Netskope Threat Labs

Backdoor.Oldrea

ATP Sandbox Adv. Heuristics

Description

Backdoor.Oldrea is a modular backdoor that the Dragonfly intrusion set used against energy companies since at least 2013, distributed through a supply chain compromise. It included specialized modules that enumerated and mapped industrial control systems, processes, and protocols on victim networks.

Stats

First seen
March 2022
Last seen
October 2026

MITRE ATT&CK techniques

16 techniques across 6 tactics.

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0006 Credential Access

  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1033System Owner/User Discovery
  • T1046Network Service Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1087Account Discovery

TA0009 Collection

  • T1560Archive Collected Data

TA0011 Command and Control

Associated groups

Alert name variants

Alert Name
Document-HTML.Trojan.Havex
Win32.Backdoor.Havex
Win32.Spyware.Havex
Win32.Trojan.Havex

Related families

QakBotTrickBotKONNIZebrocyEmpire

References