G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
Security context for executives and security teams
G0035: Dragonfly describes [Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through suppl...
Executive priority
G0035: Dragonfly is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G0035: Dragonfly by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G0035: Dragonfly appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1560 | Archive Collected Data | Dragonfly has compressed data into .zip files prior to exfiltration.CitationUS-CERT TA18-074A |
| Enterprise | T1113 | Screen Capture | |
| Enterprise | T1564.002 | Hidden UsersSub-technique | Dragonfly has modified the Registry to hide created user accounts.CitationUS-CERT TA18-074A |
| Enterprise | T1505.003 | Web ShellSub-technique | Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.CitationUS-CERT TA18-074A |
| Enterprise | T1204.002 | Malicious FileSub-technique | |
| Enterprise | T1591.002 | Business RelationshipsSub-technique | |
| Enterprise | T1078 | Valid Accounts | |
| Enterprise | T1016 | System Network Configuration Discovery | Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.CitationUS-CERT TA18-074A |
| Enterprise | T1584.004 | ServerSub-technique | |
| Enterprise | T1083 | File and Directory Discovery | |
| Enterprise | T1136.001 | Local AccountSub-technique | Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.CitationUS-CERT TA18-074A |
| Enterprise | T1221 | Template Injection | Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.CitationUS-CERT TA18-074A |
| Enterprise | T1203 | Exploitation for Client Execution | |
| Enterprise | T1110.002 | Password CrackingSub-technique | Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.CitationUS-CERT TA18-074ACitationKali Hydra |
| Enterprise | T1608.004 | Drive-by TargetSub-technique | |
| Enterprise | T1012 | Query Registry | Dragonfly has queried the Registry to identify victim information.CitationUS-CERT TA18-074A |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | |
| Enterprise | T1189 | Drive-by Compromise | |
| Enterprise | T1583.001 | DomainsSub-technique | |
| Enterprise | T1003.002 | Security Account ManagerSub-technique | Dragonfly has dropped and executed SecretsDump to dump password hashes.CitationUS-CERT TA18-074A |
| Enterprise | T1598.002 | Spearphishing AttachmentSub-technique | Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.CitationUS-CERT TA18-074A |
| Enterprise | T1005 | Data from Local System | Dragonfly has collected data from local victim systems.CitationUS-CERT TA18-074A |
| Enterprise | T1070.004 | File DeletionSub-technique | Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.CitationUS-CERT TA18-074A |
| Enterprise | T1059 | Command and Scripting Interpreter | Dragonfly has used the command line for execution.CitationUS-CERT TA18-074A |
| Enterprise | T1685.005 | Clear Windows Event LogsSub-technique | Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.CitationUS-CERT TA18-074A |
| Enterprise | T1686 | Disable or Modify System Firewall | Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.CitationUS-CERT TA18-074A |
| Enterprise | T1112 | Modify Registry | |
| Enterprise | T1588.002 | ToolSub-technique | Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.[4] |
| Enterprise | T1195.002 | Compromise Software Supply ChainSub-technique | |
| Enterprise | T1036.010 | Masquerade Account NameSub-technique | Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.CitationUS-CERT TA18-074A |
| Enterprise | T1003.003 | NTDSSub-technique | Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.CitationUS-CERT TA18-074ACitationCore Security Impacket |
| Enterprise | T1098.007 | Additional Local or Domain GroupsSub-technique | Dragonfly has added newly created accounts to the administrators group to maintain elevated access.CitationUS-CERT TA18-074A |
| Enterprise | T1583.003 | Virtual Private ServerSub-technique | |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Dragonfly has used various types of scripting to perform operations, including batch scripts.CitationUS-CERT TA18-074A |
| Enterprise | T1071.002 | File Transfer ProtocolsSub-technique | Dragonfly has used SMB for C2.CitationUS-CERT TA18-074A |
| Enterprise | T1598.003 | Spearphishing LinkSub-technique | Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.CitationUS-CERT TA18-074A |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.CitationUS-CERT TA18-074A |
| Enterprise | T1069.002 | Domain GroupsSub-technique | Dragonfly has used batch scripts to enumerate administrators and users in the domain.CitationUS-CERT TA18-074A |
| Enterprise | T1114.002 | Remote Email CollectionSub-technique | Dragonfly has accessed email accounts using Outlook Web Access.CitationUS-CERT TA18-074A |
| Enterprise | T1595.002 | Vulnerability ScanningSub-technique | |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.CitationUS-CERT TA18-074A |
| Enterprise | T1105 | Ingress Tool Transfer | Dragonfly has copied and installed tools for operations once in the victim environment.CitationUS-CERT TA18-074A |
| Enterprise | T1133 | External Remote Services | |
