Dragonfly
Dragonfly Dragonfly is a cyber espionage group that has been active since at least 2011. They initially targeted defense and aviation companies but shifted to focus on the energy sector in early 2013. They have also targeted companies related to industrial control systems. [1][2]
A similar group emerged in 2015 and was identified by Symantec as Dragonfly 2.0. There is debate over the extent of the overlap between Dragonfly and Dragonfly 2.0, but there is sufficient evidence to lead to these being tracked as two separate groups. [3][4][5]
Associated Group Descriptions
Name | Description |
---|---|
TG-4192 | |
Crouching Yeti | |
IRON LIBERTY | |
Energetic Bear |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1189 | Drive-by Compromise |
Dragonfly has has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.[2] |
|
Enterprise | T1566 | Phishing |
Dragonfly has used spearphising campaigns to gain access to victims.[2] |
|
Enterprise | T1195 | .002 | Supply Chain Compromise: Compromise Software Supply Chain |
Dragonfly has placed trojanized installers on legitimate vendor app stores.[2] |
Software
References
- Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
- Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020.
- Symantec Security Response. (2017, September 6). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.
- Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.