#Havoc

Havoc is a modern open-source C2 framework written in Go (server side) and C++ (the Demon agent), maintained by C5pider since 2022. It targets the same niche as Cobalt Strike and Sliver but ships strong evasion tradecraft out of the box - sleep obfuscation, indirect syscalls, return-address spoofing, AMSI bypass and ETW patching - without operators having to add it themselves.

Three reasons: it is free and open-source (lowering the barrier compared to Cobalt Strike's licensing); it is modern and actively maintained (in contrast to abandoned alternatives); and it ships with strong evasion features by default. Together these make Havoc attractive to both APT-aligned operators and ransomware affiliates.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Havoc-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this Havoc subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.