Havex

Use the mouse wheel or two fingers (on touchscreens) to zoom in and out of the map.

Export map as:

Research this topic

Explore the main themes, entities and connections around Havex. Start with the topic map, then use the sections below for research and deeper semantic analysis.

Explore this topic

Start with a few of the strongest sections from the source topic. These are research directions, not a list of keywords you must use.

Description

OPC ICS/SCADA DCOM Watering-hole attacks

4 related topics

Discovery

F-Secure Symantec ICS-CERT

3 related topics

Exploit Kits

Footprinting URL

2 related topics

Overview

Remote Access Trojan APT Energetic Bear ICS Stuxnet

8 related topics

Key facts & relationships

High-confidence facts extracted from structured source data. Use them as anchors for further research.

Author: Energetic Bear
Alias: Oldrea
Platforms: Windows, Linux, iOS, Android
Ports used: 44818, 105 and 502
Technical name: BKDR_HAVEX.[letter] (Trend Micro) · Backdoor:Win32/Havex.[letter] Microsoft · Backdoor:W32/Havex (F-Secure)
Type: RAT

Topics to explore

Browse the full topic structure. Each item opens a new analysis centered on that subject.

Overview

Remote Access Trojan Remote Access Trojans (RATs)
APT Advanced persistent threat
Energetic Bear
ICS Industrial control system
Stuxnet
BlackEnergy
Industroyer/CRASHOVERRIDE Industroyer
TRITON/TRISIS Triton (malware)

Discovery

F-Secure
Symantec NortonLifeLock
ICS-CERT

Description

OPC OLE for Process Control
ICS/SCADA SCADA
DCOM Distributed Component Object Model
Watering-hole attacks Watering hole attack

Exploit Kits

Advanced semantic analysis

Deeper signals for content research, entity SEO and topical coverage. The plain-language headings explain what each technical view is useful for.

Map overview Semantic statistics

Nodes22

Edges21

Triples70

Avg. degree1.91

Density0.090909

Components1

How this topic connects Entity context

See the strongest relationship patterns around the current topic before diving into the raw triples.

Havex

Top relations

related to Description · 31

Havex → By, DCOM-based, Distributed Component Object Model, Dragonfly, Havex RAT, ICS, ICS/SCADA, In, Karagany, Known, MB Connect Line, MESA Imaging, OPC, OPC Unified Architecture, Open Platform Communications, PHP, RAT, Researchers, Rockwell Automation, SANS

related to Website Redirect Injection · 11

Havex → Corrupted, Hello, Java, Karagany, LightsOut, Once, OS, The, The Hello, The LightsOut, URL

related to Affected Regions & Victims · 10

Havex → Canadian, Cybersecurity, Dragos, Europe, Researchers, Symantec, The Dragonfly, Through, United States, US

related to Discovery · 7

Havex → F-Secure, ICS, ICS-CERT, OPC, Symantec, The Havex, The ICS-CERT Alert

Technical name · 3

Havex → Backdoor:W32/Havex (F-Secure), Backdoor:Win32/Havex.[letter] Microsoft, BKDR_HAVEX.[letter] (Trend Micro)

Alias · 1

Havex → Oldrea

Author · 1

Havex → Energetic Bear

Platforms · 1

Havex → Windows, Linux, iOS, Android

Ports used · 1

Havex → 44818, 105 and 502

Type · 1

Havex → RAT

Important terminology Word statistics

Use these terms to understand the vocabulary surrounding the topic, not as a checklist for keyword stuffing.

Important terminology

malware campaign ics exploit opc researchers websites rat victims energetic bear systems also known used backdoor information industrial devices victim

Entity relationships Subject–Predicate–Object triples

Subject	Predicate	Object	Confidence	Src
Havex	Alias	Oldrea	1.00	infobox
Havex	Author	Energetic Bear	1.00	infobox
Havex	Platforms	Windows, Linux, iOS, Android	1.00	infobox
Havex	Ports used	44818, 105 and 502	1.00	infobox
Havex	Technical name	BKDR_HAVEX.[letter] (Trend Micro)	1.00	infobox
Havex	Technical name	Backdoor:Win32/Havex.[letter] Microsoft	1.00	infobox
Havex	Technical name	Backdoor:W32/Havex (F-Secure)	1.00	infobox
Havex	Type	RAT	1.00	infobox
Havex	Written in	PHP	1.00	infobox
Siemens	instance of	Researchers at SANS noted these ports are common to ICS/SCADA companies	0.80	text
Rockwell Automation	instance of	Researchers at SANS noted these ports are common to ICS/SCADA companies	0.80	text
Havex	related to Affected Regions & Victims	The Dragonfly	0.60	section

Related concept clusters Concept neighborhoods

These clusters group vocabulary that occurs around closely connected concepts in the source material.

Connections between topic areas Semantic bridges

Bridges can reveal useful research angles that are easy to miss in a flat list of related terms.

Min side: 3