In a report released in January, security intelligence firm CrowdStrike associated the Havex RAT with targeted attacks against energy sector organizations that took place in September 2013 and were perpetrated by a group of attackers with links to the Russian Federation. The security firm dubbed the attack group "Energetic Bear" and said that its malicious campaigns go as far back as August 2012.
Following the discovery of the Stuxnet industrial sabotage malware in 2010, which is believed to have destroyed up to 1,000 uranium enrichment centrifuges in Iran, security researchers sounded the alarm about the insecurity of industrial control systems and the ease with which they can be targeted by attackers. Despite those concerns, widespread malware attacks against ICS and SCADA systems never became a reality, making the new Havex campaigns a rare occurrence, but possibly an indication of things to come.
Sign up for Computerworld eNewsletters.