Dragonfly
Threat actorAttributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- DragonflyOur name
- DYMALLOYDragos
- TEMP.IsotopeMandiant
- BROMINEMicrosoft
- Ghost BlizzardMicrosoft
- Berserk BearMITRE ATT&CK
- Crouching YetiSecureworks
- IRON LIBERTYSecureworks
- TG-4192Secureworks
- Energetic BearSymantec
Targets
Sectors: Government, Defence, Aerospace, Critical infrastructure
Source: MITRE ATT&CKKnown techniques
- T1003.002Security Account Manager
- T1003.003NTDS
- T1003.004LSA Secrets
- T1005Data from Local System
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1033System Owner/User Discovery
- T1036.010Masquerade Account Name
- T1053.005Scheduled Task
- T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.006Python
- T1069.002Domain Groups
- T1070.004File Deletion
- T1071.002File Transfer Protocols
- T1074.001Local Data Staging
- T1078Valid Accounts
- T1083File and Directory Discovery
- T1087.002Domain Account
- T1098.007Additional Local or Domain Groups
- T1105Ingress Tool Transfer
- T1110Brute Force
- T1110.002Password Cracking
- T1112Modify Registry
- T1113Screen Capture
- T1114.002Remote Email Collection
- T1133External Remote Services
- T1135Network Share Discovery
- T1136.001Local Account
- T1187Forced Authentication
- T1189Drive-by Compromise
- T1190Exploit Public-Facing Application
- T1195.002Compromise Software Supply Chain
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1210Exploitation of Remote Services
- T1221Template Injection
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.