Dragonfly — APT Profile
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE, ENERGETIC BEAR, ALLANITE, ATK6, BERSERK BEAR, Blue Kraken, CASTLE, G0035, Group 24, Havex, ITG15, Koala Team, Palmetto Fusion, Static Tundra
IntelFusions coverage (3)
- Russia's FSB is hijacking weakly secured routers, 12 nations warn 2026-07-13 · Nation-State
- The Enigmatic Energetic Bear: Russia's Most Successful Critical Infrastructure Intruder You've Never Heard Of 2026-02-16 · Nation-State
- Dragonfly 2.0: Sophisticated Energy Sector Threat Group Returns with Sabotage-Ready Access to Operational Systems 2026-02-16 · Nation-State
Tools & malware
- Backdoor.Oldrea ICS Backdoor
- CrackMapExec Network Toolkit
- Impacket Network Toolkit
- MCMD Exploitation Tool
- Mimikatz Credential Harvesting
- Net Network Reconnaissance
- netsh LOLBin
- PsExec Remote Execution
- Reg LOLBin
- Trojan.Karagany Remote Access Trojan
Vendor research
- Anticipating Cyber Threats as the Ukraine Crisis Escalates Hultquist, J
- How Microsoft names threat actors Microsoft
- MCMD Malware Analysis Secureworks
- Resurgent Iron Liberty Targeting Energy Sector Secureworks
- Updated Karagany Malware Targets Energy Sector Secureworks
- Dragonfly: Western energy sector targeted by sophisticated attack group Symantec
- Dragonfly: Cyberespionage Attacks Against Energy Suppliers Symantec
- Dragonfly: Western energy sector targeted by sophisticated attack group Symantec
- Russia's FSB malign activity: factsheet UK GOV
- MCMD Malware Analysis Secureworks
- Resurgent Iron Liberty Targeting Energy Sector Secureworks
- Updated Karagany Malware Targets Energy Sector Secureworks
- Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets CISA AA
- Anticipating Cyber Threats as the Ukraine Crisis Escalates Mandiant
- Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide DOJ
- Dragos. (n.d.). DYMALLOY Dragos
- Hackers Have Penetrated Energy Grid, Symantec Warns Fortune
- THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE Gigamon
Countries linked to this actor
- Poland targets