Loading malware…
Havex, also known as Backdoor.Oldrea and the Energetic Bear RAT, is a Windows remote access trojan identified in 2013 and used for espionage and reconnaissance against industrial control system (ICS) environments. It is associated with Dragonfly, also tracked as Energetic Bear and Crouching Yeti. U.S. authorities attributed the Dragonfly/Havex campaign to officers of Russia’s FSB Center 16. Targets included energy-sector organizations, utilities, oil and gas companies, nuclear power facilities, and ICS software suppliers.
Havex communicates with attacker-controlled command-and-control servers, exfiltrates collected information, and supports deployment of additional payloads. It gathers host and network information, including running processes, the current username, network adapter configuration, connected computers, and shared resources. It also extracts Outlook address-book data and information from VPN applications; some samples incorporate a publicly available browser password recovery tool. It establishes persistence through registry-based autostart mechanisms, injects into the Windows shell process, and includes a cleanup module that removes traces of infection. Variants use encoding, compression, and cryptographic transformations to process command-and-control data.
Its ICS reconnaissance payload uses classic DCOM-based OPC to enumerate industrial servers, connected devices, and OPC tags, collecting server metadata and tag properties to map control-system environments. Analyzed payloads did not contain functionality to control or modify connected industrial hardware. Testing nevertheless demonstrated intermittent crashes of common OPC platforms, potentially disrupting applications dependent on OPC communications.
Distribution included phishing and spearphishing emails, malicious spam, compromised websites, and watering-hole attacks. A prominent supply-chain technique involved compromising ICS vendors and embedding Havex in legitimate software installers and updates, allowing industrial users to introduce the malware into their networks through trusted software distribution channels.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Havex RAT gathers information about the infected computers and the networks they are connected to and sends it to servers under the control of the attackers. A program that appears to be have been developed in-house, Havex is also known as Backdoor.Oldrea and the Energetic Bear RAT.
Developed one of only a handful of industrial control system (ICS) specific malware variants through ICS-aware modules for Havex.
Beginning in 2013 and continuing through 2014, the threat actor leveraged Havex malware on Energy Sector networks... Havex is a remote access Trojan (RAT) that communicates with a command and control (C2) server.
Beginning in 2013 and continuing through 2014, the threat actor leveraged Havex malware on Energy Sector networks... Havex is a remote access Trojan (RAT) that communicates with a command and control (C2) server.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The Havex RAT gathers information about the infected computers and the networks they are connected to
The HAVEX malware leveraged legitimate functionality in the OPC protocol to map out the industrial equipment and devices on an ICS network.
81 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ICS-targeting malware cited as demonstrating the ability to disrupt operations, cause outages, and inflict physical damage.
ICS-focused malware/RAT referenced as affecting industrial processes and critical infrastructure environments.
Malware/tooling associated with a Russia-linked ICS-focused threat cluster targeting power/energy environments; described in the context of destructive attacks and custom malware/wiper capability across IT/OT.
Used OPC to discover industrial equipment and gather information about industrial systems. The historical overview states that its operators were believed to have targeted more than 2,000 industrial sites, primarily in Europe and the United States.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.