Dragonfly
IntrusionSet · ATTACK:enterprise:G0035
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0035",
"title": "Dragonfly",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0035",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
"external_id": "G0035",
"domain": "enterprise",
"created": "2017-05-31T21:32:05.217Z",
"modified": "2026-07-31T20:48:28.048Z",
"version": "4.0",
"aliases": [
"Dragonfly",
"TEMP.Isotope",
"DYMALLOY",
"Berserk Bear",
"TG-4192",
"Crouching Yeti",
"IRON LIBERTY",
"Energetic Bear",
"Ghost Blizzard",
"BROMINE"
],
"tactics": [
],
"source_references": [
{
"source_name": "DYMALLOY"
},
{
"source_name": "Berserk Bear"
},
{
"source_name": "TEMP.Isotope"
},
{
"source_name": "Ghost Blizzard"
},
{
"source_name": "BROMINE"
},
{
"source_name": "Crouching Yeti"
},
{
"source_name": "IRON LIBERTY"
},
{
"source_name": "TG-4192"
},
{
"source_name": "Dragonfly"
},
{
"source_name": "Energetic Bear"
},
{
"source_name": "CISA AA20-296A Berserk Bear December 2020",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"
},
{
"source_name": "DOJ Russia Targeting Critical Infrastructure March 2022",
"url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical"
},
{
"source_name": "Dragos DYMALLOY ",
"url": "https://www.dragos.com/threat/dymalloy/"
},
{
"source_name": "Fortune Dragonfly 2.0 Sept 2017",
"url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/"
},
{
"source_name": "Mandiant Ukraine Cyber Threats January 2022",
"url": "https://www.mandiant.com/resources/ukraine-crisis-cyber-threats"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Secureworks MCMD July 2019",
"url": "https://www.secureworks.com/research/mcmd-malware-analysis"
},
{
"source_name": "Secureworks IRON LIBERTY July 2019",
"url": "https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"
},
{
"source_name": "Secureworks Karagany July 2019",
"url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
},
{
"source_name": "Gigamon Berserk Bear October 2021",
"url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
},
{
"source_name": "Symantec Dragonfly Sept 2017",
"url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
},
{
"source_name": "Symantec Dragonfly",
"url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
},
{
"source_name": "Symantec Dragonfly 2.0 October 2017",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks"
},
{
"source_name": "UK GOV FSB Factsheet April 2022",
"url": "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet"
}
]
}Explicit source assertions (66)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0082e86b-a7b7-496b-af03-88785b6c8fbb
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08b30f76-ca12-4d2c-9345-ee51bfd54e9f
US-CERT TA18-074A · Symantec Dragonfly Sept 2017 · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1564.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ec90a7b-2ba7-4d7e-ac41-c5fdcf9e8046
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--103489a6-af80-4d4d-8aa7-ca973713e8da
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14dbc3a9-5e47-454a-805c-b8e22659362f
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1591.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d72046-2569-4517-9a8f-c9f4377df7ab
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0500
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18210ad3-d5ed-414e-9b7d-04fc622dc2e9
Secureworks MCMD July 2019ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1896ca51-adf4-4a3b-be89-1aae18465741
US-CERT TA18-074A · Gigamon Berserk Bear October 2021 · CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa94645-05e8-40ce-b8b7-c83a4e03d4e2
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20aaed95-65ce-4a0f-9e25-4a4156889a84
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21382ce2-a504-4adf-81d2-dc1306285553
CISA AA20-296A Berserk Bear December 2020 · Gigamon Berserk Bear October 2021 · US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23df34a9-9705-4efa-9f8f-90f4bcb1a310
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26c62507-1a2b-4235-b80c-d5f7f52d1c95
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c9e64fa-52a5-4233-a1b7-333e5d7b9d40
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ecdcdb3-6aa2-4888-921f-e9506ebbd00c
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1110.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e4e4075-1731-47b5-b95f-7e0b916556d5
US-CERT TA18-074A · Kali HydraATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--461ddc5d-889d-4879-ade3-27ff78d7e442
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d5240d1-508f-4cf0-bf38-9f9276894cbf
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--509eddb7-b86f-4831-953f-15017b5d987e
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5253d038-08a8-4d17-9549-bbcf67c37603
Secureworks IRON LIBERTY July 2019 · US-CERT TA18-074A · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62478274-7562-414a-9b03-f155f5a0d80b
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63759a0f-39e8-4d94-ab20-3bdba67ca502
