Real-World Havoc C2: The 'Fake IT Support' Callback Vector

Has anyone else dug into the Huntress report from last month regarding the five organizations hit by this new campaign? The approach is notably aggressive: combining initial email spam with immediate follow-up vishing calls to deploy customized Havoc C2.

It’s a textbook example of multi-factor social engineering. The email creates the context (the "lure"), and the phone call establishes the authority, often panic-inducing the user into running a "repair" script. What stands out to me is the use of Havoc. Since it's open-source and easily modifiable, threat actors are stripping out standard signatures to evade EDRs. This isn't just a script kiddie tool anymore; it's a mature RAT rivaling Sliver or Cobalt Strike in the hands of capable actors.

Given that the entry point relies on user interaction following a phone call, purely automated detection is tough. I've been focusing my hunts on the post-exploitation behaviors, specifically looking for the hollowing techniques Havoc often employs.

Here is a Sigma rule I've drafted to catch the process injection patterns often associated with Havoc's initial beacon:

title: Havoc C2 Process Injection Pattern
status: experimental
description: Detects potential Havoc C2 process hollowing/injection techniques
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: \explorer.exe
        Image|endswith: \rundll32.exe
        CommandLine|contains: '.dll,ZwCreateThread'
    condition: selection
falsepositives:
    - Legitimate software installers
level: high

With the end goal being ransomware or data exfiltration, the dwell time is likely short. How are your teams handling the "vishing" component? Standard phishing awareness doesn't seem to cover the urgency of a live caller.