Fake IT support calls delivered Havoc C2, enabling credential theft, lateral movement, and ransomware prep across five organizations.