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6385d0af-765c-44f9-afab-ed3852f6a22f
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68ece5ad-73bd-4562-ac08-877bd1e18f79
Core Security Impacket · US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f54be53-193e-49c0-aa8e-2b24caf436fd
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71de7fd6-177c-4964-9f2b-eec22937fded
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--769a2214-5e04-4290-a172-b770f8bb223e
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f4bb217-3a93-40bc-b15b-acb2e121ddf7
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--914014ba-ee7d-46da-ab51-609c1f67dec0
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99c360a2-7395-46e4-88fc-dbd757bed5bf
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b363538-86e1-446a-a4f8-b3045a7e8f68
Secureworks IRON LIBERTY July 2019ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1195.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3ada08-1908-4458-a454-d91fda25ad04
Secureworks IRON LIBERTY July 2019 · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1036.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0d99ee4-f154-42a0-8984-8e76d3e155c9
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a291d185-31c8-4458-a3fc-9af617af28d9
Core Security Impacket · US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0488
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a60d34fc-9c1e-4b36-a82b-56258445c7f0
Secureworks IRON LIBERTY July 2019 · US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1098.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8ad10f7-be41-4fb7-805b-f3b227e56b26
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae28ef39-1e4f-41e5-9ffa-877030753852
Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0198291-ac44-47c5-9730-c11acfb1999d
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8b1f3a0-0202-4a2e-a234-f181d45d683a
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bac1d1a4-14f7-4f68-8035-e322e94f92c9
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd2f28c5-7687-4d74-b3ad-42d2d62e4548
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bed23143-48a0-4883-ae33-416d60c27b5d
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a0d653-ff95-4c77-a129-c7f3398a56ca
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1114.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4f902df-4b79-4bf7-b4b3-5873a316795b
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5d4cfac-aa9a-4dfb-a991-e81f70a937e2
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6d4f484-bb75-4012-b756-f043e962aaa6
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb54c094-5614-4d45-ab13-c00ab2cdb114
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc6b3d5d-f77d-4c83-b484-1f2516133950
US-CERT TA18-074A · CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd849a7c-f63a-4157-b4c9-9385115da08a
Core Security Impacket · US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d06cd799-f61b-460e-a287-e58e8ff39022
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2f19ee3-8e1c-46e4-b803-e8b3fa36f62e
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0093
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4968f45-d06b-4843-8f72-6e08beb94cab
Symantec Dragonfly · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9bdae16-d3b3-4260-b1ef-2624cf4e836c
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db5bc5e2-fb3d-42a7-8fbc-b0aff2be6f8f
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1187
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db7707d7-5334-47b3-b203-0ee4fcbae5e9
US-CERT TA18-074A · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfd6892f-82a4-4db4-a132-3d6f221e55f4
Secureworks IRON LIBERTY July 2019ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e068332d-0b1c-4aba-a60f-37c640e20d10
Secureworks IRON LIBERTY July 2019 · US-CERT TA18-074A · Symantec Dragonfly Sept 2017 · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e13ba463-59c5-4e50-9aeb-420ab5e677db
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e15a2065-49a7-435f-b9ad-b45c4906aa74
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f24cbdeb-cf7b-43d9-87b0-9ab10ba74b60
US-CERT TA18-074A · Symantec Dragonfly Sept 2017ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2aa88d9-852b-4932-9881-d9c6f5d89779
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f35c994e-80a6-414a-ab81-1a2eb5fd0829
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5362c13-271a-486c-8665-996367599fd8
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa6f9dc7-e984-411a-9ce4-a822d4213bc6
US-CERT TA18-074AATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0094
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa9a8640-75e5-458c-99c0-e5e85aa32a77
Symantec Dragonfly · Secureworks Karagany July 2019 · Gigamon Berserk Bear October 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0108
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc6b1d58-05bf-41a0-a7fd-fcbbae894430
US-CERT TA18-074A