{
  "family": "havex",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Havex is a highly specialized, sophisticated Remote Access Trojan (RAT) famously utilized by the 'Dragonfly' (or Energetic Bear) Advanced Persistent Threat (APT) group. Havex is critical because it was specifically engineered to target Industrial Control Systems (ICS) and SCADA networks, primarily focusing on espionage within the energy and aviation sectors.<br><br><b>Understanding Havex (ICS/SCADA APT)</b><br>To standard enterprise users, Havex might look like a typical RAT. However, to OT (Operational Technology) security engineers, Havex represents a catastrophic breach. It was designed not just to steal office documents, but to map the internal architecture of physical control systems, potentially paving the way for physical sabotage (similar to Stuxnet).<br><br><b>Execution and ICS Espionage Mechanics</b><br>Initial infection was often achieved through strategic 'Watering Hole' attacks (`T1189`)—the attackers compromised legitimate websites of ICS software vendors and replaced legitimate SCADA software installers with trojanized versions (Supply Chain Compromise - `T1195.002`). Once deployed on an engineering workstation, Havex establishes persistence and communicates with its C2 server via HTTP (`T1071.001`). Crucially, Havex includes a specialized module designed to scan the local network for devices communicating via OPC (OLE for Process Control) (`T0836`), a standard protocol used in industrial automation. It harvests data from these OPC servers to build a map of the physical controllers (PLCs) running the facility.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme espionage targeting critical national infrastructure. Host-based IoCs include the presence of known Havex DLLs (often masquerading as legitimate system files) and unexpected outbound HTTP traffic from highly restricted OT networks to known C2 domains. Network IoCs within the OT environment include anomalous, unauthorized OPC network scanning (`T0846`) originating from engineering workstations, attempting to enumerate connected industrial devices.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1195.002",
    "T1189",
    "T0836",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T0836",
      "name": "Modify Parameter (ICS specifically: OPC Network Scanning/Enumeration)",
      "tactic": "Discovery"
    },
    {
      "id": "T1195.002",
      "name": "Supply Chain Compromise: Compromise Software Supply Chain (Trojanized SCADA installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Watering hole attacks on vendor sites)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "If detected in an OT/ICS environment, immediately sever the connection between the corporate IT network and the industrial control network.",
    "Isolate the infected engineering workstations; do not immediately reboot them, as forensic memory analysis is critical for APT attribution.",
    "Analyze network traffic for unauthorized OPC scanning activity to determine how far the attackers mapped the industrial process.",
    "Engage specialized ICS/SCADA incident response teams; standard IT remediation is insufficient and potentially dangerous in OT environments."
  ],
  "what_to_avoid": [
    "Do not apply standard IT automated remediation (like aggressive AV quarantine) to active SCADA servers, as it may crash physical industrial processes.",
    "Avoid assuming the attack is limited to the IT network; Havex specifically targets the bridge between IT and OT."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}