In 2013 and 2014 someone swapped the installers on three small industrial suppliers’ websites for copies carrying a spy. It mapped plant networks and sent data home. No record shows it touched a process.
Havex is the entry where the trusted place was the target: three small European suppliers of industrial software had the installers on their own websites replaced, so customers who did the responsible thing, fetching software from the vendor, installed a remote access trojan with it. What the trojan did is modest, and the record stays modest: it collected host information, searched for OPC servers and sent what it found home. Reading the plant, not operating it. Nothing stopped. What was lost was knowledge.
That is why it belongs in the book. Learning a plant is the expensive step in any attack on a process, and here it was paid for through the one channel plants are told to trust. A signature on the download helps. The fix is architecture: a control network with no route out, remote access that is not a standing client with saved passwords, and process data read one way.
What is not known: Nobody has published how the three vendor websites were breached, beyond one vendor’s notice that its site had been attacked. No victim has come forward. No public document says how many plants installed a poisoned package rather than being reached by phishing or a compromised website, or which vendor’s package reached whom. The 17,000 devices so often quoted is a prosecutors’ total across every method. Whether Havex crashed an OPC server anywhere outside ICS-CERT’s own testing is unrecorded, and the attribution rests on an indictment never tested in court.
Recommendation
Take the route out away Nothing in the control network reaches the internet, and vendor software arrives via a staging host off it. A poisoned installer cannot fetch instructions or send home.
Remove standing remote access Replace resident clients and saved passwords with brokered, time-limited sessions, and verify every installer against a hash from a channel other than the download page.
Make read-only consumers read one way Historians take OPC data through a one-way path, so OPC servers answer only the hosts that must write to them and nothing else can browse them.
Sources: ICS-CERT ICSA-14-178-01, Jun 2014, rev. 20 Jul 2021; F-Secure, 23 Jun 2014; Symantec, Dragonfly, 30 Jun 2014; DOJ release, 24 Mar 2022; ICS-ALERT-14-176-02A and CISA AA22-083A (cited by number only). Full list with links.
Soft Spots: The OPC crashes are ICS-CERT’s lab testing, not a field incident. The 17,000 is a prosecutors’ total across all methods. Vendor identities are researcher findings. Reading Havex as the start of the Poland DER arc is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
Installers on three small industrial suppliers' websites were swapped for copies carrying a spy that mapped plant networks and sent data home. What is verified, what is only claimed, and what is still unknown.
Summary
Havex was a cyber espionage campaign in which, in 2013 and 2014, installers on three small European industrial software suppliers' websites were swapped for copies carrying a remote access trojan. It collected host data, scanned networks for OPC servers and sent findings home. No record shows it touched a process; the reported OPC crashes occurred in ICS-CERT's own testing.3,5,6
Timeline of the Havex campaign
Every date is tied to a source. Press reporting appears only as evidence of what was said.
CrowdStrike later reports the group it calls Energetic Bear active since at least August 2012.1
Symantec dates the start of the group's email (spam) campaign to February 2013.5,9
One supplier's poisoned package is available for download for at least six weeks.5
CrowdStrike's Global Threat Report names Energetic Bear and calls state sponsorship "possible."1
eWON publishes its own notice: its website had been attacked and a corrupted installer placed in its content management system. It ships a version that removes the infection, forces the upgrade and resets customer passwords. The notice is undated; the year rests on the 30 January email it announces and a researcher chronology.2
A third supplier's poisoned package is available for about ten days.5
F-Secure publishes the trojanized installers and an OPC scanning component, describing the affected vendors as based in Germany, Switzerland and Belgium.3,4
ICS-CERT publishes advisory ICSA-14-178-01, "ICS Focused Malware," with the three vectors and the OPC testing result.6
Symantec publishes "Dragonfly: Western Energy Companies Under Sabotage Threat," with the download count and availability windows.5
Symantec's Dragonfly whitepaper, version 1.21, describes the email campaign, watering holes and exploit kits.9
Netresec publishes the three suppliers' names, eWON, MB Connect Line and MESA Imaging, identified from samples.11
The ICS-CERT advisory is revised to say the US Government attributes the activity to "Russian nation-state cyber actors."6
An indictment against three FSB officers is returned in the District of Kansas.7
The Justice Department unseals the indictment. CISA, the FBI and DOE publish advisory AA22-083A the same day.7,12
Idaho National Laboratory publishes a retrospective on Havex in a US manufacturing facility, repeating that the OPC crashes were "observed in testing."8
CERT Polska reports that infrastructure behind the December 2025 attacks on Polish energy overlaps with the cluster researchers call Static Tundra, Berserk Bear and Dragonfly.13
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
How was the malware delivered?
