Dragonfly

Overview

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.

Targets

Energy · Government · Private sector

Regions

China · France · Germany · Ireland · Italy · Japan · Poland · Spain · Turkey · United States

Capabilities

• Supply-chain compromise — ATT&CK T1195.002
• Exploitation of public-facing / client applications — ATT&CK T1190, T1203

TTPs — 56 techniques across 12 tactics

Tools & malware (10)

MCMD · Net · Impacket · CrackMapExec · Reg · Backdoor.Oldrea · Mimikatz · PsExec · Trojan.Karagany · netsh

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Russia's FSB malign activity: factsheet — UK Gov
• Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide — Department of Justice