EB - Yeti July 2014 - Public.docx

Energetic Bear / Crouching Yeti is an advanced persistent threat actor active since at least 2010 that conducted large-scale surveillance campaigns against industrial, manufacturing, energy and related sectors using spearphishing, trojanized legitimate installers and waterholing (LightsOut EK). The actor deployed multiple Windows malware families (notably Havex) to harvest credentials, enumerate OPC/SCADA systems, and exfiltrate encrypted data to PHP-based C2s hosted on compromised websites, infecting roughly 2,800+ victims worldwide and demonstrating persistent, targeted operations.