An analytical deep-dive published by Pylos examines why Energetic Bear — also tracked as Dragonfly, Crouching Yeti, Berserk Bear, ALLANITE, DYMALLOY, and Iron Liberty — remains one of the most consequential yet least-discussed Russian cyber threat actors targeting critical infrastructure, despite over a decade of successful intrusions into electric utility and oil and gas environments, including confirmed access to operational technology (OT) and control systems.
Why Energetic Bear Flies Below the Radar
Unlike GRU-linked actors such as Sandworm (Unit 74455) and APT28 (Unit 26165) — which have attracted extensive government disclosures, DOJ indictments, and international sanctions in response to disruptive operations including the 2015–2016 Ukraine power incidents, NotPetya, and 2016 U.S. election interference — Energetic Bear has produced no known deliberate disruptions. This absence of observable impact, combined with the group's inconsistent naming across vendors and analytical clusters that have variously merged and separated over time, has kept it out of headline-grabbing government actions despite sustained, high-value intrusion activity spanning more than ten years.
Significant Operational Achievements
The group's actual record is formidable. Energetic Bear developed ICS-aware modules for the Havex malware — one of only a handful of industrial control system-specific malware variants ever documented. The group successfully breached multiple electric utility environments from 2017 through the period of the analysis, with isolated instances of control system access achieved. It has also deployed sophisticated intrusion mechanisms including network device manipulation for traffic shaping and capture to support campaign objectives — techniques that place it firmly among the top tier of global threat actors, regardless of its lower public profile.
Attribution: Not the GRU — Likely FSB or SVR
The analysis takes a systematic approach to attribution. The extensive catalog of U.S. and UK government indictments, disclosures, and sanctions targeting Russian actors since 2016 conspicuously excludes Energetic Bear from any GRU-linked entity — including the comprehensive inventories of GRU Unit 74455 and Unit 26165 activity. This absence allows a confident negative assertion: Energetic Bear is not the GRU. That narrows the field to Russia's civilian intelligence services — the FSB and SVR — whose operations characteristically focus on persistent access development and intelligence collection without producing discrete, observable disruptive events. APT29 (Cozy Bear), assessed with FSB/SVR links, similarly avoided indictment for 2016 election interference activities precisely because its operations did not cross into active measures with disruptive effects.
Strategic Implications for Defenders
The distinction between GRU-linked and FSB/SVR-linked actors carries significant operational implications for critical infrastructure defenders. GRU operations — particularly those associated with Sandworm — have demonstrated a pattern of rapid transition from access to disruptive effect, demanding immediate remediation when detected. Energetic Bear's FSB/SVR alignment, by contrast, suggests its intrusions are oriented toward long-term operational preparation of the environment (OPE): building access, mapping systems, and positioning for potential future weaponization in the event of escalating hostilities — rather than near-term disruption. This assessment suggests defenders who detect Energetic Bear activity may have time to monitor, understand, and mount a deliberate comprehensive response rather than requiring immediate emergency remediation — though the group's decade-long record of control system access makes it a threat that cannot be dismissed simply because no disruption has yet materialized.