MITRE ATT&CKgroup
G0035 Dragonfly
- Domain
- enterprise, ics
- Aliases
- TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE
- Version
- 4.0
- Created
- 2017-05-31
Description
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
Related
Uses · MITRE ATT&CK (68)
- T1685.005 Clear Windows Event Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1036.010 Masquerade Account Name sub-technique
- T1098.007 Additional Local or Domain Groups sub-technique
- T1608.004 Drive-by Target sub-technique
- T1591.002 Business Relationships sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1598.002 Spearphishing Attachment sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1584.004 Server sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- S0500 MCMD software (tool)
- S0488 CrackMapExec software (tool)
- T0817 Drive-by Compromise technique
- T0862 Supply Chain Compromise technique
- T1071.002 File Transfer Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1564.002 Hidden Users sub-technique
- T1195.002 Compromise Software Supply Chain sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.006 Python sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1003.004 LSA Secrets sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.002 Domain Account sub-technique
- T1560 Archive Collected Data technique
References
- https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions CISA AA20-296A Berserk Bear December 2020
- https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical DOJ Russia Targeting Critical Infrastructure March 2022
- https://www.dragos.com/threat/dymalloy/ Dragos DYMALLOY
- http://fortune.com/2017/09/06/hack-energy-grid-symantec/ Fortune Dragonfly 2.0 Sept 2017
- https://www.mandiant.com/resources/ukraine-crisis-cyber-threats Mandiant Ukraine Cyber Threats January 2022
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.secureworks.com/research/mcmd-malware-analysis Secureworks MCMD July 2019
- https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector Secureworks IRON LIBERTY July 2019
- https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector Secureworks Karagany July 2019
- https://vblocalhost.com/uploads/VB2021-Slowik.pdf Gigamon Berserk Bear October 2021
- https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers Symantec Dragonfly Sept 2017
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments Symantec Dragonfly
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks Symantec Dragonfly 2.0 October 2017
- https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet UK GOV FSB Factsheet April 2022