tagged

[havoc-c2]

4 editions · 2 items

October 6, 2026

BOFKatz packages Mimikatz as a Beacon Object File with process hollowing and command-line spoofing. It runs Mimikatz in memory inside a hollowed process and modifies PEB command-line data to present benign arguments to monitoring tools. The author reports testing only with Havoc C2, an important compatibility constraint. KrakenEU’s repository · New Tools & Releases

in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records

August 12, 2026

When the AI Is the One Finding the Zero-Days

A frontier AI agent discovered a zero-click RCE in Zoom (CVE-2026-53413, CVE-2026-53414) in under 24 hours, demonstrating rapid offensive AI capability in vulnerability research. Rapid7 disclosed an AI-assisted unauthenticated RCE in Microsoft SharePoint (CVE-2026-63520), while CISA confirmed ransomware crews are actively exploiting a related flaw. Researchers extracted encrypted reasoning traces and leaked credentials from OpenAI, Anthropic, and Google models by manipulating extended-thinking APIs. Microsoft's August Patch Tuesday fixed 421 CVEs including an actively exploited kernel zero-day (CVE-2026-68820) already in Lazarus hands, along with a pre-auth IDOR in Langflow (CVE-2026-55255) being exploited in the wild.

July 6, 2026

The Gentlemen Weaponize a Signed Kontron Driver Into an EDR Killswitch

The Gentlemen ransomware crew exploited a zero-day in a signed Kontron driver to disable endpoint defenses via BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware. CVE-2026-46242 (Bad Epoll) now has a public proof-of-concept for a Linux kernel use-after-free that enables privilege escalation on 6.4+ kernels with 99% reliability. Medtronic is notifying 3.8 million individuals after a ShinyHunters data breach exposed personal and medical data. Multiple new red-team tools and offensive-security frameworks including T3MP3ST, goshs, and Knossos were released, alongside DOJ filings revealing how Microsoft telemetry helped the FBI identify alleged Scattered Spider member Peter Stokes via Windows Global Device ID correlation.

June 30, 2026

Unit 42 detailed a new Kongtuke (ClickFix) campaign sideloading Havoc C2 via a signed WinWrapIDE binary, with an evasive loader using window cloaking, sandbox sleep, and native callback evasion to run a memory-only infostealer. Unit 42 · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List