ENERGETIC_BEAR__2014__Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf

Symantec details the Dragonfly (aka Energetic Bear) campaign targeting energy companies and ICS suppliers from 2011–2014 using spear-phishing, watering-hole redirects to the Lightsout/Hello exploit kit, and trojanized software updates to deliver Backdoor.Oldrea (Havex) and Trojan.Karagany, enabling data exfiltration, reconnaissance, and providing capabilities that could enable sabotage of energy infrastructure.