The severity is CRITICAL due to the potential for full system compromise through social engineering. The real-world exploitability is high as it relies on human interaction, and there are no specific patches or technical mitigations.
Employees are tricked by attackers posing as IT support, leading to the installation of Havoc malware on corporate systems, causing widespread compromise.
Affected Systems
- All systems with employees who might interact with fake IT support
Remediation
- Implement strict verification processes for internal communications to confirm the identity of IT staff before executing commands.
- Educate employees about recognizing and reporting phishing attempts or unexpected system crashes that prompt technical assistance.
- Deploy endpoint detection and response (EDR) solutions capable of identifying Havoc malware signatures.
Stack Impact
This affects all systems with human interaction, but does not directly impact specific software like nginx, docker, linux kernel, etc. It primarily impacts employee security awareness and corporate network integrity.