Per ICS-CERT: phishing emails, redirects to compromised websites and, "most recently," trojanized installers on at least three ICS vendor websites6
Verified (ICS-CERT's summary)
Which suppliers' installers were poisoned?
eWON (Belgium), MB Connect Line (Germany), MESA Imaging (Switzerland), identified by researchers from samples11
Researcher finding
Did any supplier confirm it?
eWON, in its own notice: its website "has been attacked"2
Verified
How long were the poisoned packages up?
250 unique downloads of one before it was caught; at least six weeks for another; about ten days for the third5
Researcher finding
What did the malware do?
Collected host information, scanned the local network for OPC servers and sent what it found home3,4
Researcher finding
Did Havex crash OPC servers at a plant?
Not on the record. The crashes were in ICS-CERT's testing6,8
Verified (lab only)
Did it change any physical process?
No published account describes it writing a value or changing logic, as of late September 2026
Verified (time-bound)
Who is accused?
Three FSB Center 16 officers, in an indictment unsealed 24 March 20227
Charged, not tried
Is 17,000 a count of Havex infections?
No. It is the prosecutors' total across every method7
Verified
How were the vendor websites breached?
Not published
Undisclosed
Which organizations were victims?
None has come forward
Undisclosed
How did Havex get into industrial networks?
Through three doors, and the vendor download pages were the last of them. ICS-CERT's June 2014 advisory lists the campaign's vectors in order: phishing emails, redirects to compromised websites and, "most recently," trojanized installers on at least three ICS vendor websites.6 Symantec dates the email campaign to February 2013 and describes watering holes and the LightsOut and Hello exploit kits.5,9 Which vector reached which victim has never been published.
The three suppliers were small and specialized: a Belgian maker of industrial VPN routers, eWON, whose client software connects engineers to PLCs; a German remote maintenance firm, MB Connect Line; and a Swiss maker of industrial cameras, MESA Imaging. None of the June 2014 reports named them. F-Secure described the affected companies only as "based in Germany, Switzerland and Belgium."3 Netresec named them in October 2014, matching samples to installers.11 The pairing of Symantec's three anonymous descriptions with these names is a researchers' match, not Symantec's.
"Two of them develop ICS remote management software and the third supplies high-precision industrial cameras and related software."
That sentence describes the suppliers, not the poisoned products. Per Netresec, only eWON's package was a remote access client (eCatcher); MB Connect Line's poisoned packages were a configuration tool, diagnostic software and a virtual COM port driver; and MESA Imaging's installer dropped a different trojan, Sysmain, not Havex.11
Symantec counted 250 unique downloads of one vendor's package before it was caught. Another was available for at least six weeks in June and July 2013, the third for about ten days in April 2014.5
Were the software vendors at fault?
Nothing on the record says so, and at least one acted quickly and in public. eWON published its own notice in January 2014, months before the research reports: its commercial website "has been attacked" and a corrupted installer had been placed in its content management system. It shipped a version that erased the infection during setup, forced the upgrade and reset customer passwords as a precaution.2
We have not found published statements from MB Connect Line or MESA Imaging. Netresec lists MB Connect Line's identification as coming from "Company incident reports and sandbox analysis," so a company statement may exist.11 How any of the three websites was breached has not been published, and nothing public says whether customers could have verified the installers they downloaded.
