Operation Poisson Havoc/Demon C2 via senti.dll Shellcode Injection into Explorer

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.