Havex

Havex, also known as Dragonfly or the Energetic Bear RAT, is a prominent threat actor in the cybersecurity landscape. First spotted in 2013, Havex was part of a broad industrial espionage campaign that specifically targeted Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) environments, primarily in Europe. The threat actors behind Havex employed a variety of infection techniques, including phishing emails and compromising ICS equipment vendor websites. They replaced legitimate software updates with malicious versions, infecting victims who downloaded these Trojan-ized updates. This allowed the threat actors to remotely access infected networks and harvest data from compromised machines. The IRON LIBERTY threat group notably used Havex, along with custom malware like Sysmain and xFrost (now Karagany), for their operations prior to 2014. A comparison between Heriplor and an IRON LIBERTY Havex second-stage malware sample from 2014 revealed identical file writing and shared command and control (C2) servers, suggesting that Heriplor was developed from the Havex code base. However, CTU researchers found no evidence that other threat actors have utilized Havex or Heriplor, indicating its unique association with specific threat groups. Havex joins the ranks of a few ICS-specific malware variants like EKANS and CRASHOVERRIDE, which contain explicit references to industrial processes. Among these, Stuxnet and Industroyer/CrashOverride are well-known examples that were used in significant cyberattacks on Iran's Uranium enrichment facility and Ukraine's power grid, respectively. In 2014, Havex was hidden in IT product downloads and used to breach IT/OT firewalls, gathering intelligence from OT networks. UNC2447, another threat actor, has been observed using 'Havex' Malleable profiles during the initial stages of intrusion for persistence and communication with C2 servers over HTTPS.