None of the three identified suppliers is a large automation vendor. Where Siemens or Rockwell appear in Havex retellings, secondary accounts tie them to network ports the scanner probed, not to any vendor breach. ICS-CERT's advice to vendors was to sign their code and make hashes available so customers can verify their downloads.6
Did Havex crash OPC servers or damage anything?
Not on any published record: the OPC crashes come from ICS-CERT's own testing, and no field incident has been published. The malware collected information about the machine, searched the local network for servers answering OPC, the protocol many plants use to pass process data between applications, and sent what it found home.3,4 The only record of crashes is one sentence:
"ICS-CERT testing has determined that the Havex payload has caused multiple common OPC platforms to intermittently crash."
The advisory adds that this could cause a denial of service effect on applications that rely on OPC.6 That is a finding about a tool, not a report of an event. Idaho National Laboratory's 2022 retrospective repeats it in the same terms: "ICS-CERT observed in testing that multiple OPC platforms crashed after a Havex infection."8 Neither document says where ICS-CERT's testing took place. No victim, vendor or agency has published a crash at a plant, and no published account describes Havex writing a value, changing logic or moving anything.
Was Havex a sabotage attack on the energy grid?
No. On the record it is an espionage and reconnaissance case; the sabotage language is a conditional. Symantec's headline on 30 June 2014 said Western energy companies were "under sabotage threat." The sentence underneath says the attackers compromised strategically important organizations:
"for spying purposes and, if they had used the sabotage capabilities open to them, could have caused damage or disruption to energy supplies in affected countries."
The capabilities were not used, on any published record. Dropping the conditional turns a spy story into a sabotage story.
How many organizations did Havex infect?
No public document says. The figure most often quoted, more than 17,000 unique devices, comes from the Justice Department's March 2022 announcement, and it is the conspirators' total "through these and other efforts, including spearphishing and 'watering hole' attacks."7 It is a prosecutors' total across every method, stated in an announcement about an indictment, which is an allegation. It is not a count of poisoned downloads.
The same release describes the devices in terms that no public document reconciles with the vendor analyses, which describe Havex running on Windows hosts.3,7 No public document says how many plants installed a poisoned package rather than being reached by phishing or a compromised website.
Who was behind Havex?
Three Russian FSB officers have been charged, and none has been tried. The public attribution arrived in three steps over eight years, and none is a verdict.
January 2014: CrowdStrike names Energetic Bear and says state sponsorship is "possible."1
20 July 2021: the ICS-CERT advisory is revised to say the US Government attributes the activity to "Russian nation-state cyber actors," seven years after first publication.6
24 March 2022: the Justice Department unseals an indictment, returned 26 August 2021 in the District of Kansas, charging Pavel Akulov, Mikhail Gavrilov and Marat Tyukov, officers of FSB Center 16, Military Unit 71330. An indictment is an allegation; the defendants have never been tried.7 CISA, the FBI and DOE published advisory AA22-083A the same day.12
CERT Polska reported in January 2026 that infrastructure behind the December 2025 attack on Polish distributed energy overlapped with the cluster researchers call Static Tundra, Berserk Bear and Dragonfly.13 The UK, together with EU member states, later attributed that attack to FSB Centre 16.14 An infrastructure overlap with a cluster is not proof of the same operators.
What is still not known about Havex
How the three vendor websites were breached, beyond eWON's notice that its site had been attacked.2
Which organizations were victims. None has come forward.
How many plants installed a poisoned package rather than being reached by phishing or a compromised website, and which vendor's package reached whom.
How many devices Havex itself reached. The 17,000 so often quoted is a prosecutors' total across every method.7
Whether Havex crashed an OPC server anywhere outside ICS-CERT's own testing.6
Whether MB Connect Line or MESA Imaging published their own statements.
Who did it, as a matter of proof. The attribution rests on an indictment never tested in court.7
Claims about Havex the record does not support
Widely repeated claim
What the record says
"Havex crashed OPC servers at plants."
