Dragonfly

Active

Also known as: Dragonfly, TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE

🇷🇺

Russia

Active Since

2017

MITRE ID

G0035

Techniques

[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

MITRE ATT&CK Techniques

Recon4

T1591.002Business Relationships

T1598.002Spearphishing Attachment

T1598.003Spearphishing Link

T1595.002Vulnerability Scanning

Resource5

T1583.001Domains

T1608.004Drive-by Target

T1584.004Server

T1588.002Tool

T1583.003Virtual Private Server

Initial4

T1195.002Compromise Software Supply Chain

T1189Drive-by Compromise

T1190Exploit Public-Facing Application

T1566.001Spearphishing Attachment

Exec7

T1059Command and Scripting Interpreter

T1203Exploitation for Client Execution

T1204.002Malicious File

T1059.001PowerShell

T1059.006Python

T1053.005Scheduled Task

T1059.003Windows Command Shell

Persist5

T1098.007Additional Local or Domain Groups

T1133External Remote Services

T1136.001Local Account

T1547.001Registry Run Keys / Startup Folder

T1505.003Web Shell

PrivEsc0

Defense8

T1070.001Clear Windows Event Logs

T1562.004Disable or Modify System Firewall

T1070.004File Deletion

T1564.002Hidden Users

T1036.010Masquerade Account Name

T1112Modify Registry

T1221Template Injection

T1078Valid Accounts

Creds6

T1110Brute Force

T1187Forced Authentication

T1003.004LSA Secrets

T1003.003NTDS

T1110.002Password Cracking

T1003.002Security Account Manager

Discovery8

T1087.002Domain Account

T1069.002Domain Groups

T1083File and Directory Discovery

T1135Network Share Discovery

T1012Query Registry

T1018Remote System Discovery

T1016System Network Configuration Discovery

T1033System Owner/User Discovery

Lateral2

T1210Exploitation of Remote Services

T1021.001Remote Desktop Protocol

Collect5

T1560Archive Collected Data

T1005Data from Local System

T1074.001Local Data Staging

T1114.002Remote Email Collection

T1113Screen Capture

C22

T1071.002File Transfer Protocols

T1105Ingress Tool Transfer

Exfil0

Impact0

Known Victims

live · just now

No victims recorded in ransomware.live for this group.