Threat intelligence / Group

Dragonfly

[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

67 recorded

Relationships

revoked-by

from Dragonfly 2.0

Group

uses

to Additional Local or Domain Groups

Technique

uses

to Archive Collected Data

Technique

uses

to Backdoor.Oldrea

Malware

uses

to Brute Force

Technique

uses

to Business Relationships

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Compromise Software Supply Chain

Technique

uses

to CrackMapExec

Tool

uses

to Data from Local System

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to Domains

Technique

uses

to Drive-by Compromise

Technique

uses

to Drive-by Target

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Forced Authentication

Technique

uses

to Hidden Users

Technique

uses

to Impacket

Tool

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to LSA Secrets

Technique

uses

to Malicious File

Technique

uses

to Masquerade Account Name

Technique

uses

to MCMD

Tool

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to Net

Tool

uses

to netsh

Tool

uses

to Network Share Discovery

Technique

uses

to NTDS

Technique

uses

to Password Cracking

Technique

uses

to PowerShell

Technique

uses

to PsExec

Tool

uses

to Python

Technique

uses

to Query Registry

Technique

uses

to Reg

Tool

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote Email Collection

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Security Account Manager

Technique

uses

to Server

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Template Injection

Technique

uses

to Tool

Technique

uses

to Trojan.Karagany

Malware

uses

to Valid Accounts

Technique

uses

to Virtual Private Server

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Shell

Technique

uses

to Windows Command Shell

Technique

25 external

References

mitre-attack

G0035

open

DYMALLOY

—

Berserk Bear

—

TEMP.Isotope

—

Ghost Blizzard

—

BROMINE

—

Crouching Yeti

—

IRON LIBERTY

—

TG-4192

—

Dragonfly

—

Energetic Bear

—

CISA AA20-296A Berserk Bear December 2020

https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions

open

DOJ Russia Targeting Critical Infrastructure March 2022

https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical

open

Dragos DYMALLOY

https://www.dragos.com/threat/dymalloy/

open

Fortune Dragonfly 2.0 Sept 2017

http://fortune.com/2017/09/06/hack-energy-grid-symantec/

open

Mandiant Ukraine Cyber Threats January 2022

https://www.mandiant.com/resources/ukraine-crisis-cyber-threats

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Secureworks MCMD July 2019

https://www.secureworks.com/research/mcmd-malware-analysis

open

Secureworks IRON LIBERTY July 2019

https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector

open

Secureworks Karagany July 2019

https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector

open

Gigamon Berserk Bear October 2021

https://vblocalhost.com/uploads/VB2021-Slowik.pdf

open

Symantec Dragonfly Sept 2017

https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers

open

Symantec Dragonfly

https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments

open

Symantec Dragonfly 2.0 October 2017

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks

open

UK GOV FSB Factsheet April 2022

https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet

open