Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks

A regional campaign dubbed the "Havoc stager" delivers malicious archives disguised as Brazilian electronic invoices; a script downloads an installer that places a signed legitimate app alongside a malicious DLL, abusing Windows DLL search order to sideload attacker code. The stager fetches a memory-resident backdoor from C2, employs evasion techniques (stack-frame spoofing, indirect syscalls), persists via unusual registry keys, and appears produced by a shared builder used across multiple distribution operations.