ENERGETIC_BEAR__2014__Kaspersky_Lab_crouching_yeti_appendixes_eng_final.pdf

Kaspersky GRUAT 'Crouching Yeti — Appendixes' is an extensive technical intelligence report on a sophisticated cyber-espionage campaign (Havex/Yeti) that targeted industrial, energy, academic and government organizations. It contains in-depth static/dynamic analysis of multiple loaders/backdoors (Havex, Sysmain, Ddex, ClientX, Karagany), delivery methods including hijacked installers and web exploit chains (Java, IE, Adobe), C2/backend behavior, cryptography and log formats, hundreds of IoCs (hashes, domains, registry keys, mutexes), and a catalog of ~101 identified victims — demonstrating large scale, targeted, and operationally mature activity against ICS/SCADA and related sectors.