Energetic Bear, 3 Minute Profile

Energetic Bear, primarily employs two exploit kits (LightOut and Hello) and two malware (Trojan.Karagany and Backdoor.Oldrea). The exploit kits are used to initially compromise the system and install the malware. The malware is used for espionage, persistent access, or sabotage. LightsOut exploits vulnerabilities in Java or in Microsoft Internet Explorer to deploy the Karagany or Oldrea malware onto a user’s system. In September 2013, the Hello exploit kit replaced the LightsOut kit. The Hello kit is combined with watering hole attacks to redirect victims to a landing page, where a JavaScript fingerprints their system to determine details such as operating system, browser, and installed plugins. The victim is then redirected to the site that contains the exploit most likely to achieve the adversaries’ goals. Havex, havex malware

crowdstrike