Threat Intelligence Garden

Berserk Bear, Dragonfly 2.0

2 min read

Berserk Bear, Dragonfly 2.0

Description

Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least March 2016. There is debate over the extent of overlap between Dragonfly 2.0 and Energetic Bear, Dragonfly, but there is sufficient evidence to lead to these being tracked as two separate groups.

Names

NameName-Giver
Berserk BearCrowdStrike
Dragonfly 2.0Symantec
DymalloyDragos
G0074MITRE

Country

State-sponsored, FSB Centre 16L: Radio-Electronic Intelligence on Communications Facilities, Post Number 71330

Motivation

  • Sabotage and destruction

First Seen

2015

Observed Sectors

Observed Countries

Tools

Operations

  • 2015-12: Symantec has evidence indicating that the Dragonfly 2.0 campaign has been underway since at least December 2015 and has identified a distinct increase in activity in 2017. https://www.symantec.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks
  • 2017-05: Attack on nuclear facilities in the US Since May, hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries. Among the companies targeted was the Wolf Creek Nuclear Operating Corporation, which runs a nuclear power plant near Burlington, Kan., according to security consultants and an urgent joint report issued by the Department of Homeland Security and the Federal Bureau of Investigation last week. https://www.nytimes.com/2017/07/06/technology/nuclear-plant-hack-report.html http://fortune.com/2017/09/06/hack-energy-grid-symantec/
  • 2017-05: Attacks on critical infrastructure and energy companies around the world Since at least May 2017, Talos has observed attackers targeting critical infrastructure and energy companies around the world, primarily in Europe and the United States. These attacks target both the critical infrastructure providers, and the vendors those providers use to deliver critical services. Attacks on critical infrastructure are not a new concern for security researchers, as adversaries are keen to understand critical infrastructure ICS networks for reasons unknown, but surely nefarious. https://blog.talosintelligence.com/2017/07/template-injection.html https://www.us-cert.gov/ncas/alerts/TA18-074A

Information

Mitre Attack

Other Information

Uuid

3a78595b-3d41-401f-8e8c-ac527a854d08

Last Card Change

2025-08-16

Graph View

Backlinks