Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
ToolMalware Family
Active Threat
Havoc
20.3k
IOCs Tracked
2022
First Seen
Oct 21, 2026
Last Seen
0
YARA Rules
Associated IOCs20,292 total · showing 50
IP50
91.202.233.2142026-10-21High
101.200.193.2112026-10-21High
67.219.102.2442026-10-21High
15.204.95.2282026-10-21High
46.151.182.2052026-10-21High
162.248.225.1652026-10-21High
221.207.101.1752026-10-21High
109.73.193.2422026-10-01High
185.177.72.682026-09-24High
77.83.36.1632026-09-03High
129.150.46.862026-06-06High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
115.231.236.1502026-06-21High
167.86.72.2202026-07-18High
206.188.196.2212026-06-04High
172.245.195.2062026-06-06High
88.119.167.1432026-08-17High
83.98.39.542026-06-09High
Related Reports9 shown
Cato CTRL™ Threat Research: Operation Poisson – Analyzing a Cybercriminal’s Entire Operation
Cato NetworksJun 16, 2026
Mythic C2 Activity at Internet Scale
CensysSep 15, 2026
Ransomware Hackers Disable Security Tools and Backups Before Encrypting Entire Networks
Cyber PressSep 3, 2026
Exploits and vulnerabilities in Q2 2026
SecurelistAug 26, 2026
From cause to cash: a cross-border look at hacktivist activity
SecurelistJun 8, 2026
The Gentlemen are knocking: сustom backdoors and evolving tactics
SecurelistJun 29, 2026
Gentlemen EDR Killer Suite Combines HexKiller, ThrottleBlood, and HavocKiller
Cyber PressJun 20, 2026
Microsoft Teams Relay Abused to Stealthily Route Malware Communications
Cyber PressJun 16, 2026
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
BI.ZONEDec 17, 2025
Threat Profile
TypeTool
StatusActive
First SeenJul 29, 2022
Last SeenOct 21, 2026
IOCs tracked20,292