Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations

Threat actors ran a multi-stage campaign impersonating IT support (email lures + phone calls) to obtain remote access, harvest credentials with a fake Microsoft page, and sideload malicious DLLs (e.g., vcruntime140_1.dll) via legitimate binaries (ADNotificationManager.exe, DLPUserAgent.exe, Werfault.exe) to deploy the Havoc Demon C2. They combined DLL sideloading, EDR bypass techniques and legitimate RMM tools for persistence and achieved rapid lateral movement—moving to nine additional endpoints in eleven hours—indicating likely data exfiltration or ransomware objectives.