Dragonfly has used batch scripts to enumerate users on a victim domain controller.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.002|Tool|

Dragonfly has obtained and used tools such as

Mimikatz,

CrackMapExec, and

PsExec.(Citation: Secureworks IRON LIBERTY July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.(Citation: Secureworks IRON LIBERTY July 2019)(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

Dragonfly utilized watering hole attacks on energy sector websites by injecting a redirect iframe to deliver

Backdoor.Oldrea or

Trojan.Karagany. (Citation: Symantec Security Response July 2014)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0862|Supply Chain Compromise|

Dragonfly trojanized legitimate ICS equipment providers software packages available for download on their websites.(Citation: Symantec Security Response July 2014)|