Havex

Overview

Trojan:Win32/Havex is a highly specialized, sophisticated Remote Access Trojan (RAT) famously utilized by the 'Dragonfly' (or Energetic Bear) Advanced Persistent Threat (APT) group. Havex is critical because it was specifically engineered to target Industrial Control Systems (ICS) and SCADA networks, primarily focusing on espionage within the energy and aviation sectors.

Understanding Havex (ICS/SCADA APT)
To standard enterprise users, Havex might look like a typical RAT. However, to OT (Operational Technology) security engineers, Havex represents a catastrophic breach. It was designed not just to steal office documents, but to map the internal architecture of physical control systems, potentially paving the way for physical sabotage (similar to Stuxnet).

Execution and ICS Espionage Mechanics
Initial infection was often achieved through strategic 'Watering Hole' attacks (`T1189`)—the attackers compromised legitimate websites of ICS software vendors and replaced legitimate SCADA software installers with trojanized versions (Supply Chain Compromise - `T1195.002`). Once deployed on an engineering workstation, Havex establishes persistence and communicates with its C2 server via HTTP (`T1071.001`). Crucially, Havex includes a specialized module designed to scan the local network for devices communicating via OPC (OLE for Process Control) (`T0836`), a standard protocol used in industrial automation. It harvests data from these OPC servers to build a map of the physical controllers (PLCs) running the facility.

Indicators of Compromise & Impact
The impact is extreme espionage targeting critical national infrastructure. Host-based IoCs include the presence of known Havex DLLs (often masquerading as legitimate system files) and unexpected outbound HTTP traffic from highly restricted OT networks to known C2 domains. Network IoCs within the OT environment include anomalous, unauthorized OPC network scanning (`T0846`) originating from engineering workstations, attempting to enumerate connected industrial devices.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_HAVEX {
    meta:
        description = "Detects Havex (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "havex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Havex Activity
id: 74a053f1f467678ccb74de8e193417a9
status: experimental
description: Detects generic indicators of the havex malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*havex*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If detected in an OT/ICS environment, immediately sever the connection between the corporate IT network and the industrial control network.
2. Isolate the infected engineering workstations; do not immediately reboot them, as forensic memory analysis is critical for APT attribution.
3. Analyze network traffic for unauthorized OPC scanning activity to determine how far the attackers mapped the industrial process.
4. Engage specialized ICS/SCADA incident response teams; standard IT remediation is insufficient and potentially dangerous in OT environments.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not apply standard IT automated remediation (like aggressive AV quarantine) to active SCADA servers, as it may crash physical industrial processes.
2. Avoid assuming the attack is limited to the IT network; Havex specifically targets the bridge between IT and OT.

References & External Analysis

• Search "havex" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Rasoon
• Rz0Auircb0Di
• Injeber
• Cloudguard
• Attack

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/havex.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.