Dragonfly — APT Profile
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.Also tracked as
TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE, ENERGETIC BEAR, ALLANITE, ATK6, BERSERK BEAR, Blue Kraken, CASTLE, G0035, Group 24, Havex, ITG15, Koala Team
Tools & malware
- Backdoor.Oldrea ICS Backdoor
- CrackMapExec Network Toolkit
- Impacket Network Toolkit
- MCMD Exploitation Tool
- Mimikatz Credential Harvesting
- Net Network Reconnaissance
- netsh LOLBin
- PsExec Remote Execution
- Reg LOLBin
- Trojan.Karagany Remote Access Trojan
Vendor research
- Updated Karagany Malware Targets Energy Sector Secureworks
- How Microsoft names threat actors Microsoft
- MCMD Malware Analysis Secureworks
- Resurgent Iron Liberty Targeting Energy Sector Secureworks
- Anticipating Cyber Threats as the Ukraine Crisis Escalates Mandiant
- THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE Gigamon
- Dragonfly: Western energy sector targeted by sophisticated attack group Symantec
- Dragonfly: Cyberespionage Attacks Against Energy Suppliers Symantec
- Dragonfly: Western energy sector targeted by sophisticated attack group Symantec
- Russia's FSB malign activity: factsheet UK GOV
- MCMD Malware Analysis Secureworks
- Resurgent Iron Liberty Targeting Energy Sector Secureworks
- Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets CISA AA
- Updated Karagany Malware Targets Energy Sector Secureworks
- Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide DOJ
- Dragos. (n.d.). DYMALLOY Dragos
- Hackers Have Penetrated Energy Grid, Symantec Warns Fortune