Dragonfly - G0035

Created: 2017-05-31T21:32:05.217Z

Modified: 2023-03-08T22:03:28.170Z

Contributors: Dragos Threat Intelligence

Aliases

Dragonfly,TEMP.Isotope,DYMALLOY,Berserk Bear,TG-4192,Crouching Yeti,IRON LIBERTY,Energetic Bear

Description

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

Techniques Used

Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

Dragonfly has registered domains for targeting intended victims.(Citation: CISA AA20-296A Berserk Bear December 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1595.002|Vulnerability Scanning|