Backdoor.Oldrea

Executive Summary

Backdoor.Oldrea is a modular backdoor used by Dragonfly to target energy companies, distributed via supply chain compromise and including ICS-specific modules. The malware enables persistent access, data exfiltration, and command execution on compromised Windows systems. Its specialized modules pose a significant threat to energy sector security and integrity.

Backdoor.Oldrea, also known as Havex, is a sophisticated modular backdoor malware primarily used by the Dragonfly threat actor group to target energy companies since at least 2013. The malware's primary function is to establish a persistent backdoor on compromised Windows systems, enabling the attackers to execute commands, exfiltrate sensitive data, and install additional malicious modules. Notably, Backdoor.Oldrea was distributed via supply chain compromise, exploiting vulnerabilities in software used by the targeted energy sector. The malware includes specialized modules designed to enumerate and map Industrial Control Systems (ICS)-specific systems, processes, and protocols, demonstrating a tailored approach to disrupt and gather intelligence on critical infrastructure. This targeted approach highlights the significant threat posed by Backdoor.Oldrea to the security and integrity of energy sector operations.

Key Capabilities

• Establishes a persistent backdoor on compromised systems
• Exfiltrates sensitive data
• Executes commands remotely
• Includes ICS-specific modules for enumeration and mapping
• Spreads via supply chain compromise

ATT&CK Techniques

Recommended Actions

• Implement robust supply chain risk management practices
• Conduct regular vulnerability assessments and patching
• Deploy endpoint detection and response tools
• Monitor network traffic for suspicious activity
• Enforce least privilege access and network segmentation

Suggested Tags