Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

Dragonfly has attempted to brute force credentials to gain access.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.003|Virtual Private Server|

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1584.004|Server|

Dragonfly has compromised legitimate websites to host C2 and malware modules.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1591.002|Business Relationships|

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1608.004|Drive-by Target|