CVE Intelligence
Home / Threat actors / Dragonfly

Dragonfly G0035

🔔 Create alert

Also known as: TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

5
associated CVEs
65
Techniques
10
Malware and tools

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability
“Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.”
CVE-2020-0688 High · 8.8 KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
CVE-2019-19781 Critical · 9.8 KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
CVE-2018-13379 Critical · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
CVE-2011-0611 High · 8.8 KEV Adobe Flash Player Remote Code Execution Vulnerability
“Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.”

Techniques by tactic

Reconnaissance
T1591.002 Business RelationshipsT1595.002 Vulnerability ScanningT1598.002 Spearphishing AttachmentT1598.003 Spearphishing Link
Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1584.004 ServerT1588.002 ToolT1608.004 Drive-by Target
Initial Access
T1078 Valid AccountsT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1566.001 Spearphishing Attachment
Execution
T1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.006 PythonT1203 Exploitation for Client ExecutionT1204.002 Malicious File
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1112 Modify RegistryT1133 External Remote ServicesT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1547.001 Registry Run Keys / Startup Folder
Stealth
T1036.010 Masquerade Account NameT1070.004 File DeletionT1078 Valid AccountsT1221 Template InjectionT1564.002 Hidden Users
Defense Impairment
T1112 Modify RegistryT1685.005 Clear Windows Event LogsT1686 Disable or Modify System Firewall
Credential Access
T1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1110 Brute ForceT1110.002 Password CrackingT1187 Forced Authentication
Discovery
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1069.002 Domain GroupsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1135 Network Share Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1210 Exploitation of Remote Services
Collection
T1005 Data from Local SystemT1074.001 Local Data StagingT1113 Screen CaptureT1114.002 Remote Email CollectionT1560 Archive Collected Data
Command and Control
T1071.002 File Transfer ProtocolsT1105 Ingress Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.