Dragonfly
- ID
- G0035
- Associated names
- TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
Techniques used (56)
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1033 System Owner/User Discovery
- T1036.010 Masquerade Account Name
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1069.002 Domain Groups
- T1070.004 File Deletion
- T1071.002 File Transfer Protocols
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1098.007 Additional Local or Domain Groups
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1110.002 Password Cracking
- T1112 Modify Registry
- T1113 Screen Capture
- T1114.002 Remote Email Collection
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1187 Forced Authentication
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1221 Template Injection
- T1505.003 Web Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1560 Archive Collected Data
- T1564.002 Hidden Users
- T1566.001 Spearphishing Attachment
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1584.004 Server
- T1588.002 Tool
- T1591.002 Business Relationships
- T1595.002 Vulnerability Scanning
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1608.004 Drive-by Target
- T1685.005 Clear Windows Event Logs
- T1686 Disable or Modify System Firewall
Software used (10)
- S0002 Mimikatz
- S0029 PsExec
- S0039 Net
- S0075 Reg
- S0093 Backdoor.Oldrea
- S0094 Trojan.Karagany
- S0108 netsh
- S0357 Impacket
- S0488 CrackMapExec
- S0500 MCMD
References
- DOJ Russia Targeting Critical Infrastructure March 2022
- UK GOV FSB Factsheet April 2022
- Symantec Dragonfly
- Secureworks IRON LIBERTY July 2019
- Symantec Dragonfly Sept 2017
- Fortune Dragonfly 2.0 Sept 2017
- Gigamon Berserk Bear October 2021
- CISA AA20-296A Berserk Bear December 2020
- Symantec Dragonfly 2.0 October 2017