216.73.217.22

Dragonfly

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:13
Updated at
27/03/2026 01:13
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
60 attack patterns (mitre), 2 malware, 8 tool

Aliases

TEMP.Isotope DYMALLOY Berserk Bear TG-4192 Crouching Yeti IRON LIBERTY Energetic Bear Ghost Blizzard BROMINE

Description

[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

Marking (TLP)

Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (60)

Malware (2)

  • Backdoor.Oldrea
  • Trojan.Karagany

Tool (8)

  • Net uses
    The MITRE Corporation Confidence 100

    The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • MCMD uses
    The MITRE Corporation Confidence 100

    [MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly 2.0](https://attack.mitre.org/groups/G0074).(Citation: Secureworks MCMD July 2019)

    Published 13/08/2020 19:15 · Modified 27/03/2026 01:07
  • Reg uses
    The MITRE Corporation Confidence 100

    [Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • netsh uses
    The MITRE Corporation Confidence 100

    [netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • CrackMapExec uses
    The MITRE Corporation Confidence 100

    [CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted …

    Published 17/07/2020 16:23 · Modified 27/03/2026 01:07
  • Impacket uses
    The MITRE Corporation Confidence 100

    [Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, …

    Published 31/01/2019 02:39 · Modified 27/03/2026 01:07
  • PsExec uses
    The MITRE Corporation Confidence 100

    [PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07