Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.12 Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.3456789
- DOJ Russia Targeting Critical Infrastructure March 2022
- UK GOV FSB Factsheet April 2022
- Symantec Dragonfly
- Secureworks IRON LIBERTY July 2019
- Symantec Dragonfly Sept 2017
- Fortune Dragonfly 2.0 Sept 2017
- Gigamon Berserk Bear October 2021
- CISA AA20-296A Berserk Bear December 2020
- Symantec Dragonfly 2.0 October 2017
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Dragonfly | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TEMP.Isotope | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DYMALLOY | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Berserk Bear | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TG-4192 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Crouching Yeti | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | IRON LIBERTY | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Energetic Bear | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Ghost Blizzard | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BROMINE | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1187 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1033 | System Owner/User Discovery | — |
| T1036.010 | Masquerade Account Name | — |
| T1053.005 | Scheduled Task | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.006 | Python | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071.002 | File Transfer Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1110.002 | Password Cracking | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1114.002 | Remote Email Collection | — |
| T1133 | External Remote Services | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1187 | Forced Authentication | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1221 | Template Injection | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560 | Archive Collected Data | — |
| T1564.002 | Hidden Users | — |
| T1566.001 | Spearphishing Attachment | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1584.004 | Server | — |
| T1588.002 | Tool | — |
| T1591.002 | Business Relationships | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.002 | Spearphishing Attachment | — |
| T1598.003 | Spearphishing Link | — |
| T1608.004 | Drive-by Target | — |
| T1685.005 | Clear Windows Event Logs | — |
| T1686 | Disable or Modify System Firewall | — |
别名
Berserk Bear · BROMINE · Crouching Yeti · Dragonfly · DYMALLOY · Energetic Bear · Ghost Blizzard · IRON LIBERTY · TEMP.Isotope · TG-4192
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。