Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0035
MITRE ATT&CK Group

Dragonfly (G0035)

TEMP.IsotopeDYMALLOYBerserk BearTG-4192Crouching YetiIRON LIBERTYEnergetic BearGhost BlizzardBROMINE
ShareXLinkedInRedditHN

[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)

▪Techniques used (58)

T1560Archive Collected DataT1113Screen CaptureT1564.002Hidden Users

▪Software used (10)

S0500MCMDtoolS0039Nettool
G0035 on MITRE ATT&CK →
T1505.003Web Shell
T1204.002Malicious File
T1591.002Business Relationships
T1078Valid Accounts
T1016System Network Configuration Discovery
T1584.004Server
T1083File and Directory Discovery
T1136.001Local Account
T1221Template Injection
T1203Exploitation for Client Execution
T1110.002Password Cracking
T1608.004Drive-by Target
T1012Query Registry
T1566.001Spearphishing Attachment
T1189Drive-by Compromise
T1583.001Domains
T1003.002Security Account Manager
T1598.002Spearphishing Attachment
T1005Data from Local System
T1070.004File Deletion
T1059Command and Scripting Interpreter
T1685.005Clear Windows Event Logs
T1686Disable or Modify System Firewall
T1112Modify Registry
T1588.002Tool
T1195.002Compromise Software Supply Chain
T1036.010Masquerade Account Name
T1003.003NTDS
T1098.007Additional Local or Domain Groups
T1583.003Virtual Private Server
T1059.003Windows Command Shell
T1071.002File Transfer Protocols
T1598.003Spearphishing Link
T1053.005Scheduled Task
T1069.002Domain Groups
T1114.002Remote Email Collection
T1595.002Vulnerability Scanning
T1547.001Registry Run Keys / Startup Folder
T1105Ingress Tool Transfer
T1133External Remote Services
T1003.004LSA Secrets
T1190Exploit Public-Facing Application
T1135Network Share Discovery
T1110Brute Force
T1021.001Remote Desktop Protocol
T1187Forced Authentication
T1033System Owner/User Discovery
T1074.001Local Data Staging
T1059.001PowerShell
T1059.006Python
T1018Remote System Discovery
T1087.002Domain Account
T1210Exploitation of Remote Services
T0817Drive-by Compromise
T0862Supply Chain Compromise
S0357Impackettool
S0488CrackMapExectool
S0075Regtool
S0093Backdoor.Oldreamalware
S0002Mimikatztool
S0029PsExectool
S0094Trojan.Karaganymalware
S0108netshtool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.