The only record is ICS-CERT's testing, a laboratory observation about the tool. No field crash has been published.6,8
"Havex was a sabotage attack on Western energy companies."
Symantec's own sentence is conditional: damage was possible "if they had used" capabilities they did not use. The case is espionage and reconnaissance.5
"Havex infected 17,000 devices."
The Justice Department's figure is the total "through these and other efforts," including spearphishing and watering holes, in an announcement about an indictment.7
BlastWave analysis: reading the plant, not operating it
Analysis, not a disclosed fact
Havex is the case where the trusted place was the target. Customers who did the responsible thing, fetching software from the vendor rather than from a mirror, installed a remote access trojan along with it. What the trojan did is modest, and the record should stay modest about it: on the consequence ladder this is OT-adjacent access and capability development. Nothing needed a fallback, because nothing stopped. What was lost was knowledge, and learning a plant is the expensive step in any attack on a process. Here it was paid for through the one channel plants are told to trust.
A signature on the download helps. The fix is architecture: a control network with no route out, remote access that is not a standing client with saved passwords, and process data read one way. The same cluster resurfaces a decade later in the Poland distributed energy record as an infrastructure overlap.13 Reading Havex as the start of that arc is BlastWave's analysis, not a disclosed finding.
Podcast: “The Foil Seal” (9:24). Joe Baxter and Cam Cullen on why a signature on the download is hygiene, and the architecture is what a poisoned installer can reach.
Video: Havex Short (60 to 90 seconds).
Frequently asked questions
What was the Havex malware?
Havex was a remote access trojan used in a cyber espionage campaign researchers call Dragonfly or Energetic Bear. In 2013 and 2014, installers on three small European industrial software suppliers' websites were swapped for copies carrying remote access trojans, Havex the main one. F-Secure reported in June 2014 that it collected host information, scanned local networks for OPC servers and sent what it found home. No published record shows it changing a physical process.
Which companies had their software installers trojanized by Havex?
Researchers identified the three suppliers from samples: eWON of Belgium, MB Connect Line of Germany and MESA Imaging of Switzerland, named by Netresec in October 2014. None of the June 2014 reports named them. eWON published its own notice in January 2014 that its website had been attacked, shipped a cleaned installer and reset customer passwords. Netresec found MESA Imaging's installer dropped a different trojan, Sysmain.
Did Havex crash OPC servers at industrial plants?
Not on any published record. ICS-CERT's advisory of June 2014 said its own testing found the Havex payload caused multiple common OPC platforms to intermittently crash. That is a laboratory finding about the tool. Idaho National Laboratory's 2022 retrospective repeats that the crashes were observed in testing. No victim, vendor or agency has published a crash at a plant.
Was Havex a sabotage attack on the power grid?
No published record shows sabotage. Symantec's 30 June 2014 report was headlined as a sabotage threat, but its own sentence says the attackers compromised organizations for spying purposes and, if they had used the sabotage capabilities open to them, could have caused damage or disruption to energy supplies. That conditional matters: the capabilities were not used on any published record.
Who was behind the Havex campaign?
In March 2022 the Justice Department unsealed an indictment, returned in August 2021 in Kansas, charging three officers of the FSB's Center 16, Pavel Akulov, Mikhail Gavrilov and Marat Tyukov. An indictment is an allegation and none has been tried. ICS-CERT revised its advisory in July 2021 to attribute the activity to Russian nation-state cyber actors; CrowdStrike called state sponsorship possible in January 2014.
Did Havex infect 17,000 devices?
That figure is not a Havex count. The Justice Department said in March 2022 that the conspirators installed malware on more than 17,000 unique devices through these and other efforts, including spearphishing and watering hole attacks. It is a prosecutors' total across every method, stated in an announcement about an indictment. No public document says how many organizations installed a poisoned package.
Is Havex connected to the 2025 cyberattack on Poland's energy sector?
