{
  "family": "havex",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Havex is a highly specialized, sophisticated Remote Access Trojan (RAT) famously utilized by the 'Dragonfly' (or Energetic Bear) Advanced Persistent Threat (APT) group. Havex is critical because it was specifically engineered to target Industrial Control Systems (ICS) and SCADA networks, primarily focusing on espionage within the energy and aviation sectors.<br><br><b>Understanding Havex (ICS/SCADA APT)</b><br>To standard enterprise users, Havex might look like a typical RAT. However, to OT (Operational Technology) security engineers, Havex represents a catastrophic breach. It was designed not just to steal office documents, but to map the internal architecture of physical control systems, potentially paving the way for physical sabotage (similar to Stuxnet).<br><br><b>Execution and ICS Espionage Mechanics</b><br>Initial infection was often achieved through strategic 'Watering Hole' attacks (`T1189`)—the attackers compromised legitimate websites of ICS software vendors and replaced legitimate SCADA software installers with trojanized versions (Supply Chain Compromise - `T1195.002`). Once deployed on an engineering workstation, Havex establishes persistence and communicates with its C2 server via HTTP (`T1071.001`). Crucially, Havex includes a specialized module designed to scan the local network for devices communicating via OPC (OLE for Process Control) (`T0836`), a standard protocol used in industrial automation. It harvests data from these OPC servers to build a map of the physical controllers (PLCs) running the facility.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme espionage targeting critical national infrastructure. Host-based IoCs include the presence of known Havex DLLs (often masquerading as legitimate system files) and unexpected outbound HTTP traffic from highly restricted OT networks to known C2 domains. Network IoCs within the OT environment include anomalous, unauthorized OPC network scanning (`T0846`) originating from engineering workstations, attempting to enumerate connected industrial devices.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Havex and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Havex is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Havex establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Havex typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Havex compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Havex should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Havex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Havex frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Havex across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Havex by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1195.002",
    "T1189",
    "T0836",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T0836",
      "name": "Modify Parameter (ICS specifically: OPC Network Scanning/Enumeration)",
      "tactic": "Discovery"
    },
    {
      "id": "T1195.002",
      "name": "Supply Chain Compromise: Compromise Software Supply Chain (Trojanized SCADA installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Watering hole attacks on vendor sites)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "If detected in an OT/ICS environment, immediately sever the connection between the corporate IT network and the industrial control network.",
    "Isolate the infected engineering workstations; do not immediately reboot them, as forensic memory analysis is critical for APT attribution.",
    "Analyze network traffic for unauthorized OPC scanning activity to determine how far the attackers mapped the industrial process.",
    "Engage specialized ICS/SCADA incident response teams; standard IT remediation is insufficient and potentially dangerous in OT environments."
  ],
  "what_to_avoid": [
    "Do not apply standard IT automated remediation (like aggressive AV quarantine) to active SCADA servers, as it may crash physical industrial processes.",
    "Avoid assuming the attack is limited to the IT network; Havex specifically targets the bridge between IT and OT."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}