D
CyberRussia

Dragonfly

State-sponsored cyber threat groupTrackedPending verification

Also known as: TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsTEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE
ProliferationOrigin country only
Active since2010At least 2010Med[1]
MITRE ATT&CK IDG0035High[1]
Capabilities
ATT&CK techniques used56ATT&CK v20.1High[1]
Malware and toolsBackdoor.Oldrea, CrackMapExec, Impacket, MCMD, Mimikatz, Net, netsh, PsExec, Reg, Trojan.Karagany10 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorRussia's Federal Security Service (FSB) Center 16High[1]
TargetsActive since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.Med[1]
Notes
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. Dragonfly, Group G0035, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0035)