Dragonfly has copied and installed tools for operations once in the victim environment.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1112|Modify Registry|

Dragonfly has modified the Registry to perform multiple techniques through the use of

Reg.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1564.002|Hidden Users|

Dragonfly has modified the Registry to hide created user accounts.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Dragonfly has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1187|Forced Authentication|

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|