Dragonfly

Overview

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.

Naming & attribution

Dragonfly is tracked under 10 names across the industry. It uses 56 documented ATT&CK techniques — more than 86% of the 174 groups tracked here. Activity attributed since at least 2010.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1187 Forced Authentication — used by 2 of 174 groups
• T1564.002 Hidden Users — used by 2 of 174 groups
• T1591.002 Business Relationships — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Threat Group-3390 China — 27 shared techniques (31% overlap)
• APT41 China — 31 shared techniques (29% overlap)
• menuPass China — 23 shared techniques (29% overlap)
• APT39 Iran — 24 shared techniques (28% overlap)
• Wizard Spider Russia — 24 shared techniques (25% overlap)
• APT28 Russia — 29 shared techniques (24% overlap)

Targets

Energy · Government · Private sector

Regions

China · France · Germany · Ireland · Italy · Japan · Poland · Spain · Turkey · United States

Capabilities

• Supply-chain compromise — ATT&CK T1195.002
• Exploitation of public-facing / client applications — ATT&CK T1190, T1203

TTPs — 56 techniques across 12 tactics

Tools & malware (10)

MCMD · Net · Impacket · CrackMapExec · Reg · Backdoor.Oldrea · Mimikatz · PsExec · Trojan.Karagany · netsh

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Russia's FSB malign activity: factsheet — UK Gov
• Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide — Department of Justice