Havoc
- ID
- S1229
- Type
- Malware
- Platforms
- Linux, macOS, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
Techniques used (29)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1018 Remote System Discovery
- T1027.010 Command Obfuscation
- T1033 System Owner/User Discovery
- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1113 Screen Capture
- T1134.001 Token Impersonation/Theft
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1497.003 Time Based Checks
- T1559 Inter-Process Communication
- T1566.002 Spearphishing Link
- T1570 Lateral Tool Transfer
- T1573.001 Symmetric Cryptography
- T1574.001 DLL