← Back to Actors
Dragonfly
DragonflyTEMP.IsotopeDYMALLOYBerserk BearTG-4192Crouching YetiIRON LIBERTYEnergetic BearGhost BlizzardBROMINE
[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Drag...
58
Techniques
53
Covered
5
Gaps
91%
Coverage
Coverage53/58
GAPS (5)
COVERED (53)
T1003.002Security Account Manager49 det.T1003.003NTDS36 det.T1003.004LSA Secrets18 det.T1005Data from Local System47 det.T1012Query Registry24 det.T1016System Network Configuration Discovery39 det.T1018Remote System Discovery50 det.T1021.001Remote Desktop Protocol53 det.T1033System Owner/User Discovery61 det.T1053.005Scheduled Task99 det.T1059Command and Scripting Interpreter486 det.T1059.001PowerShell368 det.T1059.003Windows Command Shell82 det.T1059.006Python49 det.T1069.002Domain Groups44 det.T1070.001Clear Windows Event Logs16 det.T1070.004File Deletion42 det.T1071.002File Transfer Protocols1 det.T1074.001Local Data Staging10 det.T1078Valid Accounts280 det.T1083File and Directory Discovery48 det.T1087.002Domain Account57 det.T1098.007Additional Local or Domain Groups10 det.T1105Ingress Tool Transfer183 det.T1110Brute Force90 det.T1110.002Password Cracking2 det.T1112Modify Registry203 det.T1113Screen Capture18 det.T1114.002Remote Email Collection18 det.T1133External Remote Services72 det.T1135Network Share Discovery20 det.T1136.001Local Account43 det.T1187Forced Authentication22 det.T1189Drive-by Compromise10 det.T1190Exploit Public-Facing Application216 det.T1195.002Compromise Software Supply Chain23 det.T1203Exploitation for Client Execution75 det.T1204.002Malicious File425 det.T1210Exploitation of Remote Services35 det.T1221Template Injection1 det.T1505.003Web Shell63 det.T1547.001Registry Run Keys / Startup Folder53 det.T1560Archive Collected Data12 det.T1562.004Disable or Modify System Firewall48 det.T1564.002Hidden Users8 det.T1566.001Spearphishing Attachment905 det.T1583.001Domains61 det.T1588.002Tool13 det.T1595.002Vulnerability Scanning12 det.T1598.002Spearphishing Attachment2 det.T1598.003Spearphishing Link285 det.T1685.005Clear Windows Event Logs11 det.T1686Disable or Modify System Firewall19 det.