Threat feed IOCs (28)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to ENERGETIC BEAR. Each row shows why it was linked and where it came from.

Public research & publications (37)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• fortune.comhttp://fortune.com/2017/09/06/hack-energy-grid-symantec/
• attack.mitre.orghttps://attack.mitre.org/groups/G0035
• community.broadcom.comhttps://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
• docs.broadcom.comhttps://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks
• vblocalhost.comhttps://vblocalhost.com/uploads/VB2021-Slowik.pdf
• cisa.govhttps://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions
• dragos.comhttps://www.dragos.com/threat/dymalloy/
• gov.ukhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet
• justice.govhttps://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical
• mandiant.comhttps://www.mandiant.com/resources/ukraine-crisis-cyber-threats
• secureworks.comhttps://www.secureworks.com/research/mcmd-malware-analysis
• secureworks.comhttps://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector
• secureworks.comhttps://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector
• attack.mitre.orghttps://attack.mitre.org/groups/G1000
• dragos.comhttps://dragos.com/resource/allanite/
• attack.mitre.orghttps://attack.mitre.org/groups/G0074
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/iron-liberty
• symantec.comhttps://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group
• us-cert.govhttps://www.us-cert.gov/ncas/alerts/TA18-074A
• web.archive.orghttps://web.archive.org/web/20161020180305/http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/
• paper.seebug.orghttps://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf
• netresec.comhttp://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans
• threatpost.comhttps://threatpost.com/energy-watering-hole-attack-used-lightsout-exploit-kit/104772/
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/crouching-yeti
• reuters.comhttps://www.reuters.com/article/us-ukraine-cyber-attack-energy-idUSKBN1521BA
• dragos.comhttps://dragos.com/wp-content/uploads/CrashOverride-01.pdf
• independent.iehttps://www.independent.ie/irish-news/statesponsored-hackers-targeted-eirgrid-electricity-network-in-devious-attack-36005921.html
• riskiq.comhttps://www.riskiq.com/blog/labs/energetic-bear/
• symantec-blogs.broadcom.comhttps://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks
• kaspersky.comhttps://www.kaspersky.com/resource-center/threats/crouching-yeti-energetic-bear-malware-threat
• sans.orghttps://www.sans.org/reading-room/whitepapers/ICS/impact-dragonfly-malware-industrial-control-systems-36672
• attack.mitre.orghttps://attack.mitre.org/groups/G0035/
• dragos.comhttps://dragos.com/adversaries.html
• dragos.comhttps://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/dymalloy