Trusted Design

Dragonfly

アクターID: G0035

· MITRE Pageへのリンク

脅威アクターの詳細

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

脅威アクターの別名・別称

Dragonfly
TEMP.Isotope
DYMALLOY
Berserk Bear
TG-4192
Crouching Yeti
IRON LIBERTY
Energetic Bear
Ghost Blizzard
BROMINE

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1156 - Malicious Shell Modification
• T1557 - Adversary-in-the-Middle
• T1123 - Audio Capture
• T1584.008 - Network Devices
• T1116 - Code Signing
• T1036.005 - Match Legitimate Resource Name or Location
• T1178 - SID-History Injection
• T1587.001 - Malware
• T1087.002 - Domain Account
• T1542.005 - TFTP Boot
• T1566.002 - Spearphishing Link
• T1598.003 - Spearphishing Link
• T1115 - Clipboard Data
• T1007 - System Service Discovery
• T1584.003 - Virtual Private Server
• T1536 - Revert Cloud Instance
• T1140 - Deobfuscate/Decode Files or Information
• T1098.007 - Additional Local or Domain Groups
• T1009 - Binary Padding
• T1550 - Use Alternate Authentication Material
• T1562.004 - Disable or Modify System Firewall
• T1059.009 - Cloud API
• T1555.003 - Credentials from Web Browsers
• T1583.004 - Server
• T1547.003 - Time Providers
• T1193 - Spearphishing Attachment
• T1590.006 - Network Security Appliances
• T1055.013 - Process Doppelgänging
• T1175 - Component Object Model and Distributed COM
• T1219.001 - IDE Tunneling
• T1657 - Financial Theft
• T1654 - Log Enumeration
• T1497.002 - User Activity Based Checks
• T1041 - Exfiltration Over C2 Channel
• T1059.001 - PowerShell
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1097 - Pass the Ticket
• T1157 - Dylib Hijacking
• T1204.003 - Malicious Image
• T1531 - Account Access Removal
• T1573 - Encrypted Channel
• T1218.010 - Regsvr32
• T1570 - Lateral Tool Transfer
• T1027.004 - Compile After Delivery
• T1591.004 - Identify Roles
• T1578.002 - Create Cloud Instance
• T1070.009 - Clear Persistence
• T1059.012 - Hypervisor CLI
• T1200 - Hardware Additions
• T1546.016 - Installer Packages
• T1134 - Access Token Manipulation
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1548.006 - TCC Manipulation

関連するCVE (攻撃手法に関連)

