- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- State-sponsored, FSB Centre 16L: Radio-Electronic Intelligence on Communications Facilities, Post Number 71330
- Agency named
- FSB
- Motivation
- Espionage; Sabotage and destruction
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0035 · 58 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0083 · dragonfly
RussiaWhat it is
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Berserk Bear, Energetic Bear
- IBM X-Force
- ITG15
- Mandiant
- TEMP.Isotope
- Microsoft
- Ghost Blizzard
- MITRE ATT&CK
- G0035
- PwC
- Blue Kraken
- Secureworks
- IRON LIBERTY, TG-4192
- Talos and others
- Group 24
- Thales
- ATK6
- Other names
- Dragonfly 2.0, ALLANITE, ATK 6, Berserk Bear, Dragonfly 2.0, BROMINE, CASTLE, Crouching Yeti, DYMALLOY, Electrum, Energetic Bear, Dragonfly, Havex, Koala Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Azerbaijan, Belgium, Canada, China, France, Germany, Greece, Ireland, Italy, Japan, Norway, Poland, Romania, Russia, Serbia, Singapore, Spain, Switzerland, Türkiye, Ukraine, United Kingdom, United States
- Sectors
- Aviation, Construction, Defense, Education, Energy, Government, Industrial, IT, Manufacturing, Oil and gas, Pharmaceutical, Private sector
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- CrackMapExec
- Impacket
- MCMD
- Mimikatz
- Net
- PsExec
- Reg
- Trojan.Karagany
- UNITEDRAKE
- netsh
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de