

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

BRONZE BUTLER exploits Japanese asset management software vulnerability

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

Havoc: SharePoint with Microsoft Graph API turns into FUD C2

Wreaking havoc in cyberspace: threat actors experiment with pentest tools

Unraveling SloppyLemming’s Operations Across South Asia

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Sophisticated Malware Campaign Targets Czech Officials Using NATO-Themed Decoys