Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.12 Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.3456789
- DOJ Russia Targeting Critical Infrastructure March 2022
- UK GOV FSB Factsheet April 2022
- Symantec Dragonfly
- Secureworks IRON LIBERTY July 2019
- Symantec Dragonfly Sept 2017
- Fortune Dragonfly 2.0 Sept 2017
- Gigamon Berserk Bear October 2021
- CISA AA20-296A Berserk Bear December 2020
- Symantec Dragonfly 2.0 October 2017
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1187 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1033 | System Owner/User Discovery | — |
| T1036.010 | Masquerade Account Name | — |
| T1053.005 | Scheduled Task | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.006 | Python | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071.002 | File Transfer Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1110.002 | Password Cracking | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1114.002 | Remote Email Collection | — |
| T1133 | External Remote Services | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1187 | Forced Authentication | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1221 | Template Injection | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560 | Archive Collected Data | — |
| T1564.002 | Hidden Users | — |
| T1566.001 | Spearphishing Attachment | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1584.004 | Server | — |
| T1588.002 | Tool | — |
| T1591.002 | Business Relationships | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.002 | Spearphishing Attachment | — |
| T1598.003 | Spearphishing Link | — |
| T1608.004 | Drive-by Target | — |
| T1685.005 | Clear Windows Event Logs | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
Berserk Bear · BROMINE · Crouching Yeti · Dragonfly · DYMALLOY · Energetic Bear · Ghost Blizzard · IRON LIBERTY · TEMP.Isotope · TG-4192
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.