• CVE-2013-3906 (T1218.010)
• CVE-2013-6282 (T1041)
• CVE-2014-4114 (T1200)
• CVE-2015-5119 (T1218.010)
• CVE-2015-5122 (T1134)
• CVE-2015-1427 (T1555.003)
• CVE-2015-1770 (T1622)
• CVE-2012-1856 (T1548.006)
• CVE-2015-2545 (T1200)
• CVE-2015-2546 (T1531)
• CVE-2014-6332 (T1218.010)
• CVE-2015-3785 (T1041)
• CVE-2015-5897 (T1157)
• CVE-2015-7645 (T1218.010)
• CVE-2017-0199 (T1622)
• CVE-2017-12149 (T1009)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1218.010)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1531)
• CVE-2015-2424 (T1531)
• CVE-2015-0097 (T1531)
• CVE-2015-4495 (T1059.012)
• CVE-2012-0158 (T1548.006)
• CVE-2014-1761 (T1218.010)
• CVE-2015-2502 (T1059.012)
• CVE-2014-6271 (T1591.004)
• CVE-2013-2094 (T1157)
• CVE-2014-4113 (T1570)
• CVE-2015-8562 (T1041)
• CVE-2015-7808 (T1218.010)
• CVE-2012-1889 (T1115)
• CVE-2016-1990 (T1157)
• CVE-2016-1991 (T1531)
• CVE-2016-1010 (T1218.010)
• CVE-2016-0984 (T1531)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1218.010)
• CVE-2015-1641 (T1531)
• CVE-2015-1701 (T1570)
• CVE-2015-0313 (T1218.010)
• CVE-2015-0359 (T1134)
• CVE-2014-0329 (T1531)
• CVE-2015-5130 (T1531)
• CVE-2015-5134 (T1531)
• CVE-2015-5539 (T1531)
• CVE-2015-5557 (T1531)
• CVE-2015-5563 (T1531)
• CVE-2015-5559 (T1531)
• CVE-2015-5540 (T1531)
• CVE-2015-5561 (T1531)
• CVE-2015-5551 (T1531)
• CVE-2015-5564 (T1531)
• CVE-2015-5565 (T1531)
• CVE-2015-5550 (T1531)
• CVE-2015-5566 (T1531)
• CVE-2015-5127 (T1531)
• CVE-2015-5556 (T1531)
• CVE-2015-5749 (T1657)
• CVE-2015-3628 (T1218.010)
• CVE-2015-2852 (T1218.010)
• CVE-2015-2854 (T1218.010)
• CVE-2015-2853 (T1218.010)
• CVE-2015-7755 (T1218.010)
• CVE-2012-4969 (T1591.004)
• CVE-2016-1287 (T1041)
• CVE-2015-6585 (T1175)
• CVE-2015-7261 (T1657)
• CVE-2015-6022 (T1531)
• CVE-2015-7262 (T1531)
• CVE-2015-8286 (T1657)
• CVE-2015-8287 (T1218.010)
• CVE-2016-1562 (T1531)
• CVE-2016-2342 (T1041)
• CVE-2016-2343 (T1566.002)
• CVE-2017-0263 (T1531)
• CVE-2016-6532 (T1097)
• CVE-2016-9494 (T1657)
• CVE-2016-9496 (T1531)
• CVE-2016-9495 (T1218.010)
• CVE-2017-3212 (T1041)
• CVE-2025-61882 (T1200)
• CVE-2015-0311 (T1218.010)
• CVE-2010-3081 (T1157)
• CVE-2012-3213 (T1218.010)
• CVE-2012-4792 (T1547.013)
• CVE-2012-1258 (T1157)
• CVE-2015-0336 (T1218.010)
• CVE-2014-3153 (T1218.010)
• CVE-2014-4322 (T1157)
• CVE-2015-3105 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2014-8361 (T1218.010)
• CVE-2017-17215 (T1531)
• CVE-2013-0074 (T1218.010)
• CVE-2012-0507 (T1531)
• CVE-2013-2551 (T1059.012)
• CVE-2014-0569 (T1041)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2012-4681 (T1157)
• CVE-2014-1776 (T1218.010)
• CVE-2012-1876 (T1218.010)
• CVE-2015-0071 (T1059.012)
• CVE-2015-1761 (T1531)
• CVE-2014-8440 (T1134)
• CVE-2013-3660 (T1531)
• CVE-2010-0806 (T1547.013)
• CVE-2014-4148 (T1531)
• CVE-2011-3402 (T1531)
• CVE-2010-2883 (T1591.004)
• CVE-2014-7247 (T1218.010)
• CVE-2013-2678 (T1531)
• CVE-2010-0738 (T1157)
• CVE-2015-2426 (T1531)
• CVE-2008-1436 (T1157)
• CVE-2010-0232 (T1218.010)
• CVE-2010-4398 (T1570)
• CVE-2014-3393 (T1041)
• CVE-2012-6422 (T1157)
• CVE-2013-2595 (T1200)
• CVE-2014-3897 (T1059.012)
• CVE-2015-2387 (T1531)
• CVE-2011-1255 (T1548.006)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1218.010)
• CVE-2016-0189 (T1059.012)
• CVE-2017-7255 (T1134)
• CVE-2017-0143 (T1218.010)
• CVE-2023-1389 (T1134)
• CVE-2025-24893 (T1218.010)
• CVE-2025-34026 (T1218.010)
• CVE-2026-0723 (T1657)
• CVE-2026-20127 (T1531)
• CVE-2014-6352 (T1218.010)
• CVE-2015-0016 (T1218.010)
• CVE-2010-3333 (T1200)
• CVE-2010-0188 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2015-3456 (T1157)
• CVE-2010-1553 (T1041)
• CVE-2015-5477 (T1566.002)
• CVE-2016-1019 (T1157)
• CVE-2015-6034 (T1157)
• CVE-2016-1898 (T1140)
• CVE-2016-1897 (T1140)
• CVE-2015-6036 (T1657)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2025-55182 (T1531)
• CVE-2015-0932 (T1041)
• CVE-2012-0056 (T1157)
• CVE-2014-0322 (T1059.012)
• CVE-2011-3544 (T1531)
• CVE-2014-7911 (T1531)
• CVE-2015-3636 (T1157)
• CVE-2017-16929 (T1531)
• CVE-2013-2465 (T1531)
• CVE-2014-8439 (T1041)
• CVE-2014-0556 (T1531)
• CVE-2015-5560 (T1041)
• CVE-2015-0057 (T1531)
• CVE-2012-2539 (T1218.010)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1531)
• CVE-2010-1297 (T1591.004)
• CVE-2013-7331 (T1548.006)
• CVE-2015-2360 (T1570)
• CVE-2014-6324 (T1531)
• CVE-2013-0634 (T1097)
• CVE-2012-5054 (T1041)
• CVE-2013-0641 (T1591.004)
• CVE-2014-2273 (T1041)
• CVE-2015-4902 (T1531)
• CVE-2009-3129 (T1531)
• CVE-2017-8570 (T1531)
• CVE-2012-0611 (T1059.012)
• CVE-2015-2419 (T1059.012)
• CVE-2016-4117 (T1218.010)
• CVE-2017-0001 (T1531)
• CVE-2025-13335 (T1531)
• CVE-2025-13927 (T1531)
• CVE-2025-13928 (T1531)
• CVE-2025-31125 (T1531)
• CVE-2025-54313 (T1566.002)
• CVE-2025-55183 (T1531)
• CVE-2025-55184 (T1531)
• CVE-2025-68645 (T1531)
• CVE-2026-1102 (T1531)
• CVE-2025-66478 (T1657)
• CVE-2010-2572 (T1531)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る