building-red-team-c2-infrastructure-with-havoc

SUSPICIOUS/HIGH-RISK skill. The install sources are mostly coherent with the stated purpose and do not show clear credential harvesting, but the skill equips an AI agent to build and operate offensive C2 infrastructure, generate payloads, and conduct post-exploitation actions with real-world impact. Supply-chain trust is only moderate due to archived mutable source builds, and the redirector config weakens TLS verification. Not confirmed malware, but unsafe to grant broadly.

This fragment is an offensive security engagement template for configuring and operating Havoc C2 infrastructure. It contains no executable malware or implementation of data theft, persistence, exfiltration, or remote control, so malicious behavior cannot be confirmed from the fragment alone. However, the documented configuration directly supports C2 communication, payload execution, phishing, evasion, and lateral movement and would present substantial operational risk if used outside an authorized engagement.

The code is a dual-use Havoc C2 administration and reporting utility, not ordinary benign infrastructure code. It communicates with a caller-specified C2 teamserver, exposes agent information, and contains capabilities for listener creation and payload generation, although those capabilities are not called by the current main flow. The primary concrete security flaw is disabled TLS verification, which can expose the authentication token and API contents to man-in-the-middle attacks. The fragment as supplied also appears syntactically incomplete. There is no direct evidence in this file of data exfiltration to an undisclosed destination, persistence, or destructive behavior, but its C2 and payload-generation purpose creates substantial operational risk if used outside authorized testing.

This fragment does not contain conventional npm-package malware behavior, but it documents and automates deployment of Havoc C2 infrastructure, including an internet-facing redirector and operational evasion practices. That functionality is dual-use in authorized red-team exercises but is also directly applicable to covert command-and-control. The visible Terraform alone does not show data theft or persistence, while the referenced installation scripts remain an important unreviewed execution point. Treat the material as high-risk offensive security infrastructure and require authorization, provenance validation, and review of all referenced scripts before use.

This is documentation for a red-team C2 platform rather than an implementation containing executable malicious behavior. It exposes a clear dual-use and potentially harmful operational capability, especially through agent tasking and stealth-oriented payload options, but there is no evidence in the supplied fragment of malware, credential theft, exfiltration, persistence, or backdoor execution. Use should be restricted to authorized testing and isolated lab environments.