#Havoc

Open-source C2 framework with built-in evasion, seen in real intrusions

Subscribe (RSS)


#Havoc

Open-source C2, abused in real intrusions

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #Havoc

Week

0

IOCs tagged #Havoc

Month

0

IOCs tagged #Havoc

Year

16

IOCs tagged #Havoc

Counts as of 2026-10-29. Regenerated daily.

About #Havoc

  • Type: Open-source C2 framework. Go server, C++ Demon agent.
  • Maintainer: C5pider. Released 2022.
  • Evasion: Sleep obfuscation, indirect syscalls, AMSI bypass, ETW patching.
  • Abuse: Cobalt Strike alternative. APT and ransomware affiliates, 2023-2026.
  • Detection: Demon agent strings, HTTP listener defaults, JA3 / JA4, sleep-obfuscation patterns.
  • References: HavocFramework/Havoc on GitHub · Malpedia.

Recent IOCs tagged #Havoc

No IOCs tagged #Havoc in the past 30 days. Year total: 16. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Havoc).

Related tags

Often seen with #Havoc.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is Havoc?

An open-source C2 framework (Go server, C++ Demon agent) maintained by C5pider since 2022. It has evasion tradecraft built in, like sleep obfuscation and AMSI bypass.

Why is Havoc popular among operators?

It is free, actively maintained and has strong evasion by default. APT-aligned operators and ransomware affiliates use it.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Havoc subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Havoc IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.