Havex (Backdoor.Oldrea)

OPC-aware RAT used by Dragonfly / Energetic Bear from 2013 in supply-chain compromises of ICS vendor websites (MESA Imaging, eWON/Talk2M, MB Connect Line). Activity is named as BERSERK BEAR in CISA / FBI joint advisory AA22-110A (20 April 2022), which attributes the group to FSB Centre 16 (Military Unit 71330).

family

Havex

first seen

Dec 31, 2012

publisher

CISA