Início / Grupos de ameaça / Dragonfly
Dragonfly G0035
Também conhecido como: TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
5
CVEs associadas
65
Técnicas
10
Malwares e ferramentas
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
“Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.”
CVE-2020-0688
Alta · 8.8
KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
CVE-2019-19781
Crítica · 9.8
KEV Ransomware Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
“Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.”
“Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.”
Técnicas por tática
Reconhecimento
T1591.002 Business RelationshipsT1595.002 Vulnerability ScanningT1598.002 Spearphishing AttachmentT1598.003 Spearphishing Link Desenvolvimento de recursos
T1583.001 DomainsT1583.003 Virtual Private ServerT1584.004 ServerT1588.002 ToolT1608.004 Drive-by Target Acesso inicial
T1078 Valid AccountsT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1566.001 Spearphishing Attachment Execução
T1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.006 PythonT1203 Exploitation for Client ExecutionT1204.002 Malicious File Persistência
T1053.005 Scheduled TaskT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1112 Modify RegistryT1133 External Remote ServicesT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup Folder Escalada de privilégios
T1053.005 Scheduled TaskT1078 Valid AccountsT1098.007 Additional Local or Domain GroupsT1547.001 Registry Run Keys / Startup Folder Furtividade
T1036.010 Masquerade Account NameT1070.004 File DeletionT1078 Valid AccountsT1221 Template InjectionT1564.002 Hidden Users Comprometimento de defesas
T1112 Modify RegistryT1685.005 Clear Windows Event LogsT1686 Disable or Modify System Firewall Acesso a credenciais
T1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1110 Brute ForceT1110.002 Password CrackingT1187 Forced Authentication Descoberta
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1069.002 Domain GroupsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1135 Network Share Discovery Movimento lateral
T1021.001 Remote Desktop ProtocolT1210 Exploitation of Remote Services Coleta
T1005 Data from Local SystemT1074.001 Local Data StagingT1113 Screen CaptureT1114.002 Remote Email CollectionT1560 Archive Collected Data Comando e controle
T1071.002 File Transfer ProtocolsT1105 Ingress Tool Transfer Malwares e ferramentas
- Backdoor.OldreaMalwareS0093
- Trojan.KaraganyMalwareS0094
- CrackMapExecFerramentaS0488
- ImpacketFerramentaS0357
- MCMDFerramentaS0500
- MimikatzFerramentaS0002
- NetFerramentaS0039
- netshFerramentaS0108
- PsExecFerramentaS0029
- RegFerramentaS0075
© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.