CERT Polska reported in January 2026 that infrastructure behind the December 2025 attacks on Polish energy overlapped with the cluster researchers call Static Tundra, Berserk Bear and Dragonfly, and the UK and EU member states later attributed that attack to FSB Centre 16. An infrastructure overlap is not proof of the same operators. Reading Havex as the start of that arc is BlastWave's analysis, not a disclosed finding.
Primary sources are US government advisories and charging announcements, a national laboratory report, a vendor's own notice, and responders' and researchers' own dated publications. Press is cited only as evidence of what was said.
PressSecurityWeek, account of CrowdStrike's Global Threat Report 2013, 22 January 2014. Cited as evidence of what CrowdStrike said (Energetic Bear, active since at least August 2012; state sponsorship "possible").
CompanyeWON, "Talk2M Incident Report," undated web notice announcing a forced upgrade email of 30 January. The year, 2014, rests on the SCADAhacker reference chronology.
ResearcherF-Secure, "Havex Hunts For ICS/SCADA Systems," 23 June 2014, and F-Secure's threat description Backdoor:W32/Havex. The original post is cited through the threat description and contemporaneous reporting. f-secure.com
PressComputerworld, report on F-Secure's Havex findings, 24 June 2014. Cited as evidence of what F-Secure said.
ResearcherSymantec Security Response, "Dragonfly: Western Energy Companies Under Sabotage Threat," 30 June 2014. The three suppliers described, 250 downloads, availability windows, the conditional damage sentence. security.com
FederalICS-CERT, Advisory ICSA-14-178-01, "ICS Focused Malware," original release 27 June 2014, updated 20 July 2021. Carries the three-vector sentence, the OPC testing sentence, the vendor guidance on code signing and hashes, and the 2021 attribution update. cisa.gov
FederalUS Department of Justice, "Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide," 24 March 2022 (indictment returned 26 August 2021, District of Kansas). justice.gov
FederalIdaho National Laboratory, INL/RPT-22-69481, "Precursor Analysis Report: Havex Malware in a U.S. Manufacturing Facility 2014" (CyOTE), 30 June 2022. PDF
ResearcherSymantec Security Response, "Dragonfly: Cyberespionage Attacks Against Energy Suppliers," whitepaper, version 1.21, 7 July 2014. Spam campaign from February 2013, watering holes, exploit kits.
FederalICS-CERT, Alert ICS-ALERT-14-176-02A, "ICS Focused Malware (Update A)," 25 June 2014. Cited for its title and date only. cisa.gov
ResearcherNetresec (Erik Hjelmvik), "Full Disclosure of Havex Trojans," 27 October 2014. Names MESA Imaging, eWON and MB Connect Line, with installer file names. netresec.com
FederalCISA, FBI and DOE, Joint Cybersecurity Advisory AA22-083A, 24 March 2022. Date and co-authors read through the American Hospital Association's verbatim republication; not quoted here. PDF · Republication (aha.org)
GovernmentCERT Polska, incident report on the 29 December 2025 attacks on the Polish energy sector, 30 January 2026. Cited for the infrastructure overlap with the cluster researchers call Static Tundra, Berserk Bear and Dragonfly. cert.pl
GovernmentUK National Cyber Security Centre, "UK and Allies urge critical sectors to improve defences against Russian intelligence targeting." Cited for the UK and EU attribution of the December 2025 Poland attack. ncsc.gov.uk
Cite this page
BlastWave. “Havex / Dragonfly Cyber Espionage Campaign (2014): What Is Verified.” Hackopedia, Volume 2, FILE 047. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/havex-2014/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 047 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check at source: confirmed the original release dates of ICS-CERT advisory ICSA-14-178-01 (27 June 2014) and alert ICS-ALERT-14-176-02A (25 June 2014). Consistency check against the Poland distributed energy, Kaseya VSA and Target entries.
26 Sep 2026
Full validation against primary sources: the indictment and its dates, the ICS-CERT advisory's vectors, testing sentence and 2021 attribution, Symantec's figures and conditional sentence, the supplier identifications, eWON's notice, the CERT Polska overlap and the UK attribution. Supplier product descriptions and attribution wording aligned to the sources.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
