Automation · API / MCP 中文

Group profile · G0074

Dragonfly 2.0

Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. There is debate over the extent of overlap between Dragonfly 2.0 and Dragonfly, but there is sufficient evidence to lead to these being tracked as two separate groups.

ATT&CK G0074 Confidence High · 100 Source src_mitre_attck_enterprise Status active

Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. 1 2 There is debate over the extent of overlap between Dragonfly 2.0 and Dragonfly, but there is sufficient evidence to lead to these being tracked as two separate groups. 34

  1. US-CERT TA18-074A
  2. Symantec Dragonfly Sept 2017
  3. Fortune Dragonfly 2.0 Sept 2017
  4. Dragos DYMALLOY

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asDragonfly 2.0— → …100src_mitre_attck_enterprise
also_known_asIRON LIBERTY— → …100src_mitre_attck_enterprise
also_known_asDYMALLOY— → …100src_mitre_attck_enterprise
also_known_asBerserk Bear— → …100src_mitre_attck_enterprise

Technique use

No technique use yet; ATT&CK sync fills it by citation year.

Aliases

Berserk Bear · Dragonfly 2.0 · DYMALLOY · IRON LIBERTY

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections