### Incident Overview

Post-deployment of the **'Havex' RAT**, communication with its command and control (C2) servers has been observed. This RAT allows adversaries remote control over infected machines, enabling further reconnaissance and exploitation.

### Key Indicators:
- **C2 Domains**: Infected systems connect to multiple C2 domains, some of which have been newly registered and others linked to known threat actor infrastructure.
- **RAT Capabilities**: The 'Havex' RAT is capable of gathering system information, executing commands, and facilitating lateral movement.

### Actionable Intelligence:
- **Registry Monitoring**: Prepare to detect persistence mechanisms, particularly involving registry modifications.
- **Network Segmentation**: Implement stricter network segmentation to limit RAT communication and lateral movement.