Full Disclosure of Havex Trojans - NETRESEC Blog

This report discloses investigation results into the Havex backdoor (used by the Dragonfly/Energetic Bear APT), documenting multiple instances where legitimate ICS vendor installers (MESA Imaging, eWON, MB Connect Line) were trojanized; it includes product names, filenames, MD5/SHA256 hashes, exposure windows, and concludes the actor focused on European industrial control system suppliers through supply‑chain compromise.