Threat group.View on attack.mitre.org
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.
| Technique | Procedure example |
|---|---|
| T1003.002 Security Account Manager |
Dragonfly has dropped and executed SecretsDump to dump password hashes. |
| T1003.003 NTDS |
Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers. |
| T1003.004 LSA Secrets |
Dragonfly has dropped and executed SecretsDump to dump password hashes. |
| T1005 Data from Local System |
Dragonfly has collected data from local victim systems. |
| T1012 Query Registry |
Dragonfly has queried the Registry to identify victim information. |
| T1016 System Network Configuration Discovery |
Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain. |
| T1018 Remote System Discovery |
Dragonfly has likely obtained a list of hosts in the victim environment. |
| T1021.001 Remote Desktop Protocol |
Dragonfly has moved laterally via RDP. |
| T1033 System Owner/User Discovery |
Dragonfly used the command |
| T1036.010 Masquerade Account Name |
Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account. |
| T1053.005 Scheduled Task |
Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files. |
| T1059 Command and Scripting Interpreter |
Dragonfly has used the command line for execution. |
| T1059.001 PowerShell |
Dragonfly has used PowerShell scripts for execution. |
| T1059.003 Windows Command Shell |
Dragonfly has used various types of scripting to perform operations, including batch scripts. |
| T1059.006 Python |
Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
