The Energetic Bear APT group

Energetaic Bear (aka Crouching Yeti) is an APT group believed to be operating since at least 2011.  They managed to compromise a number of strategically important organizations for spying purposes and could have caused damage or disruption to energy supplies in affected countries.  The two primary tools the group uses are Remote Access Trojans (RAT) named Backdoor.Oldrea and Trojan.Karagany.

The group initially targeted defense and aviation companies in the US and Canada before shifting its focus mainly to US and European energy firms in early 2013.  Among the targets of were energy grid operators, major electricity generation firms, petroleum pipeline operators, and Energy industry industrial control system (ICS) equipment manufacturers. The majority of the victims were located in the United States, Spain, France, Italy, Germany, Turkey, and Poland.