# Fake Tech Support Delivers Havoc Command & Control

Fake IT-support calls led users to run a fake Outlook antispam patch, sideloading DLLs that loaded a customized Havoc Demon with indirect syscalls and registry-based C2 fallback.

- Payout: Real-world hack
- Severity: high
- Program: Huntress partner organizations
- Analysis by: Huntress
- Disclosed: 2026-03-02
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/fake-tech-support-havoc-command-control
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-tech-support-havoc-command-control
- Tags: area:os domain:desktop impact:internal-access impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Windows endpoints; signed binaries ADNotificationManager.exe, DLPUserAgent.exe, Werfault.exe
**Root cause:** Users were socially engineered into running a password-protected zip 'antispam patch' that dropped malicious DLLs beside legitimate signed binaries; DLL search-order sideloading then executed an obfuscated loader that decrypts and runs Havoc Demon shellcode.
**Steps:**
1. Spam campaign followed by phone call from fake 'IT support' offering to fix Outlook spam.
2. User approves QuickAssist/AnyDesk; attacker opens fake AWS-hosted 'Outlook Antispam Control Panel'.
3. User downloads `patch<numbers>.1`; attacker reconstructs zip via `resources.zip` containing `PK` header plus appended file.
4. Extract password-protected zip to `%PROGRAMDATA%\Adobe\ARM` yielding license.key, vcruntime140_1.dll, vcruntime140_2.dll, ADNotificationManager.exe, msvcp140.dll, vcruntime140.dll.
5. Set registry values UXMP and UCID under `HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft`, then delete UXMP.
6. Execute `ADNotificationManager.exe`, which sideloads malicious `vcruntime140_1.dll` forwarding exports to `vcruntime140_2.dll`.
7. Loader uses Hell's Gate/Halo's Gate to resolve SSNs, XOR-decrypts .rsrc payload, reflectively loads DLL that ChaCha20-decrypts `license.key` and spawns Havoc Demon (e.g. into notepad.exe).
**How found:** Huntress DE&TH flagged an anomalous process execution chain in a partner environment, then expanded into a multi-day hunt across five partners, correlating spam/tech-support lures with DLL sideloading and Havoc tradecraft.
**Exploitation:** Attacker gained hands-on remote access via QuickAssist/AnyDesk, harvested credentials via fake password overlay, deployed Havoc Demon for C2, then within ~50 minutes created scheduled tasks running `C:\Windows\SoftwareDistribution\Download\go.bat` to reassemble c_*.dat files into a cab, expand to WerFault.exe + faultrep.dll sideload, and re-launch Demon on boot. Also deployed Level RMM (enrollment key `--key uGTYwD7VzX3bnwX9PVGdXtiD`) and XEOX RMM on separate hosts for diversified persistence.
**Escalation:** Lateral movement from beachhead to nine additional endpoints in ~11 hours using three distinct persistence mechanisms (Havoc scheduled tasks, Level RMM, XEOX RMM) so remediation of one wouldn't remove all access.
**Insight:** Customized Havoc variants add registry-based C2 fallback (UXMP/UFID/UCID under HKCU\...\Microsoft with HKLM SQMClient fallback) and Detours hooks on RtlExitUserProcess/LdrUnloadDll — hunt for these registry keys and ntdll hook patterns rather than stock Havoc signatures; also treat unexpected RMM enrollment keys as persistence.

## Proof of concept (copied exactly from the original report)

**Batch script reconstructing Havoc payload via scheduled task**

```
C:\Windows\SoftwareDistribution\Download\go.bat, a directory that temporarily stores Windows Update files, chosen to blend in with legitimate system activity. The
 scheduled tasks ensured that on every system boot, the batch script would execute, reconstructing and launching the Havoc Demon payload, providing the adversary with persistent C2 access that would
 survive reboots:

Loading Gist...

 In a particularly amusing touch, the adversary included echo “Update completed”
```

**Registry-based C2 fallback with ChaCha20 key**

```
Primary: HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\
 
- Fallback: HKLM\SOFTWARE\Microsoft\SQMClient\

 The three registry values each serve a distinct purpose. UXMP likely stores the file path to the Demon payload on disk, when the agent needs to perform fork-and-run
 operations, it reads this path, creates a randomly-named pipe (\\.\pipe\{GUID}), and calls CreateProcessW to spawn a sacrificial process
 for executing post-exploitation tasks.

 The UFID and UCID values work as a pair: after reading the registry data, the Demon sets up a ChaCha20 decryption using the
 UCID output as key material, with a hardcoded 12-byte nonce (41 98 B6 39 77 EA 2B F0 A4 2D 42 22)
```

**Level RMM enrollment key command**

```
--key uGTYwD7VzX3bnwX9PVGdXtiD
```