← Back to Actors
Dragonfly
DragonflyTEMP.IsotopeDYMALLOYBerserk BearTG-4192Crouching YetiIRON LIBERTYEnergetic BearGhost BlizzardBROMINE
[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Drag...
58
Techniques
53
Covered
5
Gaps
91%
Coverage
Coverage53/58
GAPS (5)
COVERED (53)
T1003.002Security Account Manager49 det.T1003.003NTDS36 det.T1003.004LSA Secrets18 det.T1005Data from Local System51 det.T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1021.001Remote Desktop Protocol55 det.T1033System Owner/User Discovery62 det.T1053.005Scheduled Task100 det.T1059Command and Scripting Interpreter552 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.006Python55 det.T1069.002Domain Groups45 det.T1070.001Clear Windows Event Logs16 det.T1070.004File Deletion46 det.T1071.002File Transfer Protocols1 det.T1074.001Local Data Staging10 det.T1078Valid Accounts320 det.T1083File and Directory Discovery49 det.T1087.002Domain Account58 det.T1098.007Additional Local or Domain Groups10 det.T1105Ingress Tool Transfer199 det.T1110Brute Force100 det.T1110.002Password Cracking2 det.T1112Modify Registry208 det.T1113Screen Capture19 det.T1114.002Remote Email Collection18 det.T1133External Remote Services80 det.T1135Network Share Discovery20 det.T1136.001Local Account46 det.T1187Forced Authentication23 det.T1189Drive-by Compromise13 det.T1190Exploit Public-Facing Application240 det.T1195.002Compromise Software Supply Chain24 det.T1203Exploitation for Client Execution81 det.T1204.002Malicious File468 det.T1210Exploitation of Remote Services40 det.T1221Template Injection1 det.T1505.003Web Shell70 det.T1547.001Registry Run Keys / Startup Folder53 det.T1560Archive Collected Data12 det.T1562.004Disable or Modify System Firewall50 det.T1564.002Hidden Users8 det.T1566.001Spearphishing Attachment1144 det.T1583.001Domains69 det.T1588.002Tool13 det.T1595.002Vulnerability Scanning13 det.T1598.002Spearphishing Attachment2 det.T1598.003Spearphishing Link353 det.T1685.005Clear Windows Event Logs12 det.T1686Disable or Modify System Firewall19 det.