{
  "name": "The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP",
  "slug": "the-demon-arrives-later-a-havoc-stager-hides-behind-microsoft-defender-dlp",
  "description": "Cybercriminals in Brazil are exploiting the country's electronic invoice system (Nota Fiscal eletr\u00f4nica) to deliver Havoc framework implants. The campaign surfaced during May 2026, coinciding with tax season when accountants routinely process invoice-related emails. Attackers distribute malicious ZIP files disguised as legitimate invoices, containing VBScript droppers that download MSI installers from Google Cloud Storage. These installers deploy a fake Microsoft Defender DLP module (endpointdlp.dll) alongside a legitimate signed executable. The stager DLL downloads Havoc demon shellcode from command-and-control infrastructure at runtime, never writing the final payload to disk. Analysis reveals nine stager variants originating from a single builder, distributed through multiple channels including Brazilian NF-e-themed lures and Malaysia-registered domains. The implant establishes persistence through the rarely-monitored UserInitMprLogonScript registry key and employs advanced anti-forensic techniques incl...",
  "published": "2026-06-03T22:14:23.239000+00:00",
  "created_at": "2026-06-04T09:10:26.867000+00:00",
  "modified_at": "2026-06-04T07:10:26+00:00",
  "created_at_opencti": "2026-06-04T09:10:26.867000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "banana rat",
    "brazil tax lure",
    "havoc",
    "invoice phishing",
    "kongtuke"
  ],
  "tags": [
    "2026-06-03",
    "banana rat",
    "brazil tax lure",
    "havoc",
    "invoice phishing",
    "kongtuke"
  ],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "acbdb075-9fe9-4ce6-b0e5-2a470f52a7fe",
        "name": "CVE-2026-45585"
      }
    ],
    "indicators": [
      {
        "id": "c5f8772e-0d6a-4260-a85b-11c09e659a3a",
        "name": "c958de72460256c9c1cceef527d880862e8bc29e3ae4e2d478af97dcafd41180"
      },
      {
        "id": "e01baf59-9ead-47af-8331-912eddf8352b",
        "name": "2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494"
      },
      {
        "id": "69b957cb-c4be-4add-83e5-286540da62d2",
        "name": "fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a"
      },
      {
        "id": "ce3d6149-c6e8-4b30-a964-989eb5e63d91",
        "name": "194.62.55.81"
      },
      {
        "id": "9a136ba9-55f6-4440-9cd1-bc8dc7149ae8",
        "name": "7d4fb94f6b4623690daea67ed52e97705cb102f443988ff605f2a9c4898244dc"
      },
      {
        "id": "45c6c4dd-0e32-436c-90cd-59cf7ef34d7c",
        "name": "6b22df0de0a40ff372973639c8a1974cfb75084b8e3b85f9ab9038e0acce43c0"
      },
      {
        "id": "1f53620b-c324-4d99-9477-a5532c6ab610",
        "name": "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c"
      },
      {
        "id": "fbfb5971-09ca-4804-b436-13b71ca3a5b9",
        "name": "d2c637235d62ad766f961f9b8563f6a0e6db2ec0a343470385991b4df826afbc"
      },
      {
        "id": "3cab53a9-c983-4a5d-85c7-4e0291ca21c9",
        "name": "1fc515870c681bf3e1b7947e2248bbcfe9918db2978117e91134de20bd42fd6a"
      },
      {
        "id": "395c80d6-af6b-497e-ab0c-a9af8371f5f0",
        "name": "f2357e70f359803d42298d016c7e1631e9fba6c7e01e5df1eb8fb9ff7eb3df4e"
      },
      {
        "id": "22a9117d-4206-41f3-ba84-301e9b99e2e7",
        "name": "389a6a2007e4f06d16beac0ec2cb01391f80ad5e392343386cae3ceb82ec1502"
      },
      {
        "id": "4b6494e7-3bec-4cb7-9880-c17ade1c6453",
        "name": "e4wxbrg5277.com"
