Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
- ATT&CK ID
- G0035
- Origin
- Russia
- Weather family
- Blizzard
- Techniques
- 48
- Tools
- 10
Also tracked as TEMP.Isotope · DYMALLOY · Berserk Bear · TG-4192 · Crouching Yeti · IRON LIBERTY · Energetic Bear · Ghost Blizzard · BROMINE
Vulnerabilities it has exploited
- CVE-2011-0611 Adobe Flash PlayerUnscored · exploited in the wild
- CVE-2018-13379 Fortinet FortiOSUnscored · exploited in the wild
- CVE-2019-19781 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnscored · exploited in the wild
- CVE-2020-0688 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2020-1472 Microsoft NetlogonUnscored · exploited in the wild
Techniques
Reconnaissance
Gather Victim Org InformationActive ScanningPhishing for Information
Resource Development
Acquire InfrastructureCompromise InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Valid AccountsExternal Remote ServicesDrive-by CompromiseExploit Public-Facing ApplicationSupply Chain CompromisePhishing
Execution
Scheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser Execution
Persistence
Scheduled Task/JobValid AccountsAccount ManipulationModify RegistryExternal Remote ServicesCreate AccountServer Software ComponentBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobValid AccountsAccount ManipulationBoot or Logon Autostart Execution
Stealth
MasqueradingIndicator RemovalValid AccountsTemplate InjectionHide Artifacts
Defense Impairment
Modify RegistryDisable or Modify ToolsDisable or Modify System Firewall
Credential Access
OS Credential DumpingBrute ForceForced Authentication
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryPermission Groups DiscoveryFile and Directory DiscoveryAccount DiscoveryNetwork Share Discovery
Lateral Movement
Remote ServicesExploitation of Remote Services
Collection
Data from Local SystemData StagedScreen CaptureEmail CollectionArchive Collected Data
Command and Control
Application Layer ProtocolIngress Tool Transfer
Software
Backdoor.Oldrea · CrackMapExec · Impacket · MCMD · Mimikatz · Net · PsExec · Reg · Trojan.Karagany · netsh