Dragonfly Havex ICS vendor compromises

Dragonfly, also tracked as Energetic Bear, turned industrial software distribution into an espionage path. During the Havex phase, the operators compromised ICS and SCADA vendor sites and made trusted downloads carry remote-access malware.

The vendor compromises were not interchangeable. MESA Imaging supplied industrial camera software, eWON supplied remote-access tooling, and MB Connect Line supplied router and maintenance utilities. Each download looked like legitimate support software for engineers working near operational environments.

Havex gave the operators remote access and reconnaissance capability, including an OPC-scanning component used to look for industrial control systems after infection. That made the trojanized installer more than a foothold; it was a way to map what kind of plant or energy environment the victim might be connected to.

The campaign matters because each vendor served a different operational niche, but the actor, malware family, infrastructure, and industrial targeting were shared. Vendor records remain separate so responders can search concrete products, versions, hashes, and download windows.