Dragonfly

Introduction

Dragonfly is a cyber espionage group that has been attributed to Russia’s Federal Security Service (FSB) Center 16. DOJ Russia Targeting Critical Infrastructure March 2022 UK GOV FSB Factsheet April 2022 Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks. Symantec Dragonfly Secureworks IRON LIBERTY July 2019 Symantec Dragonfly Sept 2017 Fortune Dragonfly 2.0 Sept 2017 Gigamon Berserk Bear October 2021 CISA AA20-296A Berserk Bear December 2020 Symantec Dragonfly 2.0 October 2017

Activities and Tactics

Targeted Sectors: Energy, Private sector, Government

Country of Origin: 🇷🇺 Russia

Incident Type: Espionage

Suspected Victims: United States, Germany, Turkey, China, Spain, France, Ireland, Japan, Italy, Poland

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1560 Archive Collected Data
• T1113 Screen Capture
• T1564.002 Hidden Users
• T1505.003 Web Shell
• T1204.002 Malicious File
• T1591.002 Business Relationships
• T1078 Valid Accounts
• T1016 System Network Configuration Discovery
• T1584.004 Server
• T1083 File and Directory Discovery
• T1136.001 Local Account
• T1221 Template Injection
• T1203 Exploitation for Client Execution
• T1110.002 Password Cracking
• T1608.004 Drive-by Target
• T1012 Query Registry
• T1566.001 Spearphishing Attachment
• T1189 Drive-by Compromise
• T1583.001 Domains
• T1003.002 Security Account Manager
• T1598.002 Spearphishing Attachment
• T1005 Data from Local System
• T1070.004 File Deletion
• T1059 Command and Scripting Interpreter
• T1685.005 Clear Windows Event Logs
• T1686 Disable or Modify System Firewall
• T1112 Modify Registry
• T1588.002 Tool
• T1195.002 Compromise Software Supply Chain
• T1036.010 Masquerade Account Name
• T1003.003 NTDS
• T1098.007 Additional Local or Domain Groups
• T1583.003 Virtual Private Server
• T1059.003 Windows Command Shell
• T1071.002 File Transfer Protocols
• T1598.003 Spearphishing Link
• T1053.005 Scheduled Task
• T1069.002 Domain Groups
• T1114.002 Remote Email Collection
• T1595.002 Vulnerability Scanning
• T1547.001 Registry Run Keys / Startup Folder
• T1105 Ingress Tool Transfer
• T1133 External Remote Services
• T1003.004 LSA Secrets
• T1190 Exploit Public-Facing Application
• T1135 Network Share Discovery
• T1110 Brute Force
• T1021.001 Remote Desktop Protocol
• T1187 Forced Authentication
• T1033 System Owner/User Discovery
• T1074.001 Local Data Staging
• T1059.001 PowerShell
• T1210 Exploitation of Remote Services
• T1059.006 Python
• T1018 Remote System Discovery
• T1087.002 Domain Account
• T0817 Drive-by Compromise
• T0862 Supply Chain Compromise

ATT&CK technique IDs (denormalized)

• T0817
• T0862
• T1003.002
• T1003.003
• T1003.004
• T1005
• T1012
• T1016
• T1018
• T1021.001
• T1033
• T1036.010
• T1053.005
• T1059
• T1059.001
• T1059.003
• T1059.006
• T1069.002
• T1070.004
• T1071.002
• T1074.001
• T1078
• T1083
• T1087.002
• T1098.007
• T1105
• T1110
• T1110.002
• T1112
• T1113
• T1114.002
• T1133
• T1135
• T1136.001
• T1187
• T1189
• T1190
• T1195.002
• T1203
• T1204.002
• T1210
• T1221
• T1505.003
• T1547.001
• T1560
• T1564.002
• T1566.001
• T1583.001
• T1583.003
• T1584.004
• T1588.002
• T1591.002
• T1595.002
• T1598.002
• T1598.003
• T1608.004
• T1685.005
• T1686

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• MCMD (S0500) — tool
• Net (S0039) — tool
• Impacket (S0357) — tool
• CrackMapExec (S0488) — tool
• Reg (S0075) — tool
• Backdoor.Oldrea (S0093) — malware
• Mimikatz (S0002) — tool
• PsExec (S0029) — tool
• Trojan.Karagany (S0094) — malware
• netsh (S0108) — tool

Russian APT Tool Matrix observations

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [12] CISA AA20-296A Berserk Bear December 2020 CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021. [13] DOJ Russia Targeting Critical Infrastructure March 2022 Department of Justice. (2022, March 24). Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide. Retrieved April 5, 2022. [14] Dragos DYMALLOY Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020. [15] Fortune Dragonfly 2.0 Sept 2017 Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018. [16] Mandiant Ukraine Cyber Threats January 2022 Hultquist, J. (2022, January 20). Anticipating Cyber Threats as the Ukraine Crisis Escalates. Retrieved January 24, 2022. [17] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [18] Secureworks MCMD July 2019 Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020. [19] Secureworks IRON LIBERTY July 2019 Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020. [20] Secureworks Karagany July 2019 Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020. [21] Gigamon Berserk Bear October 2021 Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021. [22] Symantec Dragonfly Sept 2017 Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017. [23] Symantec Dragonfly Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016. [24] Symantec Dragonfly 2.0 October 2017 Symantec. (2017, October 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved April 19, 2022. [25] UK GOV FSB Factsheet April 2022 UK Gov. (2022, April 5). Russia’s FSB malign activity: factsheet. Retrieved April 5, 2022. [16] Symantec Dragonfly [17] Symantec Dragonfly Sept 2017