DHS Warns Energy Firms Of Malware Used In Targeted Attacks

The Department of Homeland Security’s ICS‑CERT and security firms (Symantec, F‑Secure) warned of a targeted campaign—dubbed Dragonfly/Havex—compromising industrial control systems at energy firms in the U.S. and Europe. Attackers used phishing and watering‑hole compromises of ICS vendor download sites to distribute a RAT/downloader (Havex) and secondary payloads (e.g., Karagany), conducted OPC/ICS device reconnaissance and data harvesting, and operated hundreds of C2 servers and many RAT variants to gain footholds that could enable sabotage of ICS environments.