| Enterprise | T1003.004 | LSA SecretsSub-technique | Dragonfly has dropped and executed SecretsDump to dump password hashes.CitationUS-CERT TA18-074ACitationCore Security Impacket |
| Enterprise | T1190 | Exploit Public-Facing Application | |
| Enterprise | T1135 | Network Share Discovery | Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.CitationUS-CERT TA18-074A |
| Enterprise | T1110 | Brute Force | |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | Dragonfly has moved laterally via RDP.CitationUS-CERT TA18-074A |
| Enterprise | T1187 | Forced Authentication | |
| Enterprise | T1033 | System Owner/User Discovery | Dragonfly used the command |
| Enterprise | T1074.001 | Local Data StagingSub-technique | Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.CitationUS-CERT TA18-074A |
| Enterprise | T1059.001 | PowerShellSub-technique | |
| Enterprise | T1210 | Exploitation of Remote Services | |
| Enterprise | T1059.006 | PythonSub-technique | Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.CitationUS-CERT TA18-074A |
| Enterprise | T1018 | Remote System Discovery | Dragonfly has likely obtained a list of hosts in the victim environment.CitationUS-CERT TA18-074A |
| Enterprise | T1087.002 | Domain AccountSub-technique | Dragonfly has used batch scripts to enumerate users on a victim domain controller.CitationUS-CERT TA18-074A |
Groups, software, and campaigns
G0074: Dragonfly 2.0
Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. [1] [2] There is debate over the extent of overlap between Dragonfly 2.0 and Dragonfly, but there is sufficient evidence to lead to these being tracked as two separate groups. [3][4]
S0500: MCMD
S0039: Net
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
S0357: Impacket
S0488: CrackMapExec
CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]
S0075: Reg
S0093: Backdoor.Oldrea
Backdoor.Oldrea is a modular backdoor that used by Dragonfly against energy companies since at least 2013. Backdoor.Oldrea was distributed via supply chain compromise, and included specialized modules to enumerate and map ICS-specific systems, processes, and protocols.[1][2][3]
S0002: Mimikatz
S0029: PsExec
S0094: Trojan.Karagany
Trojan.Karagany is a modular remote access tool used for recon and linked to Dragonfly. The source code for Trojan.Karagany originated from Dream Loader malware which was leaked in 2010 and sold on underground forums. [1][2][3]
S0108: netsh
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 4.0 | Current bundle | 15b5121ad26a… | ||
| 19.2 | 4.0 | Older bundle | 15b5121ad26a… | ||
| 19.1 | 4.0 | Older bundle | af4de2ac45e0… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]DOJ Russia Targeting Critical Infrastructure March 2022
Department of Justice. (2022, March 24). Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide. Retrieved April 5, 2022.
Open source URL - [2]UK GOV FSB Factsheet April 2022
UK Gov. (2022, April 5). Russia's FSB malign activity: factsheet. Retrieved April 5, 2022.
Open source URL - [3]Symantec Dragonfly
Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
Open source URL - [4]Secureworks IRON LIBERTY July 2019
Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020.
Open source URL - [5]Symantec Dragonfly Sept 2017
Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.
Open source URL - [6]Fortune Dragonfly 2.0 Sept 2017
Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.
- [7]Gigamon Berserk Bear October 2021
Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.
Open source URL - [8]CISA AA20-296A Berserk Bear December 2020
CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.
Open source URL - [9]Symantec Dragonfly 2.0 October 2017
Symantec. (2017, October 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved April 19, 2022.
Open source URL - [10]Secureworks MCMD July 2019
Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
Open source URL - [11]Secureworks Karagany July 2019
Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
Open source URL - [12]BROMINE
(Citation: Microsoft Threat Actor Naming July 2023)
- [13]Berserk Bear
(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)
- [14]Crouching Yeti
(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)
- [15]DYMALLOY
(Citation: Dragos DYMALLOY )(Citation: UK GOV FSB Factsheet April 2022)
- [16]Dragonfly
(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)
- [17]Dragos DYMALLOY
Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.
Open source URL - [18]Energetic Bear
(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)
- [19]Ghost Blizzard
(Citation: Microsoft Threat Actor Naming July 2023)
- [20]IRON LIBERTY
(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: UK GOV FSB Factsheet April 2022)
- [21]Mandiant Ukraine Cyber Threats January 2022
Hultquist, J. (2022, January 20). Anticipating Cyber Threats as the Ukraine Crisis Escalates. Retrieved January 24, 2022.
Open source URL - [22]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [23]TEMP.Isotope
(Citation: Mandiant Ukraine Cyber Threats January 2022)(Citation: Gigamon Berserk Bear October 2021)
- [24]TG-4192
(Citation: Secureworks IRON LIBERTY July 2019)(Citation: UK GOV FSB Factsheet April 2022)
- [25]mitre-attackG0035Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.