Exorcising Demons: Fake Tech Support Delivers Havoc Command & Control
Fake tech support scams used to end with a gift card. Now they end with a modified Havoc C2 framework in your environment, using indirect syscalls to dodge your EDR.
Fake tech support scams used to end with a gift card. Now they end with a modified Havoc C2 framework in your environment, using indirect syscalls to dodge your EDR.
Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates.
A local file inclusion flaw in Gladinet CentreStack and Triofox was actively exploited before a patch existed. Huntress documented the vulnerability, the exploitation activity, and what to do now.