New Havex malware variants target industrial control system and SCADA users
A malware threat previously used in attacks against energy sector companies is now being aimed at organizations that use or develop industrial applications and machines.
The attackers modified the legitimate software installers to drop and execute an additional file on computers. The file is called mbcheck.dll and is actually the Havex malware.
The new distribution technique was used in addition to more traditional attacks like spam emails and Web-based exploits, and indicates that those behind the operation are specifically interested in targeting organizations that use ICS and SCADA (supervisory control and data acquisition) applications.
That conclusion is also supported by the existence of a new malicious Havex component whose purpose is to scan local area networks for devices that respond to OPC (Open Platform Communications) requests. OPC is a communications standard that allows interaction between Windows-based SCADA applications and process control hardware.
FireEye recently analyzed the capabilities of a variant of Havex (referred to by FireEye as “Fertger” or “PEACEPIPE”), the first publicized malware reported to actively scan OPC servers used for controlling SCADA (Supervisory Control and Data Acquisition) devices in critical infrastructure (e.g., water and electric utilities), energy, and manufacturing sectors.
While Havex itself is a somewhat simple PHP Remote Access Trojan (RAT) that has been analyzed by other sources, none of these have covered the scanning functionality that could impact SCADA devices and other industrial control systems (ICS). Specifically, this Havex variant targets servers involved in OPC (Object linking and embedding for Process Control) communication, a client/server technology widely used in process control systems (for example, to control water pumps, turbines, tanks, etc.).
Note: ICS is a general term that encompasses SCADA (Supervisory Control and Data Acquisition) systems, DCS (Distributed Control Systems), and other control system environments. The term SCADA is well-known to wider audiences, and throughout this article, ICS and SCADA will be used interchangeably.