      },
      {
        "id": "00e56acc-a931-43bd-9ff8-eb68028f60fc",
        "name": "49xb5hoiqsr.com"
      },
      {
        "id": "bab0358b-d73d-40c0-afdb-320b2ffd6512",
        "name": "ced6b0f4441085bb9c54a32da9ab4ba14c6e21daf6e34fd61d54923f87baacd0"
      },
      {
        "id": "228aa7b5-7560-4542-8348-501c00e89142",
        "name": "1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf"
      },
      {
        "id": "b864b35e-4542-4313-8289-a3650ed90cd1",
        "name": "d24216d0b82747e9406a696da76960183926145f9621947e34a772137f5e22a6"
      },
      {
        "id": "b867bd9f-cf14-491d-b366-cba244a96d31",
        "name": "ae8cded2822c56dd85f52bba09d9285cb2db3e6317227530b848ea143afb067c"
      },
      {
        "id": "07307821-41a7-4846-b4f9-cae12fac634f",
        "name": "0743154262c5ccf24794168ee331feeefc6539386715307ee44d5d9b6b321077"
      },
      {
        "id": "4de9ac89-52ef-42a2-89a0-3b753b8b15f3",
        "name": "3578e1588846a805ee806fa6151b5801d0acb88879a93d378300e2ee7665736e"
      },
      {
        "id": "5e2caa19-9ba5-4204-9f48-5bde548bfc81",
        "name": "00d979bdb1b29b2859f2120580f101f40e8e13de0b3b7bc29675e2c31098a03c"
      },
      {
        "id": "6ba3e513-0ace-4bd7-a04f-703889674131",
        "name": "9eefc66d1fca7f18a91f49affb569b41bcde043f91567e7f5cc9f2016aeddf8c"
      },
      {
        "id": "347d25ab-9469-43c5-9f92-07088447c732",
        "name": "eca5c297008e7c07a5c6fc9070c03121d702ef093b4a8e508b712040d87fed36"
      },
      {
        "id": "be1f86c1-bd42-488b-9b77-f1291afa3664",
        "name": "thomphon.com"
      },
      {
        "id": "dbbc0fbf-371d-446b-8124-6cf09127a5c8",
        "name": "6dc41555455860b8584d761303a7ae5487117944e2a24d74fa3e91ad8f840077"
      },
      {
        "id": "7a276e88-2a9d-4ed1-8be6-523df1187fea",
        "name": "194.59.31.192"
      },
      {
        "id": "07c10b4d-ba10-4182-8f4b-bf224600998d",
        "name": "jh038x18gy9.com"
      },
      {
        "id": "91c738cb-8960-4278-82d1-a5bbfed4fab9",
        "name": "31f27fdc14505e0cebe360579e1ba0326762cbe0948e50b5f920da51fdef1b51"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "52f731f8-22b9-4a53-87eb-35a6738f7a1b",
        "name": "T1036.001"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "a41fbebf-38b5-43c1-9b09-278186a8eb65",
        "name": "T1037.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      }
    ],
    "malware": [
      {
        "id": "b09f5343-ec83-482b-86c5-eb6ecc13eeec",
        "name": "Havoc",
        "slug": "havoc"
      },
      {
        "id": "49998110-e6da-4bcb-bd77-db3d2784b8a6",
        "name": "Banana RAT",
        "slug": "banana-rat"
      },
      {
        "id": "a95d760f-e791-4a4c-84c6-7b6edd8d3534",
        "name": "KongTuke",
        "slug": "kongtuke"
      }
    ],
    "observables": [
      {
        "id": "5eddb521-0f96-4c5c-b536-0d59e5bc017f",
        "name": "49xb5hoiqsr.com"
      },
      {
        "id": "aa28f21b-357c-468c-befe-cf6680db6bbb",
        "name": "e4wxbrg5277.com"
      },
      {
        "id": "405add82-dd02-46c2-bb0f-a373baa85766",
        "name": "jh038x18gy9.com"
      },
      {
        "id": "786d53be-c4ed-44b2-a778-44c753a87354",
        "name": "thomphon.com"
      },
      {
        "id": "0ad1b6ad-25d4-4d41-b9d6-bc20b3e678c4",
        "name": "194.62.55.81"
      },
      {
        "id": "a15cbefd-e30b-48f0-9f3a-60195560768e",
        "name": "194.59.31.192"
      },
      {
        "id": "",
        "name": "c958de72460256c9c1cceef527d880862e8bc29e3ae4e2d478af97dcafd41180"
