Loading malware…
Havex, also known as Backdoor.Oldrea, is a remote access trojan (RAT) associated with the Russia-attributed Energetic Bear / Dragonfly activity. It was publicly reported in 2013 by F-Secure and Symantec, and ICS-CERT reported on the campaign the same year. The malware is notable for industrial control system (ICS) targeting and is considered ICS-tailored because it includes an OPC scanning module used to search for industrial devices, enumerate and map ICS-specific systems, and abuse the older DCOM-based OPC standard to conduct reconnaissance in victim environments. Reported scanning behavior includes identifying ICS-related ports, with the OPC module scanning TCP ports 44818, 105, and 502. FireEye analyzed a Havex variant referred to as Fertger or PEACEPIPE and described it as the first publicly reported malware observed actively scanning OPC servers used in SCADA environments. That variant recursively enumerated accessible servers, checked for COM interfaces associated with OPC services, determined OPC server capabilities, and queried fields such as server state, tag name, type, access, and ID. Collected scan data was written to temporary files, then encrypted using a randomly generated 168-bit 3DES key protected by an RSA public key from the TYU resource; related reporting identified sample PE.dll with MD5 6bfc42f7cb1364ef0bfd749776ac6d38 and related MD5s ba8da708b8784afd36c44bb5f1f436bc and 4102f370aaf46629575daffbd5a0b3c9.
Havex was used in Operation Dragonfly, a multi-pronged intrusion campaign that established network presence, performed reconnaissance, and enabled command and control. Reported initial access vectors included spear phishing, watering-hole attacks, and supply-chain compromise of ICS vendor websites and legitimate software downloads. Known compromised vendors included MESA Imaging, eWON/Talk2M, and MB Connect Line. Watering-hole delivery used the LightsOut and Hello exploit kits, which exploited Java and browser vulnerabilities, with Hello adding victim fingerprinting. The supply-chain method allowed trojanized software to be downloaded and installed by authorized users.
The malware has two primary components: the RAT itself and a PHP-based C2 server. Reported host behaviors include collecting the current username, OS information, and computer name; injecting itself into explorer.exe; using rundll32 for execution; and writing collected data to temporary files in encrypted form before exfiltration. Some samples use Base64 plus bzip2, while others use Base64 plus reverse XOR plus RSA-2048 to decrypt data received from C2 servers. Some samples also contain a publicly available web browser password recovery tool. Havex was often used to deliver the Karagany payload, which can steal credentials, take screenshots, and transfer files.
The campaign primarily targeted the energy sector, but reporting also cites aviation, pharmaceutical, defense, and petrochemical sectors, with victims mainly in the United States and Europe. Researchers reported substantial campaign infrastructure, including 146 associated C2 servers, 88 Havex variants, and an estimated targeting scope of more than 2,000 sites.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Berserk Bear is a Russian state-sponsored cyber espionage group linked to the FSB. They have been active since at least 2010 under many names (Dragonfly, Energetic Bear, Havex, Crouching Yeti, Koala, TeamSpy, etc.) and specialize in penetrating critical infrastructure."
25 distinct techniques documented for this family, organized by ATT&CK tactic.
"ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration."; "Agent Tesla can encrypt data with 3DES..."; "APT32's backdoor has used...RC4 encryption before exfiltration."; "Epic encrypts collected data using a public key framework..."; "Some variants encrypt...with AES and encode it with base64..."; "Prikormka...encrypts it with Blowfish."; "VERMIN encrypts the collected files using 3-DES."; "Zebrocy...RC4...as well as AES...and hexadecimal for encoding"
The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Through recursive calls to WNetOpenEnum and WNetEnumResources, the scanner builds a list of all servers that are globally accessible through Windows networking.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
When executing PE.dll, all of the OPC server data output is first saved as %TEMP%\[random].tmp.dat. The results of a capability scan of an OPC server is stored in %TEMP%\OPCServer[random].txt.
"AppleSeed has compressed collected data before exfiltration."; "APT28 used a publicly available tool to gather and compress multiple documents..."; "Aria-body has used ZIP to compress data..."; "Cadelspy...compress stolen data into a .cab file."; "Daserf hides collected data in password-protected .rar archives."; "FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."; "Lazarus Group has compressed exfiltrated data with RAR...archive specified directories in .zip format"; "XCSSET will compress entire ~/Desktop folders..."
Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
52 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ICS-targeting malware cited as demonstrating the ability to disrupt operations, cause outages, and inflict physical damage.
ICS-focused malware/RAT referenced as affecting industrial processes and critical infrastructure environments.
Malware/tooling associated with a Russia-linked ICS-focused threat cluster targeting power/energy environments; described in the context of destructive attacks and custom malware/wiper capability across IT/OT.
Havex is a known espionage backdoor/RAT historically associated with the Berserk Bear/Dragonfly activity set, used to gain remote access and support intrusion operations against critical infrastructure environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.