Trojan.Karagany — Malware Profile

Trojan.Karagany is a modular remote access tool used for recon and linked to Dragonfly. The source code for Trojan.Karagany originated from Dream Loader malware which was leaked in 2010 and sold on underground forums.

MITRE ATT&CK techniques (22)

• T1003 OS Credential Dumping
• T1010 Application Window Discovery
• T1016 System Network Configuration Discovery
• T1027 Obfuscated Files or Information
• T1027.002 Software Packing
• T1033 System Owner/User Discovery
• T1049 System Network Connections Discovery
• T1055.003 Thread Execution Hijacking
• T1056.001 Keylogging
• T1057 Process Discovery
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1074.001 Local Data Staging
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1113 Screen Capture
• T1497.001 System Checks
• T1547.001 Registry Run Keys / Startup Folder
• T1555.003 Credentials from Web Browsers
• T1573.002 Asymmetric Cryptography

IntelFusions coverage

• Dragonfly 2.0: Sophisticated Energy Sector Threat Group Returns with Sabotage-Ready Access to Operational Systems 2026-02-16

Attributed threat actors

• Dragonfly

Read the full analysis on IntelFusions