      },
      {
        "id": "",
        "name": "2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494"
      },
      {
        "id": "",
        "name": "fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a"
      },
      {
        "id": "",
        "name": "7d4fb94f6b4623690daea67ed52e97705cb102f443988ff605f2a9c4898244dc"
      },
      {
        "id": "",
        "name": "6b22df0de0a40ff372973639c8a1974cfb75084b8e3b85f9ab9038e0acce43c0"
      },
      {
        "id": "",
        "name": "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c"
      },
      {
        "id": "",
        "name": "d2c637235d62ad766f961f9b8563f6a0e6db2ec0a343470385991b4df826afbc"
      },
      {
        "id": "",
        "name": "1fc515870c681bf3e1b7947e2248bbcfe9918db2978117e91134de20bd42fd6a"
      },
      {
        "id": "",
        "name": "f2357e70f359803d42298d016c7e1631e9fba6c7e01e5df1eb8fb9ff7eb3df4e"
      },
      {
        "id": "",
        "name": "389a6a2007e4f06d16beac0ec2cb01391f80ad5e392343386cae3ceb82ec1502"
      },
      {
        "id": "",
        "name": "ced6b0f4441085bb9c54a32da9ab4ba14c6e21daf6e34fd61d54923f87baacd0"
      },
      {
        "id": "",
        "name": "1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf"
      },
      {
        "id": "",
        "name": "d24216d0b82747e9406a696da76960183926145f9621947e34a772137f5e22a6"
      },
      {
        "id": "",
        "name": "ae8cded2822c56dd85f52bba09d9285cb2db3e6317227530b848ea143afb067c"
      },
      {
        "id": "",
        "name": "0743154262c5ccf24794168ee331feeefc6539386715307ee44d5d9b6b321077"
      },
      {
        "id": "",
        "name": "3578e1588846a805ee806fa6151b5801d0acb88879a93d378300e2ee7665736e"
      },
      {
        "id": "",
        "name": "00d979bdb1b29b2859f2120580f101f40e8e13de0b3b7bc29675e2c31098a03c"
      },
      {
        "id": "",
        "name": "9eefc66d1fca7f18a91f49affb569b41bcde043f91567e7f5cc9f2016aeddf8c"
      },
      {
        "id": "",
        "name": "eca5c297008e7c07a5c6fc9070c03121d702ef093b4a8e508b712040d87fed36"
      },
      {
        "id": "",
        "name": "6dc41555455860b8584d761303a7ae5487117944e2a24d74fa3e91ad8f840077"
      },
      {
        "id": "",
        "name": "31f27fdc14505e0cebe360579e1ba0326762cbe0948e50b5f920da51fdef1b51"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "e4wxbrg5277.com"
      },
      {
        "id": "",
        "name": "49xb5hoiqsr.com"
      },
      {
        "id": "",
        "name": "thomphon.com"
      },
      {
        "id": "",
        "name": "jh038x18gy9.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "8def554d-c98d-41f4-869f-5b291d6a8aa2",
      "standard_id": "external-reference--1a5bdcf9-6eab-5f4d-ac7b-bd427d9484ff",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a20a73fc005e1fc15255876",
      "hash": null,
      "external_id": "6a20a73fc005e1fc15255876",
      "created": "2026-06-04T09:10:20.013Z",
      "modified": "2026-06-04T09:10:20.013Z",
      "createdById": null
    },
    {
      "id": "4e2712fc-0bde-43cb-86ad-731c12f70867",
      "standard_id": "external-reference--bef09851-592a-5f44-a41a-462e114f54b5",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.levelblue.com/blogs/spiderlabs-blog/the-demon-arrives-later-a-havoc-stager-hides-behind-microsoft-defender-dlp",
      "hash": null,
      "external_id": null,
      "created": "2026-06-04T09:10:20.051Z",
      "modified": "2026-06-04T09:10:20.051Z",
      "createdById": null
    }
  ]
}